T09 · Insecure Skill Coding Practices
Error
- Location
scripts/register.js:19- Finding
API Key Disclosure Through Attacker-Controlled Base URL and Plaintext HTTP
- Content
View full analysis
= 0 && idx + 1 < args.length ? args[idx + 1] : null } // ─── HTTP helper ───────────────────────────────────────────────────────────── function request(method, urlPath, body) { return new Promise((resolve, reject) => { const url = new URL(urlPath, BASE_URL) const mod = url.protocol === 'https:' ? https : http const opts = { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: url.pathname + url.search, method, headers: { 'Content-Type': 'application/json', ...(API_KEY ? { 'Authorization': `Bearer ${API_KEY}` } : {}), 'User-Agent': 'OpenClaw-AgentConnex/1.0', }, } ``` From `scripts/heartbeat-sync.js`: ```js const API_KEY = process.env.AGENTCONNEX_API_KEY const BASE_URL = process.env.AGENTCONNEX_URL || 'https://agentconnex.com' const SLUG = process.env.AGENTCONNEX_SLUG if (!API_KEY || !SLUG) { // Silently skip if not configured process.exit(0) } function request(method, urlPath, body) { return new Promise((resolve, reject) => { const url = new URL(urlPath, BASE_URL) const mod = url.protocol === 'https:' ? https : http const opts = { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: url.pathname, method, h ...[truncated 2326 chars]- Remediation
View remediation