T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:167- Finding
Examples Target the Production API Despite Repeated Sandbox Claims
- Content
View full analysis
All examples use the GreenHelix sandbox (https://sandbox.greenhelix.net) which > provides 500 free credits — no API key required to get started. ``` The implementation instead directs every request to the main API endpoint: ```markdown All code runs against the GreenHelix A2A Commerce Gateway at `https://api.greenhelix.net/v1`. ``` ```python import requests import json import time from datetime import datetime, timedelta base_url = "https://api.greenhelix.net/v1" api_key = "your-api-key" # From GreenHelix dashboard session = requests.Session() session.headers["Authorization"] = f"Bearer {api_key}" session.headers["Content-Type"] = "application/json" def execute(tool: str, inputs: dict) -> dict: """Execute a GreenHelix tool and return the result.""" resp = session.post( f"{base_url}/v1", json={"tool": tool, "input": inputs} ) resp.raise_for_status() return resp.json() ``` ### Technical Analysis The guide establishes a safety expectation that its examples operate exclusively against a free sandbox. However, the shared request helper targets `https://api.greenhelix.net/v1`, not `https://sandbox.greenhelix.net`. Every subsequent example uses the `execute()` helper for account registration, wallet creation, payment intents, escrow operations, metrics submission, and messaging. Consequently, a user who copies the examples while relying on the sandbox notice may unknowingly transmit credentials and campaign information to the production-facing service. The endpoint is also constructed as `https://api.greenhelix.net/v1/v1` because `base_url` already contains `/v1` and the request appends another `/v1`. ...[truncated 1434 chars]- Remediation
View remediation