Tainted flow: 'req' from os.environ.get (line 114, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Content
) if ssl_bad and QWEN_INSECURE_SSL: ctx = ssl._create_unverified_context() return urllib.request.urlopen(req, timeout=timeout, context=ctx) if ssl_bad and not QWEN_INSECURE_SSL: print( "[generate_content] SSL 证书校验失败，已回退模板。"- Confidence
- 90% confidence
- Finding
- When QWEN_INSECURE_SSL is enabled, the script retries HTTPS requests with certificate verification disabled. That allows a machine-in-the-middle attacker to intercept or alter prompts, model responses, and the Authorization bearer token sent to the LLM endpoint. In a skill that handles API credentials and generated publication content, weakening TLS materially increases the chance of credential theft and content tampering.