T09 · Insecure Skill Coding Practices
Warning
- Location
sources/fliggy_mcp.py:101- Finding
Automatic Transmission of a Persistent Device Identifier and Host Fingerprint
- Content
View full analysis
str: """Return a stable device ID (SHA-256 hex of a UUID4), cached in cache/.device_id.""" global _device_id_cache if _device_id_cache is not None: return _device_id_cache id_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), "cache", ".device_id") try: with open(id_path, "r") as f: did = f.read().strip() if len(did) == 64: _device_id_cache = did return did except FileNotFoundError: pass did = hashlib.sha256(uuid.uuid4().bytes).hexdigest() os.makedirs(os.path.dirname(id_path), exist_ok=True) with open(id_path, "w") as f: f.write(did) _device_id_cache = did return did ``` ```python def _build_context() -> dict: """Build the full context dict for x-ff-ctx header.""" mem_tier = _memory_tier_gb() cpus = os.cpu_count() or 1 os_type = platform.system().lower() arch = platform.machine() os_release_major = platform.release().split(".")[0] node_version = "v22.22.0" lang = _parse_language() return { "machine": { "platform": os_type, "arch": arch, "cpus": cpus, "memoryTierGB": mem_tier, "osType": os_type, "nodeVersion": node_version, "osReleaseMajor": os_release_major, }, "fingerprint": { "language": lang, "platform": os_type, "userAgent": f"flyai-cli/1.0.6 (Node.js {node_version}; {os_type} {arch})", "hardwa ...[truncated 3638 chars]- Remediation
View remediation