T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:162- Finding
Contradictory Documentation Encourages Undisclosed Transmission of Email Addresses to an External Service
- Content
View full analysis
{ if (input.includes('@')) { const result = await claw0x.call('email-validator', { email: input }); if (!result.valid) { return 'Invalid email format'; } if (result.checks.is_disposable) { return 'Disposable email not allowed'; } } }); ``` ### LangChain Agent ```python from claw0x import Claw0xClient client = Claw0xClient(api_key=os.environ['CLAW0X_API_KEY']) def validate_email(email: str) -> dict: result = client.call('email-validator', {'email': email}) return result # Use in chain email = "user@example.com" validation = validate_email(email) if validation['valid']: print(f"Email is valid with risk score: {validation['risk_score']}") ``` ### Custom Agent ```javascript const response = await fetch('https://api.claw0x.com/v1/call', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.CLAW0X_API_KEY}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ skill: 'email-validator', input: { email: 'test@example.com' } }) }); const result = await response.json(); console.log(result); ``` ``` ### Technical Analysis Email addresses are personal or customer-sensitive data. The documented SDK calls and direct HTTP request place those addresses ...[truncated 2626 chars]- Remediation
View remediation