T09 · Insecure Skill Coding Practices
Error
- Location
src/brief.ts:3- Finding
Local communication contents are transmitted to a remote API without clear disclosure or explicit opt-in
- Content
View full analysis
{ const apiKey = process.env.WORLDLOOPS_API_KEY; const baseUrl = getApiBaseUrl(); const response = await fetch(`${baseUrl}/api/v1/openclaw/brief`, { method: 'POST', headers: { 'Content-Type': 'application/json', ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}), }, body: JSON.stringify({ signals: input.signals, mode: input.mode ?? (apiKey ? 'connected' : 'demo'), }), }); const json = (await response.json()) as WorldLoopsBriefResponse; ``` The primary guard command reads a local payload, converts it into a signal, and invokes this API: ```ts let raw: unknown; try { raw = JSON.parse(fs.readFileSync(path.resolve(inputPath), 'utf8')); } catch (e) { printError([`❌ Could not read input file: ${inputPath}`], outputFormat); process.exit(1); } const validation = validateAdapterSignal(raw); if (!validation.ok) { printError(['❌ Invalid adapter signal.', ...validation.errors], outputFormat); process.exit(1); } const signal = toWorldLoopsSignal(validation.signal); const signals: Signal[] = [signal]; const result = await callWorldLoopsBrief({ signals, mode: 'reconciliation' }); ``` The transmitted `Signal` structure includes full text and may include a source URL: ```ts export interface Signal { source: SignalSource; text: string; url?: string; createdAt?: string; } ``` ## ...[truncated 2505 chars]- Remediation
View remediation