T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/musicful_api.py:28- Finding
Unrestricted API Base URL Can Exfiltrate Credentials and User Content
- Content
View full analysis
Dict[str, str]: key = api_key or DEFAULT_KEY if not key: raise RuntimeError( "MUSICFUL_API_KEY not configured. Edit: {} and set MUSICFUL_API_KEY=YOUR_KEY. " "Get/purchase a key at https://www.musicful.ai/api/authentication/interface-key/".format( _ENV_PATH ) ) return {"x-api-key": key, "Content-Type": "application/json"} def generate_lyrics(prompt: str, api_key: Optional[str] = None) -> Dict[str, Any]: url = f"{BASE_URL}/v1/lyrics" r = requests.post(url, json={"prompt": prompt}, headers=_headers(api_key), timeout=60) r.raise_for_status() j = r.json() return j.get("data", j) ``` ```python url = f"{BASE_URL}/v1/music/generate" data: Dict[str, Any] = { "action": action, "style": style, "mv": mv, "instrumental": instrumental, "gender": gender, } if prompt: data["prompt"] = prompt if action == "custom" and lyrics: data["lyrics"] = lyrics if title: data["title"] = title r = requests.post(url, json=data, headers=_headers(api_key), timeout=120) ``` ```python def query_tasks(task_ids: List[str], api_key: Optional[str] = None) -> List[Dict[str, Any]]: ids_str = ",".join(task_ids) url = f"{BASE_URL}/v1/music/tasks?ids={ids_str}" r = requests.get(url, headers=_headers(api_key), timeout=60) r.raise_for_status() return r.json().get("data", []) def generate_mp4(task_id: str, api_key: Optional[str] = None) -> Dict[str, Any]: url = f"{BASE_URL}/ ...[truncated 2956 chars]- Remediation
View remediation