other
Warning
- Location
scripts/call_api.py:50- Finding
Unnecessary External API Access and Credential Transmission for Local Date Formatting
- Content
View full analysis
HttpResult: """调用小笨羊MCP工具""" url = f"{settings.base_url}/api" mcp_id = mcp_id or settings.mcp_id api_key = get_api_key() if not api_key: raise UpstreamError("API密钥未设置，请先调用 set_api_key()") headers = { "XBY-APIKEY": api_key, "func": tool_name, "mcpid": mcp_id, "Content-Type": "application/json", } # data = {k: str(v) if v is not None else "" for k, v in params.items()} t0 = time.time() try: resp = self._session.post( url=url, headers=headers, data=json.dumps(params), timeout=settings.timeout_seconds, ) ``` The corresponding tool invocation is: ```python arguments = { "format": format } return call_api("1777419075044355", "get_datetime", arguments) ``` ### Technical Analysis The Skill's stated capability is formatting the current date and time. This operation can be performed entirely locally using standard date/time libraries, but the implementation requires a third-party API key and sends that credential in the `XBY-APIKEY` HTTP header to `https://mcp.xiaobenyang.com/api`. Although the external request is documented and HTTPS is used, requiring remote access for a local formatting operation violates data-minimization and least-capability principles. It unnecessarily expands the trust boundary to include the remote service, DNS resolution, certificate authorities, network infrastructure, and the remote operator. The transmitted data includes the API credential, selected MCP identifier, tool name, requested format, and request timing m ...[truncated 1189 chars]- Remediation
View remediation