T09 · Insecure Skill Coding Practices
Error
- Location
skills/linkfox-aigc-imagegen/scripts/onboarding.py:454- Finding
API credentials are exposed through stdout and persisted in plaintext shell configuration
- Content
View full analysis
dict: hdr = _headers("agent-linkfox-web", "ai.linkfox.com", access_token=access_token, user_id=user_id, group_id=group_id) for path, source in (("/group/getApiToken", "existing"), ("/group/generateApiToken", "generated")): resp = _http_post(f"{_agent_user_base()}{path}", {"id": group_id}, hdr) if "_error" in resp: return {"error": f"{path.rsplit('/', 1)[-1]}: {resp.get('_body') or resp['_error']}"} tok = _extract_token(resp) if tok: return {"api_key": tok, "source": source} return {"error": f"generateApiToken: 未拿到 token，响应: {json.dumps(resp, ensure_ascii=False)}"} def login_and_get_key(phone: str, code: str, channel: str) -> dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: 手机号格式不正确: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: 验证码格式不正确: {code}", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{T ...[truncated 3555 chars]- Remediation
View remediation