T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cloud_cli.py:14- Finding
Unrestricted local file upload through a configurable plaintext API endpoint
- Content
View full analysis
str: """CLI parameters: read an existing file path; otherwise treat it as literal text.""" raw = (value or "").strip() if not raw: return "" path = Path(raw) if path.is_file(): return path.read_text(encoding="utf-8") return raw ``` `scripts/run.py:40,55-56,68`: ```python parser.add_argument("--listing-context", help="Listing text or file path") if args.listing_context: payload["listing_context"] = read_text_arg(args.listing_context) data = run_skill(SKILL_API_ID, payload, timeout=180.0) ``` `scripts/yufluent_api.py:19-23`: ```python def normalize_api_root(base_url: str) -> str: base = (base_url or "").strip().rstrip("/") if not base: base = "http://localhost:8080/v1" if base.endswith("/v1"): return base return f"{base}/v1" ``` `scripts/yufluent_api.py:49-53`: ```python def _auth_headers(api_key: str) -> dict[str, str]: return { "Authorization": f"Bearer {api_key}", "Accept": "application/json", } ``` `scripts/yufluent_api.py:218-230`: ```python root = base_url or os.getenv("TOKENAPI_BASE_URL", "") url = skill_run_url(root, skill_id) try: resp = _post_json(url, api_key=key, body=payload, timeout=timeout) except requests.RequestException as exc: raise YufluentApiError(f"Request failed: {exc}") from exc if _should_fallback_skill_run(resp.status_code): return _run_skill_via_agent_turn( skill_id, payload, api_key=key, base_url=root, timeout=timeout, ) ``` ### Technical Analy ...[truncated 3424 chars]- Remediation
View remediation