T09 · Insecure Skill Coding Practices
Error
- Location
scripts/memory_semantic_consolidate.py:38- Finding
Private memory content and API credentials can be transmitted to an arbitrary endpoint
- Content
View full analysis
Dict[str, str]: """Load Anthropic API config from openclaw.json tui provider.""" base_url = os.environ.get("ANTHROPIC_BASE_URL", "") api_key = os.environ.get("ANTHROPIC_API_KEY", "") model = os.environ.get("SEMANTIC_LLM_MODEL", "claude-haiku-4-5-20251001") if not base_url or not api_key: try: cfg_path = Path.home() / ".openclaw" / "openclaw.json" cfg = json.loads(cfg_path.read_text("utf-8")) tui = cfg.get("models", {}).get("providers", {}).get("tui", {}) if not base_url: base_url = tui.get("baseUrl", "") if not api_key: api_key = tui.get("apiKey", "") except Exception: pass return {"base_url": base_url.rstrip("/"), "api_key": api_key, "model": model} def _call_anthropic(prompt: str, system: str, cfg: Dict[str, str]) -> Optional[str]: """Call Anthropic Messages API. Returns assistant text or None on failure.""" url = f"{cfg['base_url']}/v1/messages" body = json.dumps({ "model": cfg["model"], "max_tokens": 4096, "system": system, "messages": [{"role": "user", "content": prompt}], }).encode("utf-8") headers = { "Content-Type": "application/json", "x-api-key": cfg["api_key"], "anthropic-version": "2023-06-01", } try: req = Request(url, data=body, headers=headers, method="POST") with urlopen(req, timeout=60) as resp: data = json.loads(resp.read().decode("utf-8")) for block in data.get("content", []): if block.get("type") == "text": return block["text"] except Exception as exc: print(f"[semantic] LLM call fa ...[truncated 3601 chars]- Remediation
View remediation