T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:599- Finding
Scraped Content Is Transmitted to a Third-Party LLM Without Sensitivity Controls
- Content
View full analysis
dict: """Extracts entities from a news article using LLM.""" text_sample = text[:4000] if len(text) > 4000 else text prompt = f"""You are a news entity extractor. Analyze the text below and extract: TITLE: {metadata.get('title', 'N/A')} DATE: {metadata.get('date', 'N/A')} TEXT: {text_sample} Respond ONLY with valid JSON, no markdown, in this format: {{ "people": [ {{"name": "Full Name", "role": "Role/Title", "context": "One sentence about their role in the article"}} ], "organizations": [ {{"name": "Org Name", "type": "company|government|ngo|other", "context": "role in article"}} ], "locations": [ {{"name": "Location Name", "type": "city|state|country|address", "context": "mention"}} ], "events": [ {{"name": "Event", "date": "date if available", "description": "brief description"}} ], "relationships": [ {{"subject": "Entity A", "relation": "relation type", "object": "Entity B"}} ] }}""" try: response = req.post( OPENROUTER_ENDPOINT, headers={ "Authorization": f"Bearer {OPENROUTER_API_KEY}", "Content-Type": "application/json", }, json={ "model": "google/gemini-2.5-flash-lite", "messages": [{"role": "user", "content": prompt}], "max_tokens": 2000, "temperature": 0.1, }, timeout=30, ) ``` ### Technical Analysis The optional entity-extraction stage includes the article title, publication date, and up to 4,000 characters of scraped tex ...[truncated 1776 chars]- Remediation
View remediation