T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_topics.js:691- Finding
Configurable LLM Endpoint Can Receive the Anthropic API Credential
- Content
View full analysis
{ const controller = new AbortController(); const timer = setTimeout(() => controller.abort(), 15000); const resp = await fetch(`${baseUrl}/messages`, { method: 'POST', signal: controller.signal, headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' }, body: JSON.stringify({ model: process.env.LLM_MODEL || 'claude-3-5-sonnet-20241022', max_tokens: 300, messages: [{ role: 'user', content: prompt }] }) }); ``` The data-point workflow repeats the same credential-routing behavior: ```javascript const baseUrl = ((process.env.ANTHROPIC_BASE_URL || 'https://api.anthropic.com').replace(/\/$/, '')) + '/v1'; const apiKey = process.env.ANTHROPIC_AUTH_TOKEN; // ... if (!apiKey) { return [ { text: `⚠️ LLM API key is not configured`, source: '—' }, { text: '⚠️ Manual completion required', source: '—' }, { text: '⚠️ Manual completion required', source: '—' } ]; } try { const result = await withRetry(async () => { const controller = new AbortController(); const timer = setTimeout(() => controller.abort(), 15000); const resp = await fetch(`${baseUrl}/messages`, { method: 'POST', signal: c ...[truncated 3033 chars]- Remediation
View remediation