T09 · Insecure Skill Coding Practices
Error
- Location
lib.mjs:153- Finding
Restore Keys and Authentication Tokens Can Be Sent to an Arbitrary or Insecure Server
- Content
View full analysis
({ question: item.question, answer: item.answer })) }; const verified = await apiRequest( serverUrl, "POST", `/api/souls/${soulId}/verify`, verifyPayload, auth.token ); } ``` ```js // lib.mjs export async function verifyRemoteSoul(options = {}) { const serverUrl = ensureServerUrl(options.serverUrl); const auth = await ensureSession(serverUrl, options); return apiRequest(serverUrl, "POST", `/api/souls/${options.soulId}/verify`, { mode: options.verificationMode || "key", key: options.key || "", answers: (options.memoryQuestions || []).map(parseMemoryQuestion).map((item) => ({ question: item.question, answer: item.answer })) }, auth.token); } function ensureServerUrl(value) { return String(value || "https://agentslope.com").replace(/\/$/, ""); } ``` ```js // lib.mjs async function apiRequest(serverUrl, method, pathname, body, token) { const headers = {}; if (body !== undefined) { headers["content-type"] = "application/json"; } if (token) { headers.authorization = `Bearer ${token}`; } const response = await fetch(`${serverUrl}${pathname}`, { method, headers, body: body === undefined ? undefined : JSON.stringify(body) }); // ... } ``` ```js // cli.mjs async function runWithAuth(fn, op ...[truncated 2335 chars]- Remediation
View remediation