T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ecommerce_product_kit.py:28- Finding
Unrestricted API endpoint overrides can expose credentials and task data
- Content
View full analysis
Dict[str, str]: ak = _require_ak() return { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json", "Origin": "https://www.designkit.cn", "Referer": "https://www.designkit.cn/product-kit/?from=home", "X-Openclaw-AK": ak, "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) " "AppleWebKit/537.36 (KHTML, like Gecko) " "Chrome/120.0.0.0 Safari/537.36", } ``` ```python # scripts/ecommerce_product_kit.py:228-233 headers = _headers_json() if json_mode and body else _headers_get() if body and "Content-Type" not in headers: headers["Content-Type"] = "application/json" _request_log_http_summary(method, url, headers, body, timeout=120) req = urllib.request.Request(url, data=body, headers=headers, method=method) ``` ```python # scripts/openclaw_atomic_runner.py:180-189 def http_json_post(url: str, ak: str, body: bytes) -> Tuple[int, Any, str]: headers = { "Content-Type": "application/json", "X-Openclaw-AK": ak, } return http_request("POST", url, headers, body, timeout=120) def http_json_get(url: str, ak: str) -> Tuple[int, Any, str]: headers = {"X-Openclaw-AK": ak} return http_request("GET", url, headers, None, timeout=120) ``` ```python # scripts/openclaw_atomic_runner.py:391-406 api_base = n ...[truncated 2668 chars]- Remediation
View remediation