T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.py:18- Finding
API Credentials and User Content Are Sent to a Third-Party Relay by Default
- Content
View full analysis
str: if cli_key: return cli_key for var in ("OPENAI_API_KEY", "BIANXIE_API_KEY", "IMAGE_API_KEY"): v = os.environ.get(var) if v: return v raise SystemExit( "[edit] no API key. Pass --api-key, or export OPENAI_API_KEY / " "BIANXIE_API_KEY / IMAGE_API_KEY." ) ``` ```python ap.add_argument("--api-key", default=None, help="API key; falls back to OPENAI_API_KEY / " "BIANXIE_API_KEY / IMAGE_API_KEY env vars") ap.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL", DEFAULT_BASE_URL), help=f"OpenAI-compatible base url (default {DEFAULT_BASE_URL}, " "or $OPENAI_BASE_URL)") ``` ```python api_key = resolve_api_key(args.api_key) client = OpenAI(api_key=api_key, base_url=args.base_url) ``` ```python files = [open(img_path, "rb")] mask_fh = open(args.mask, "rb") if args.mask else None try: kwargs = dict( model=args.model, image=files, prompt=args.prompt, size=args.size, n=args.n, quality=args.quality, response_format="b64_json", ) if args.background: kwargs["background"] = args.background if mask_fh is not None: kwargs["mask"] = mask_fh resp = client.images.edit(**kwargs) finally: for f in files: ...[truncated 3046 chars]- Remediation
View remediation