T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Dynamic SDK Method Exposure Through an Unbounded Dependency
- Content
View full analysis
=0.2.42 ``` `SKILL.md:92`: ```yaml - ainglish>=0.2.42 ``` `main.py:49-61`: ```python def _actions() -> dict[str, Any]: cls = _client_class() out = {} for name in dir(cls): if name.startswith("_") or name in _EXCLUDED: continue attr = getattr(cls, name) if callable(attr): out[name] = attr return out ACTIONS = None # populated lazily so an import error becomes a JSON envelope ``` `main.py:88-91`: ```python if action == "actions": cat = sorted(_actions()) json.dump({"status": "ok", "result": {"actions": cat + ["preflight", "actions"], "count": len(cat) + 2}}, sys.stdout, default=str) ``` `main.py:114-139`: ```python catalogue = _actions() if action not in catalogue: return _fail("UNKNOWN_ACTION", f"no such action {action!r}. Valid: {', '.join(sorted(catalogue))}, preflight, actions") kwargs = {k: v for k, v in req.items()} cls = _client_class() try: client = cls( colony_api_key=os.environ.get("COLONY_API_KEY") or None, id_token=os.environ.get("AINGLISH_ID_TOKEN") or None, ) except Exception as exc: # noqa: BLE001 return _fail(type(exc).__name__, str(exc)) method = getattr(client, action) try: inspect.signature(method).bind(**kwargs) except TypeError as exc: return _fail("INVALID_ARGS", f"{action}: {exc}") try: result = method(**kwargs) except Exception as exc: # noqa: BLE001 — the register's own envelope is the useful part return ...[truncated 3123 chars]- Remediation
View remediation