T09 · Insecure Skill Coding Practices
Error
- Location
scripts/content_engine/llm.py:52- Finding
OpenRouter API credentials are transmitted to the Ofox endpoint
- Content
View full analysis
str | None: """Load credentials from environment variables or supported configuration files.""" for var in ("OFOX_API_KEY", "OPENROUTER_API_KEY"): if v := os.environ.get(var): return v.strip() for path_fn in _TOKEN_SEARCH_PATHS: try: path = path_fn() except Exception: continue if not path.exists() or not path.is_file(): continue try: for line in path.read_text(encoding="utf-8").splitlines(): line = line.strip() for var in ("OFOX_API_KEY", "OPENROUTER_API_KEY"): if line.startswith(f"{var}="): val = line.split("=", 1)[1].strip() return val.strip('"').strip("'") except (OSError, UnicodeDecodeError): continue return None ``` ```python self.api_key = api_key or _load_ofox_key() if not self.api_key: raise OfoxError(_help_message()) self.base_url = ( base_url or os.environ.get("OFOX_BASE_URL") or OFOX_BASE_URL ).rstrip("/") ``` ```python req = urllib.request.Request( url, data=body, headers={ "Content-Type": "application/json; charset=utf-8", "Authorization": f"Bearer {self.api_key}", }, method="POST", ) with urllib.request.urlopen(req, timeout=self.timeout) as resp: data = json.loads(resp.read()) ``` The default value of `OFOX_BASE_URL` is `https://api.ofox.ai`. The behavior is also explicitly covered by `tests/test_llm.py:43-46`, which verifies that `OPENROUTER_API_KEY` is accepted as a fallback Ofox key. ### Technical Analysis Credential selection and provider endpoint selection are not coupled. If `OFOX_API_KEY` is absent but `OPENROUTER ...[truncated 1488 chars]- Remediation
View remediation