T09 · Insecure Skill Coding Practices
Error
- Location
scripts/utils.py:13- Finding
Unvalidated API Base URL Can Exfiltrate Credentials and Sensitive User Content
- Content
View full analysis
Dict[str, Any]: base_url = MINIMAX_API_BASE_BACKUP if use_backup else MINIMAX_API_BASE url = f"{base_url}/{endpoint.lstrip('/')}" if files: headers = { "Authorization": f"Bearer {MINIMAX_VOICE_API_KEY}", "Accept-Encoding": "gzip, deflate", } else: headers = get_headers() response = requests.request( method=method, url=url, headers=headers, json=data if not files else None, data=data if files else None, files=files, params=params, timeout=timeout, ) response.raise_for_status() return response.json() ``` Related TTS sink in `scripts/sync_tts.py`: ```python headers = get_headers() url = f"{MINIMAX_API_BASE}/t2a_v2" with requests.post( url, headers=headers, json=payload, stream=True, timeout=300 ) as response: response.raise_for_status() ``` Related biometric audio upload sink in `scripts/voice_clone.py`: ```python import requests url = f"{MINIMAX_API_BASE}/files/upload" headers = {"Authorization": f"Bearer {MINIMAX_VOICE_API_KEY}"} with open(file_path, "rb") as f: files = {"file": (os.path.basename(file_path), f)} ...[truncated 2923 chars]- Remediation
View remediation