T09 · Insecure Skill Coding Practices
Error
- Location
shuyan_classify.py:21- Finding
Bearer Credential and Sensitive Classification Data Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
Dict[str, str]: return { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json" } def classify_batch( self, items: List[Dict[str, Any]] ) -> Dict[str, Any]: """Batch classification""" response = requests.post( self.endpoint, headers=self._headers(), json=items, timeout=120 ) response.raise_for_status() return response.json() ``` The shell implementation has the same behavior: ```bash API_KEY="${SHUYAN_API_KEY:-sk-secret-key}" API_URL="${SHUYAN_API_URL:-http://localhost:8080}" ENDPOINT="/api/llm_infer_zh_and_cls_and_type_v2_batchdata_sync" curl -s -X POST "${API_URL}${ENDPOINT}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d @"$JSON_FILE" ``` ### Technical Analysis Submitting field information to a classification service is necessary for the Skill's declared functionality. The network operation is documented and is not covert exfiltration. However, the implementation permits any caller-controlled `SHUYAN_API_URL` and does not enforce TLS for non-loopback destinati ...[truncated 1802 chars]- Remediation
View remediation