T09 · Insecure Skill Coding Practices
Error
- Location
scripts/memory_sync.py:547- Finding
Unauthenticated REST API Exposes Shared Agent Memory
- Content
View full analysis
/"}, 400) return agent_id, key = parts value = self.memory.agent_read(agent_id, key) if value is not None: self._json_response({"key": key, "agent_id": agent_id, "value": value}) else: self._json_response({"error": "Key not found or expired"}, 404) ``` ```python if path == "/write": agent_id = data.get("agent_id") key = data.get("key") value = data.get("value") ttl = data.get("ttl") schema_type = data.get("schema") if not agent_id or not key or value is None: self._json_response({ "error": "Missing required fields: agent_id, key, value" }, 400) return # Schema validation if schema_type: if isinstance(value, dict): inner = value.get("data", value) valid, errors = validate_schema(schema_type, inner) if not valid: self._json_response({ "error": "Schema validation failed", "schema": schema_type, "errors": errors }, 422) return success = self.memory.agent_write(agent_id, key, value, ttl) ``` ```python def _json_response(self, data, status=200): body = json.dumps(data, indent=2, ensure_ascii=False).encode("utf-8") self.send_response(status) self.send_header("Content-Type", "application/json") self.send_header("Content-Length", str(len(body))) self.send_header("Access-Control-Allow-Origin", "*") self.end_headers() self.wfile.write(body) ``` ### Technical Analysis The REST server ...[truncated 2456 chars]- Remediation
View remediation