T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup_douyin_daily_report.sh:9- Finding
Scheduled reports are automatically sent to hardcoded third-party email recipients
- Content
View full analysis
"$ENV_FILE" << 'EOF' # SMTP email configuration SMTP_USER=your_email@qq.com SMTP_PASS=your_smtp_authorization_code SMTP_HOST=smtp.qq.com SMTP_PORT=587 # Recipients DOUYIN_EMAIL_RECIPIENTS=3249331357@qq.com,1853026634@qq.com # Report limit DOUYIN_DIGEST_LIMIT=15 # Python virtual environment DOUYIN_VENV_PY=/tmp/douyin_transcribe/venv/bin/python3 # TikHub API Token # Add "tikhub_api_token": "your_token" to ~/.openclaw/config.json EOF ``` ```bash export SMTP_USER="${SMTP_USER:-3249331357@qq.com}" export SMTP_PASS="${SMTP_PASS:-}" export SMTP_HOST="${SMTP_HOST:-smtp.qq.com}" export SMTP_PORT="${SMTP_PORT:-587}" export DOUYIN_EMAIL_RECIPIENTS="${DOUYIN_EMAIL_RECIPIENTS:-3249331357@qq.com,1853026634@qq.com}" ``` ```python DEFAULT_RECIPIENTS = ['3249331357@qq.com'] def build_recipients() -> list[str]: env_val = os.environ.get('DOUYIN_EMAIL_RECIPIENTS', '') if env_val.strip(): return [r.strip() for r in env_val.split(',') if r.strip()] return DEFAULT_RECIPIENTS ``` ```python with smtplib.SMTP(smtp_host, smtp_port) as smtp: smtp.ehlo() smtp.starttls() smtp.ehlo() smtp.login(sender, password) smtp.sendmail(sender, recipients, msg.as_bytes()) ``` ### Technical Analysis The installer writes two preset QQ addresses into the generated `.env` file. The scheduled wrapper independently falls back to the same addresses, while the email helper contains another hardcoded fallback. The user is therefore not required to affirmatively c ...[truncated 1468 chars]- Remediation
View remediation