T09 · Insecure Skill Coding Practices
Error
- Location
scripts/content_engine/llm.py:53- Finding
OpenRouter credentials can be transmitted to the Ofox API
- Content
View full analysis
str | None: """env > .env file sources. OPENROUTER_API_KEY is accepted as a fallback.""" for var in ("OFOX_API_KEY", "OPENROUTER_API_KEY"): if v := os.environ.get(var): return v.strip() for path_fn in _TOKEN_SEARCH_PATHS: try: path = path_fn() except Exception: continue if not path.exists() or not path.is_file(): continue try: for line in path.read_text(encoding="utf-8").splitlines(): line = line.strip() for var in ("OFOX_API_KEY", "OPENROUTER_API_KEY"): if line.startswith(f"{var}="): val = line.split("=", 1)[1].strip() return val.strip('"').strip("'") except (OSError, UnicodeDecodeError): continue return None ``` ```python self.api_key = api_key or _load_ofox_key() if not self.api_key: raise OfoxError(_help_message()) self.base_url = ( base_url or os.environ.get("OFOX_BASE_URL") or OFOX_BASE_URL ).rstrip("/") ``` ```python req = urllib.request.Request( url, data=body, headers={ "Content-Type": "application/json; charset=utf-8", "Authorization": f"Bearer {self.api_key}", }, method="POST", ) ``` ### Technical Analysis The credential loader treats `OPENROUTER_API_KEY` as interchangeable with `OFOX_API_KEY`. However, selecting an OpenRouter credential does not select an OpenRouter endpoint. Unless separately overridden, the client continues using the default Ofox origin, `https://api.ofox.ai`. Consequently, a credential issued by OpenRouter is placed in an HTTP `Authorization` header and disclosed to Ofox. Credential compatibility cannot safely b ...[truncated 1125 chars]- Remediation
View remediation