T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:67- Finding
Unrestricted URL Fetching Enables SSRF and External Data Disclosure
- Content
View full analysis
Optional[str]: """Get URL content""" default_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" } if headers: default_headers.update(headers) try: resp = requests.get(url, headers=default_headers, timeout=30) resp.raise_for_status() return resp.text except Exception as e: log(f"getURLfail: {url} - {e}", "error") return None def call_llm(prompt: str) -> Optional[str]: """Call LLM API""" if not OPENAI_API_KEY: log("OPENAI_API_KEY environment variable not set", "error") return None try: import openai client = openai.OpenAI( api_key=OPENAI_API_KEY, base_url=OPENAI_BASE_URL, ) resp = client.chat.completions.create( model=DEFAULT_MODEL, messages=[ {"role": "system", "content": "You are a professional scientific content summary assistant."}, {"role": "user", "content": prompt}, ], temperature=0.3, ) return resp.choices[0].message.content ``` ```python # Get target URL target_url = args.url if not target_url: log(f"Getting latest {PODCAST_SOURCES[args.podcast]['name']} English...") if args.podcast == "huberman": target_url = get_latest_huberman_url() else: target_url = get_latest_nature_url() if not target_url: log("Unable to get podcast URL", "error") sys.exit(1) log(f"parse page: {target_url}") # Get page content html = fetch_url(target_url) if not html: sys.exit(1) # parse content if args.podcast == "huberman": ep ...[truncated 3037 chars]- Remediation
View remediation