T09 · Insecure Skill Coding Practices
Error
- Location
scripts/service.py:49- Finding
Local Payment Verification Can Be Forged to Bypass the Buyout Gate
- Content
View full analysis
bool: """Check if user has already bought out this skill.""" return os.path.isfile(_BUYOUT_FILE) def write_buyout(order_no: str, credential: str): """Record buyout credential after first successful payment.""" print(f"[BUYOUT] Writing credential to {_BUYOUT_FILE}") os.makedirs(_BUYOUT_DIR, exist_ok=True) data = {"slug": SLUG, "order_no": order_no, "credential": credential, "timestamp": int(time.time())} with open(_BUYOUT_FILE, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2) def is_credential_valid(order_data: dict) -> bool: credential = order_data.get("payCredential") if not credential: return False credential_ts = order_data.get("credentialTimestamp") if credential_ts and time.time() - credential_ts > CREDENTIAL_TTL: return False return True ``` ```python if __name__ == "__main__": # Check buyout first if has_buyout(): print("=" * 60) print(" ai-content-creator-pro - Buyout Active") print("=" * 60) print("Buyout credential found. Skipping payment.\n") print("The AI model will now deliver multi-platform content creation.") print("=" * 60) print("PAY_STATUS: SUCCESS") print("BUYOUT: true") sys.exit(0) # First-time use: need payment parser = argparse.ArgumentParser(description="Verify buyout payment for ai-content-creator-pro") parser.add_argument("order_no", help="Order number from Phase 1") args = parser.parse_args() indicator = compute_indicator(SLUG) try: order_data = _load_order(indicator, args.order_no) except Exception as e: print("PAY_STATUS: ERROR") print(f"ERROR_INFO: Order file ...[truncated 2641 chars]- Remediation
View remediation