T09 · Insecure Skill Coding Practices
Warning
- Location
config.json:1- Finding
Privileged Personal Access Token Stored in Plaintext Configuration
- Content
View full analysis
Dict[str, Any]: """加载配置文件""" with open(CONFIG_PATH, 'r', encoding='utf-8') as f: return json.load(f) def get_headers(config: Optional[Dict] = None) -> Dict[str, str]: """获取请求头""" if config is None: config = load_config() return { 'Content-Type': 'application/json', 'x-yunxiao-token': config['token'] } ``` ### Technical Analysis The distributed `config.json` does not contain a live credential, but the documented setup process requires users to write their personal access token into that file. The application then reads the secret directly from disk ...[truncated 2300 chars]- Remediation
View remediation