IMA AI Video Generator — Short & Promo Video, Text to Video, Image to Video Generation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:51 AM UTC
• Version: 1.0.13

Overview

This appears to be a real video-generation skill, but its API-key handling creates credible leakage risks that users should review before installing.

Before installing, use a scoped or test IMA key, ensure IMA_BASE_URL, IMA_IM_BASE_URL, and --base-url point only to trusted IMA HTTPS endpoints, do not run troubleshooting commands that print the full API key, and inspect or delete ~/.openclaw/logs/ima_skills/ after failures because logs may contain sensitive request details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ima_runtime/shared/client.py:78
• Finding: Primary API Credential Exposed in Upload-Token Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ima_runtime/shared/client.py:78-96` **Vulnerability Type**: Credential exposure through URL query parameters **Risk Level**: High ### Vulnerable Code ```python url = f"{im_base_url}/api/rest/oss/getuploadtoken" params = { "appUid": api_key, "appId": APP_ID, "appKey": APP_KEY, "cmimToken": api_key, "sign": sign, "timestamp": ts, "nonce": nonce, "fService": "privite", "fType": "picture", "fSuffix": suffix, "fContentType": content_type, } logger.info(f"Getting upload token: suffix={suffix}") try: resp = requests.get(url, params=params, timeout=30) ``` ### Technical Analysis The upload-token request places the primary `IMA_API_KEY` in two GET query parameters: `appUid` and `cmimToken`. Although HTTPS protects the request while it is in transit, it does not prevent the complete URL from being retained by the destination server, reverse proxies, load balancers, network monitoring products, or exception diagnostics. Query parameters are unsuitable for long-lived authentication credentials because URLs are routinely treated as loggable metadata. Reusing the primary API credential for the upload service also gives the upload-token flow more authority than a narrowly scoped, short-lived upload credential would require. The upload operation is necessary for local media, but transmitting the primary credential in the URL exceeds a safe minimum-privilege design. ### Attack Path 1. The operator supplies a local media file or triggers upload of a derived video cover. 2. The runtime calls `get_upload_token()`. 3. The primary API key is serialized into the request URL as both `appUid` and `cmimToken`. 4. An HTTP access log, reverse-proxy log, monitoring system, or diagnostic record stores the complete URL. 5. A party with access to that record extracts the API key. 6. The exposed key can be replayed against APIs that accept the same credential. ### Impact Ass ...[truncated 436 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the GET request with an authenticated POST request. 2. Transmit authentication through an `Authorization` header rather than query parameters. 3. Do not reuse the primary API key as both an account identifier and upload token. 4. Have the primary API issue a short-lived, upload-only credential with restricted object size, content type, destination, and expiration. 5. Ensure reverse proxies and application servers redact authentication fields. 6. Rotate API keys that may already have appeared in URL logs. 7. Add automated tests asserting that prepared request URLs never contain `IMA_API_KEY`, `appUid`, or `cmimToken` credential values. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ima_runtime/shared/client.py:111
• Finding: Upload-Token Failures May Persist API Credentials in Logs and Error Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ima_runtime/shared/client.py:111-113` **Vulnerability Type**: Sensitive information exposure through exception logging **Risk Level**: High ### Vulnerable Code ```python except requests.RequestException as e: logger.error(f"Failed to get upload token: {e}") raise RuntimeError(f"Failed to get upload token: {e}") ``` The referenced logger writes messages to persistent files: ```python file_handler = RotatingFileHandler( log_file, maxBytes=max_bytes, backupCount=backup_count, encoding='utf-8' ) file_handler.setLevel(log_level) file_handler.setFormatter(formatter) logger.addHandler(file_handler) ``` ### Technical Analysis The preceding upload-token request embeds the API key in the request URL. A `requests.RequestException` can include the prepared request URL in its string representation. The handler records the raw exception in `~/.openclaw/logs/ima_skills/` and then includes the same value in a newly raised `RuntimeError`. No redaction filter removes `appUid`, `cmimToken`, bearer tokens, or key-shaped values. The propagated exception can additionally reach stderr, an Agent transcript, a process supervisor, or centralized log collection. The vulnerability is most readily triggered by connection, timeout, TLS, proxy, or HTTP failures occurring after the credential-bearing URL has been prepared. ### Attack Path 1. A local-media upload initiates the upload-token request. 2. The request URL is prepared with the API key in its query string. 3. The request fails because of a network, proxy, TLS, timeout, or HTTP error. 4. The exception string includes the credential-bearing URL. 5. The logger writes the exception to a persistent log file, and the runtime propagates it to its caller. 6. A local log reader, support recipient, terminal recorder, or centralized logging operator obtains the key. 7. The key is replayed against the IMA service. ### Impact Assessment The exposure ...[truncated 359 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove credentials from URLs as described in the preceding finding. 2. Do not log raw `requests` exceptions for authenticated requests. 3. Log only sanitized fields such as exception class, destination hostname, status code, and a generated correlation identifier. 4. Install a global logging filter that redacts: - `Authorization` values - `appUid` - `cmimToken` - API-key patterns such as `ima_*` 5. Return a generic user-facing transport error instead of propagating the raw exception. 6. Create log files and directories with owner-only permissions, such as `0700` for directories and `0600` for files. 7. Review and securely delete existing logs that may contain credential-bearing URLs. 8. Add failure-path tests that inspect logs and exception messages for leaked secrets. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ima_runtime/shared/config.py:5
• Finding: Configurable API Origins Allow Bearer Credentials to Be Sent to Arbitrary Hosts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ima_runtime/shared/config.py:5-6` **Vulnerability Type**: Unvalidated credential destination **Risk Level**: High ### Vulnerable Code The API destinations can be replaced through environment variables: ```python DEFAULT_BASE_URL = os.getenv("IMA_BASE_URL", "https://api.imastudio.com") DEFAULT_IM_BASE_URL = os.getenv("IMA_IM_BASE_URL", "https://imapi.liveme.com") ``` The primary endpoint is also exposed as a CLI argument: ```python parser.add_argument("--base-url", default=DEFAULT_BASE_URL, help="API base URL") ``` The resulting value is used directly when attaching the bearer credential: ```python url = f"{base_url}/open/v1/product/list" params = {"app": app, "platform": platform, "category": category} headers = make_headers(api_key, language) logger.info(f"Query product list: category={category}, app={app}, platform={platform}") try: resp = requests.get(url, params=params, headers=headers, timeout=30) ``` Compliance verification follows the same pattern: ```python url = f"{base_url}/open/v1/assets/verify" headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", "User-Agent": "IMA-OpenAPI-Client/ima-video-ai", "x-app-source": "ima_skills", "x_app_language": "en", } payload = {"url": asset_url} if asset_name: payload["name"] = asset_name[:64] response = requests.post(url, json=payload, headers=headers, timeout=300) ``` ### Technical Analysis No validation ensures that `base_url` is HTTPS or that its hostname is `api.imastudio.com` before the bearer token is attached. Likewise, `IMA_IM_BASE_URL` controls the destination that receives the API key in the upload-token flow. Consequently, a modified environment variable, unsafe wrapper, copied command, or configuration mistake can redirect credentials to an attacker-controlled origin. Plain HTTP destinations are also not explicitly rejected, allowing credentials to be exposed in t ...[truncated 1482 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate API origins before constructing any authenticated request. 2. In production, allow only: - `https://api.imastudio.com` - `https://imapi.liveme.com` 3. Reject HTTP, embedded credentials, fragments, unexpected ports, non-approved hostnames, and malformed URLs. 4. Apply validation immediately before adding authentication headers, not only when parsing CLI arguments. 5. Remove environment-based endpoint replacement from production builds if it is unnecessary. 6. If custom endpoints are required for testing: - Require an explicit `--unsafe-development-endpoint` option. - Display a clear warning. - Refuse to use production-shaped credentials. - Require a separate test key. 7. Consider disabling environment proxy inheritance for credential-bearing requests or document and constrain trusted proxy use. 8. Add tests confirming that no credential is sent when the endpoint is HTTP, unapproved, malformed, or attacker-controlled. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/operations/troubleshooting.md:17
• Finding: Troubleshooting Instructions Print the Complete API Key<![CDATA[ ## Vulnerability Details **File Location**: `references/operations/troubleshooting.md:17-22` **Vulnerability Type**: Secret disclosure through unsafe diagnostic guidance **Risk Level**: Medium ### Vulnerable Code ```bash echo "$IMA_API_KEY" python3 scripts/ima_runtime_doctor.py --task-type text_to_video export IMA_API_KEY="ima_xxxxxxxx" python3 scripts/ima_runtime_doctor.py --task-type text_to_video python3 scripts/ima_runtime_cli.py --task-type text_to_video --list-models --output-json ``` ### Technical Analysis The authentication troubleshooting procedure instructs operators to print the complete API key. This is unnecessary when the diagnostic goal is only to determine whether the environment variable exists or has a plausible format. Terminal output can be retained by shell-session recording, CI logs, support transcripts, screen sharing, command-execution agents, terminal multiplexers, or copied diagnostic output. The command therefore expands a secret from process environment storage into a significantly broader disclosure surface. ### Attack Path 1. An operator experiences an authentication error. 2. The operator follows the documented troubleshooting steps. 3. `echo "$IMA_API_KEY"` prints the complete credential. 4. A terminal recorder, support transcript, shared screen, CI log, or Agent conversation captures the output. 5. A party with access to that record obtains and reuses the key. ### Impact Assessment A disclosed key may allow unauthorized use of the victim’s IMA account within the credential’s server-side scope, including submission of generation tasks and consumption of account credits. The issue does not provide local operating-system access, but it can compromise the associated external service account. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the secret-printing command with a presence check: ```bash if test -n "$IMA_API_KEY"; then echo "IMA_API_KEY is set" else echo "IMA_API_KEY is missing" fi ``` 2. If format inspection is necessary, display only a masked prefix and suffix. 3. Warn users never to paste API keys into support tickets, chat sessions, screenshots, or issue reports. 4. Ensure doctor and setup commands report only whether the key exists and whether authentication succeeded. 5. Add secret-scanning checks to documentation review so examples do not encourage printing credentials. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:4
• Finding: Open-Ended Dependency Constraints Prevent Reproducible, Integrity-Verified Installation<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:4-5` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Low ### Vulnerable Code ```text requests>=2.25.0 Pillow>=10.0.0 ``` The documented installation command is: ```text pip install -r requirements.txt ``` ### Technical Analysis The dependency declarations specify only minimum versions. Any future version of `requests` or `Pillow` satisfying the lower bound can therefore be installed without repository review. The project does not provide a lock file or package hashes to verify that the installed artifacts match reviewed builds. No evidence of typosquatting, dependency confusion, or a currently malicious package was found; both package names are established projects. The risk is reduced reproducibility and exposure to compromised, incompatible, or unexpectedly changed future releases. ### Attack Path 1. An operator runs the documented `pip install -r requirements.txt` command. 2. The package resolver selects the newest available versions satisfying the minimum constraints. 3. A future compromised or unsafe release, compromised package index response, or incompatible transitive dependency is selected. 4. The dependency executes during installation or when the Skill processes network data or media files. 5. The dependency runs with the privileges of the user invoking the Skill. ### Impact Assessment A compromised dependency would execute with the local privileges of the installing or running user. That could expose the API key, prompts, local media selected for upload, preference files, logs, and other files accessible to that user. The current repository does not establish that such a compromised package exists, so this is a preventive supply-chain finding rather than evidence of active malicious behavior. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin reviewed direct dependency versions using exact constraints. 2. Generate and commit a reproducible lock file including transitive dependencies. 3. Use package hashes and install with `pip --require-hashes`. 4. Update dependencies through a controlled review process with automated vulnerability scanning. 5. Use an isolated virtual environment rather than installing into a privileged or shared Python environment. 6. Test pinned updates against representative image, video, network, and error-handling paths before release. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a user-facing AI video generator with support for multiple models and generation modes. However, the supplied code does not implement any video generation, model invocation, media processing, or API-key-based external service access. Instead, it manages logging: creating directories in the user's home folder, writing rotating log files, optionally emitting console logs, and deleting old log files. While logging can be a supporting detail in a larger skill, this code chunk by itself has a materially different purpose from the declared functionality and introduces filesystem behavior not mentioned in the description. Therefore this chunk does not accurately represent the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises a fully featured AI video generation capability with support for numerous models and workflows. However, the supplied code chunk contains only an empty package initializer with a docstring. Based on the provided code alone, there is no implemented behavior matching the declared functionality. This is a material description-behavior mismatch because the actual code does not demonstrate the primary purpose or capabilities described.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a feature-rich AI video generation skill, but the provided code chunk is only a minimal package initializer that exposes `print_model_summary`. Based on this code alone, the implemented behavior is limited to module export setup and possibly CLI presentation support. There is no evidence of any of the core claimed capabilities, no model integration, and no use of the declared API dependency. This is a material mismatch between declared purpose and actual code behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description centers on producing AI videos across several generation modes and models. In contrast, this code only validates setup and connectivity: it checks IMA_API_KEY, queries available products/models, handles errors, and prints recommendations. It explicitly says 'No paid generation task was created,' which directly indicates it does not generate videos. While this could be a supporting utility within a larger video-generation skill, the supplied code chunk itself does not match the declared primary behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises a full-featured AI video generation capability with multiple named models, input modes, and use cases. The provided code chunk contains only module initialization logic that imports and exports `route_request`. This is materially insufficient to substantiate the declared purpose. While this file could be part of a larger implementation, the supplied chunk itself does not match the claimed behavior and instead serves as a generic routing/package interface component.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents the skill as an operational AI video generator with multiple generation modes and model options. However, the supplied code chunk only implements setup flow behavior: collecting or reading IMA_API_KEY, prompting for a task type, retrieving available models from an API, selecting a model, saving preferences, and printing CLI next steps. While these actions are related to supporting a video generation system, they do not match the declared primary purpose of generating videos. This is a material description-to-behavior mismatch because the code shown is configuration logic, not generation functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents the skill as an AI video generator with various generation modes and model support. However, the supplied code only contains shared error-handling utilities: model-name normalization, extraction of HTTP/API/timeout errors, diagnosis of likely failure causes, parameter degradation suggestions, and formatting of user-facing error messages. While these behaviors are related to a video generation system, they do not implement the advertised primary capability of generating videos. There is no code here that submits generation jobs, processes prompts/images into video, or interfaces with the named models directly. This is therefore a material description-versus-behavior mismatch for the supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description promises a comprehensive multi-model AI video generation skill with several generation modes. This code chunk does not implement generation behavior and does not cover most of the advertised models or features. Instead, it is a narrow support module for Seedance-related model capability lookup and compliance requirements for a few task types. While image-to-video, first-last-frame, and reference-image-to-video are partially reflected, the primary behavior in this chunk is metadata validation for two specific models, not the broad functionality claimed in the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises a full-featured AI video generator with multiple generation modes and model integrations. The actual code shown is only a minimal package initializer that imports and exports `build_confirmable_plan`. There is no evidence in this chunk of video generation, media processing, model invocation, API-key usage, or any of the advertised capabilities. This is a material mismatch in primary purpose based on the supplied code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises a feature-rich AI video generation capability using multiple named models and generation modes. The actual code chunk does not implement any video generation behavior, external API access, model orchestration, media handling, or related workflow logic. It merely returns the input plan unchanged. This is a materially different primary purpose from the declared description, so the description does not accurately represent the supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description promises a full-featured AI video generation capability with specific generation modes and model support. The actual code chunk is a thin orchestration wrapper for workflow planning: it builds a workflow plan from a request and converts it to a confirmable plan. There is no evidence in this code of generating videos, handling images, invoking any of the listed models, or using IMA_API_KEY. While this could be an internal supporting component of a larger system, based on the supplied chunk alone the behavior does not match the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared description promises a full AI video generator with specific models, generation modes, and media capabilities. However, the supplied code chunk only initializes logging, constructs a parser, and calls external CLI runtime functions. On its own, this code does not demonstrate the described video-generation behavior, model access, or API-key use. Because the actual chunk’s observable behavior is a generic command-line launcher rather than an AI video generation implementation, the description does not accurately represent this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents the skill as a full AI video generator with multiple generation modes and model options. The supplied code does not implement video generation; it builds a CLI parser for a 'video doctor' tool and calls a doctor/check flow intended to verify environment and connectivity cheaply without creating a paid task. That is a materially different primary purpose from generating videos. While it references the same IMA video ecosystem and API key, this chunk's behavior is diagnostic/support functionality that is not represented in the declared description, so this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description presents a full-featured AI video generator skill with multiple generation modes and model support. However, this code chunk does not implement video generation. It defines a command-line setup utility for onboarding and configuration, specifically to choose a model preference and pass runtime settings such as API key, base URL, language, and user ID. While this may be related support code for the broader skill, the supplied chunk’s actual purpose is materially different from the declared primary purpose, so this should be flagged as a mismatch.

Memory Manipulation

High

• Category: Memory Poisoning

Content

- create-time API errors: bad auth, credit issues, attribute/rule mismatch, invalid params
- transport errors: request failures from `requests`
- poll-time task failures: explicit media error, delete state, backend-reported failure
- timeout: no terminal success before `VIDEO_MAX_WAIT_SECONDS`

## User-Facing Boundary

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The keyword list is extremely broad and repetitive, covering many generic phrases like 'AI video generator,' 'video generator,' 'short video generator,' and 'image to video' without clear activation boundaries. This can cause the skill to trigger on routine video-related user requests, increasing the chance of over-invocation, unintended routing, and misuse of a skill that requires an API key and can initiate external content generation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares broad capabilities including environment access, filesystem persistence, network access, and shell/runtime execution, but it does not define any explicit tool scope such as permissions or allowed-tools. In an agent environment, this increases risk because the runtime may grant more access than is minimally necessary, making unintended file writes, command execution, or network interactions harder to constrain and audit.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown file documents a live clarification message entirely in Chinese, with no indication that the user's preferred language is detected or that alternative locales are supported. That creates a natural-language policy concern because it appears to force a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The troubleshooting guidance explicitly tells users to run `echo "$IMA_API_KEY"`, which prints a live secret to the terminal and can expose it through shell history capture, terminal logs, screen sharing, CI job logs, or remote support sessions. In the context of an API-backed video generation skill, exposure of the key could allow unauthorized use of the account, consumption of credits, and access under the user's billing identity.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The code returns a user-facing clarification question and answer options entirely in Chinese. This forces a specific language for the interaction without any visible opt-in, fallback, or justification that the skill is region-specific.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The function makes a remote product-list request and transmits the API key, but the user-facing output only says 'Doctor checks' and 'API key: present' without clearly warning that a network request will be sent to the configured base URL. While errors and progress are printed, there is no explicit disclosure before the outbound call about contacting the service with provided credentials.

Tainted flow: 'ful' from requests.get (line 104, network input) → requests.put (network output)

Medium

• Category: Data Flow

Content

logger.info(f"Uploading {len(image_bytes)} bytes to OSS...")

    try:
        resp = requests.put(ful, data=image_bytes,
                           headers={"Content-Type": content_type}, timeout=60)
        resp.raise_for_status()
        logger.info("Upload successful")

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Tainted flow: 'task_id' from requests.post (line 356, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

f"Please check your creation record at {VIDEO_RECORDS_URL}."
            )

        resp = requests.post(url, json={"task_id": task_id},
                             headers=headers, timeout=30)
        resp.raise_for_status()
        data = resp.json()

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function sends the asset URL and optional asset name to an external verification endpoint and includes an Authorization bearer token in the request headers. In this file there is no confirmation prompt, logging, print statement, or explanatory comment/docstring disclosing that user or system data is transmitted to a remote service.

External Transmission

Medium

• Category: Data Exfiltration

Content

if asset_name:
        payload["name"] = asset_name[:64]

    response = requests.post(url, json=payload, headers=headers, timeout=300)
    try:
        data = response.json()
    except ValueError as exc:

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.