T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/feishu_api.py:13- Finding
Configurable Service Endpoints Can Expose Credentials and Private Content
- Content
View full analysis
None: self.base_url = get_optional('FEISHU_BASE_URL', 'https://open.feishu.cn').rstrip('/') self.app_id = get_required('FEISHU_APP_ID') self.app_secret = get_required('FEISHU_APP_SECRET') def tenant_access_token(self) -> str: resp = requests.post( f'{self.base_url}/open-apis/auth/v3/tenant_access_token/internal', headers={'Content-Type': 'application/json; charset=utf-8'}, json={'app_id': self.app_id, 'app_secret': self.app_secret}, timeout=30, ) ``` The SenseAudio clients follow the same pattern: ```python class SenseAudioASR: def __init__(self) -> None: base_url = get_optional('SENSEAUDIO_BASE_URL', 'https://api.senseaudio.cn').rstrip('/') self.api_url = f'{base_url}/v1/audio/transcriptions' self.api_key = get_required('SENSEAUDIO_API_KEY') self.model = get_optional('SENSEAUDIO_ASR_MODEL', 'sense-asr') def transcribe(self, audio_path: str | Path, language: str | None = 'zh') -> dict[str, Any]: path = Path(audio_path) with path.open('rb') as f: files = {'file': (path.name, f)} data: dict[str, Any] = {'model': self.model, 'response_format': 'json'} if language and self.model != 'sense-asr-deepthink': data['language'] = language resp = requests.post( self.api_url, headers={'Authorization': f'Bearer {self.api_key}'}, data=data, files=files, timeout=120, ...[truncated 2251 chars]- Remediation
View remediation