T09 · Insecure Skill Coding Practices
Error
- Location
scripts/model_validator.py:57- Finding
Provider credentials and prompt data can be transmitted to arbitrary or plaintext endpoints
- Content
View full analysis
Optional[str]: """Resolve the API base URL from provider configuration.""" base = provider_data.get("baseUrl") or provider_data.get("base_url") or "" if base: return base.rstrip("/") ``` ```python # scripts/model_validator.py:88-121 def resolve_api_key(provider_key: str, provider_data: Dict[str, Any]) -> Optional[str]: """Resolve the API key from provider configuration.""" import os key = provider_data.get("apiKey") or provider_data.get("api_key") or "" if key and not key.startswith("${"): return key if key.startswith("${") and key.endswith("}"): env_var = key[2:-1] return os.environ.get(env_var) if key.startswith("$"): return os.environ.get(key[1:]) key_lower = provider_key.lower() env_candidates = [ f"{provider_key.upper()}_API_KEY", f"{provider_key.upper()}_KEY", f"{key_lower.upper().replace('-', '_')}_API_KEY", ] if "openai" in key_lower: env_candidates.insert(0, "OPENAI_API_KEY") if "anthropic" in key_lower: env_candidates.insert(0, "ANTHROPIC_API_KEY") if "deepseek" in key_lower: env_candidates.insert(0, "DEEPSEEK_API_KEY") for env in env_candidates: val = os.environ.get(env) if val: return val return None ``` ```python # scripts/model_validator.py:196-225 def probe_model_openai(base_url: str, model_id: str, api_key: Optional[str], timeout: int) -> Tuple[str, Optional[str], float]: url = _build_endpoint(base_url, "openai-completions") payload = json.dum ...[truncated 5701 chars]- Remediation
View remediation