T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/usda_fdc.py:22- Finding
API Credentials May Be Disclosed Through Unsanitized HTTP Exceptions
- Content
View full analysis
= 500: raise USDAError(f"USDA API server error ({r.status_code})", status=r.status_code) r.raise_for_status() ``` ```python # scripts/usda_fdc.py:33-41 def search_food(query: str) -> List[Dict[str, Any]]: _require_key() url = f"{FDC_BASE}/foods/search" payload = { "query": query, "pageSize": SEARCH_PAGE_SIZE, "dataType": PREFERRED_DATA_TYPES, } r = requests.post( url, params={"api_key": USDA_API_KEY}, json=payload, timeout=HTTP_TIMEOUT_SEC, ) ``` ```python # scripts/spoonacular.py:35-46 def search_ingredient(name: str) -> List[Dict[str, Any]]: _require_key() url = f"{SPOONACULAR_BASE}/food/ingredients/search" params = { "query": name, "number": SPOONACULAR_SEARCH_LIMIT, "apiKey": SPOONACULAR_API_KEY, } r = requests.get(url, params=params, timeout=HTTP_TIMEOUT_SEC) ``` ```python # scripts/core.py:117-119 except SpoonacularError as e: spoon_errors.append(f"Spoonacular query failed ({term}): {e}") except Exception as e: spoon_errors.append(f"Unexpected Spoonacular query error ({term}): {e}") ``` ```python # scripts/core.py:349-350 except Exception as e: return _error(f"USDA query failed ...[truncated 2738 chars]- Remediation
View remediation
= 500: raise USDAError("USDA service is temporarily unavailable", status=503) if not r.ok: raise USDAError( f"USDA request failed with HTTP status {r.status_code}", status=r.status_code, ) ``` 3. **Introduce centralized credential redaction** - Redact values associated with `api_key`, `apiKey`, `Authorization`, `token`, and similar fields before logging or returning exception data. - Apply redaction to both URL query strings and serialized request metadata. 4. **Avoid placing credentials in result notes** - Store only a provider name, sanitized status code, and stable internal error identifier. - Do not expose prepared request URLs, response bodies, headers, or exception representations. 5. **Add regression tests** - Mock unhandled responses such as HTTP 400, 404, and 422. - Assert that neither the USDA key nor the Spoonacular key appears in returned values, notes, exception messages, or captured logs. 6. **Consider safer authentication transport where supported** - If a provider supports authentication headers, prefer them over URL parameters. - Where query-parameter authentication is required by the provider, ensure URLs are always treat ...[truncated 66 chars]