T09 · Insecure Skill Coding Practices
Error
- Location
scripts/memory_manager.py:28- Finding
Undisclosed transmission of stored conversations with unrestricted embedding endpoint override
- Content
View full analysis
list: """ 调用 GLM embedding API 生成向量 使用 embedding-3 模型 """ global ZHIYI_API_KEY # 尝试从 OpenClaw 配置获取 API Key if not ZHIYI_API_KEY: config_path = Path('/root/.openclaw/openclaw.json') if config_path.exists(): with open(config_path) as f: config = json.load(f) # 从 zhiyi provider 获取 API key if 'auth' in config and 'profiles' in config['auth']: for profile_name, profile in config['auth']['profiles'].items(): if 'zhiyi' in profile_name.lower() or profile.get('provider') == 'zhiyi': ZHIYI_API_KEY = profile.get('apiKey', '') break # 或者从 zhiyi provider 的 models 配置获取 if not ZHIYI_API_KEY and 'models' in config and 'providers' in config['models']: zhiyi_cfg = config['models']['providers'].get('zhiyi', {}) ZHIYI_API_KEY = zhiyi_cfg.get('apiKey', '') if not ZHIYI_API_KEY: print("✗ 无法获取 ZHIYI API Key") return None url = f"{ZHIYI_BASE_URL}/embeddings" headers = { "Authorization": f"Bearer {ZHIYI_API_KEY}", "Content-Type": "application/json" } data = { "model": "embedding-3", "input": text } try: response = requests.post(url, headers=headers, json=data, timeout=30) response.raise_for_status() result = response.jso ...[truncated 5306 chars]- Remediation
View remediation