T09 · Insecure Skill Coding Practices
Error
- Location
scripts/onboarding.py:68- Finding
Configurable Authentication Endpoints Can Expose User Credentials
- Content
View full analysis
str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _login_by_token(access_token: str, refresh_token: str) -> dict: """New-user credit grant. Failure does not block the remaining flow.""" resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token)) if "_error" in resp: return {"error": f"loginByToken: {resp.get('_body') or resp['_error']}"} if resp.get("errcode") != 200: return {"error": f"loginByToken: {resp.get('errmsg') or json.dumps(resp, ensure_ascii=False)}"} print(f"{TAG} loginByToken succeeded and new-user credits were triggered", file=sys.stderr) return {} def _fetch_user_info_v3(access_token: str, user_id: str) -> dict: """Obtain group_id and member_id from userInfo.""" resp = _http_post(f"{_login_base()}/linkFoxApp/api/userCenter/userInfo", {}, _headers("agent-linkfox-web", "ag ...[truncated 3256 chars]- Remediation
View remediation