T09 · Insecure Skill Coding Practices
Error
- Location
scripts/video_gen.js:24- Finding
Unvalidated endpoint overrides can disclose the WeryAI API key and local media
- Content
View full analysis
controller.abort(), 30000); try { const res = await fetch(fullUrl, { method, headers, body: body != null ? JSON.stringify(body) : undefined, signal: controller.signal, }); clearTimeout(timer); let data; try { data = await res.json(); } catch { data = { status: res.status, msg: `Non-JSON response (HTTP ${res.status})` }; } return { httpStatus: res.status, ...data }; } catch (err) { clearTimeout(timer); if (err.name === 'AbortError') { throw new Error(`Request timeout: ${method} ${fullUrl}`); } throw err; } } async function apiRequest(method, pathName, body, apiKey) { return httpJson(method, BASE_URL + pathName, body, apiKey); } async function fetchModelsRegistry(apiKey) { return httpJson('GET', MODELS_BASE_URL + MODELS_API_PATH, null, apiKey); } ``` ```js async function uploadLocalSource(localPathInput, apiKey) { const localPath = normalizeLocalFilePath(localPathInput); if (!localPath) { throw new Error(`Invalid local path: ${localPathInput}`); } const stat = await fs.stat(localPath); if (!stat.isFile()) { throw new Error(`Local path is not a file: ${localPathInput}`); } ...[truncated 3870 chars]- Remediation
View remediation