T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fang_audit.py:43- Finding
Unrestricted remote disclosure of scanned source code and API credentials
- Content
View full analysis
str: try: import urllib.request import urllib.error except ImportError: return "[ERROR] urllib not available" # Build file content block (trim to 3000 chars per file to stay within limits) content_blocks = [] for item in files: snippet = item["content"][:3000] content_blocks.append(f"### File: {item['path']}\n```\n{snippet}\n```") combined = "\n\n".join(content_blocks) prompt = f"""You are a security analyst. Analyze the following script files from an AI agent skill directory. Your job: detect any HIGH-RISK behavior that could STEAL or LEAK environment variables. Focus on: 1. Code that reads env vars (os.environ, process.env, os.getenv, $ENV, etc.) 2. Code that sends data externally (HTTP requests, WebSockets, DNS lookups, etc.) 3. Combined risk: reading env vars AND sending them out (this is the most critical) 4. Obfuscation tricks: base64 encoding, hex encoding, compressed payloads 5. Suspicious subprocess / eval / exec usage 6. Hardcoded URLs or IPs that look like data exfiltration endpoints For each suspicious file, output: - File path - Risk level: HIGH / MEDIUM / LOW - Reason: one clear sentence - Code snippet: the exact suspicious lines (max 5 lines) If a file is clean, skip it entirely. At the ...[truncated 3493 chars]- Remediation
View remediation