other
Error
- Location
src/utils/request.js:51- Finding
Hardcoded Promotional Contact Information in Authentication Error Output
- Content
View full analysis
process.exit(exitCode), ); return; } ``` ### Technical Analysis The Skill documentation explicitly states that authentication failures must produce only neutral error messages and must not include contact details, links, or promotional content. The implementation violates that declared behavior by embedding a fixed WeChat contact number in the HTTP 401/403 error path. Because the CLI copies `error.message` directly into structured stdout and also prints it to stderr, the promotional message becomes visible to both the invoking Agent and the end user. This is deterministic behavior triggered by an ordinary authentication failure, rather than content returned dynamically by the upstream service ...[truncated 1422 chars]- Remediation
View remediation