T09 · Insecure Skill Coding Practices
Error
- Location
scripts/insurai_api.py:65- Finding
Arbitrary HTTPS Endpoint Can Receive the API Key and Sensitive Insurance Data
- Content
View full analysis
str: """Read only the documented InsurAI API key; never enumerate environment variables.""" try: return os.environ["INSURAI_API_KEY"].strip() except KeyError: return "" def _validate_base_url() -> None: parsed = urlparse(BASE) if parsed.scheme != "https" or not parsed.netloc: raise RuntimeError("INSURAI_AGENT_URL must be an https URL.") ``` ```python def get_session() -> Session: global _session _load_http_dependencies() api_key = _get_api_key() headers = {**HEADERS, "X-API-KEY": api_key} if _session is None: _session = Session() # Increase pool size for batch operations _session.mount("https://", adapters.HTTPAdapter( pool_connections=10, pool_maxsize=20, max_retries=0, # we handle retries manually )) _session.headers.update(headers) elif _session.headers.get("X-API-KEY") != api_key: # API key changed (e.g. reloaded in long-running process) — refresh headers _session.headers.update(headers) return _session ``` ### Technical Analysis The destination is controlled by the `INSURAI_AGENT_URL` environment variable. Validation only confirms that the URL has an `https` scheme and a nonempty network location. It does not verify that the hostname is `insurai.com.tw` or another explicitly trusted InsurAI host. The resulting session attaches `INSURAI_API_KEY` to every request through the `X-API-KEY` header. The API functions also submit insurance-planning information that may include age, gender, occupation, family circumstance ...[truncated 1816 chars]- Remediation
View remediation