T09 · Insecure Skill Coding Practices
Error
- Location
seedance.py:27- Finding
API Credential and User Data Sent to an Undocumented Domain
- Content
View full analysis
dict: """Call SkillBoss API Hub /v1/pilot and return parsed JSON response.""" api_key = get_api_key() headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } data = json.dumps(body).encode("utf-8") req = urllib.request.Request(PILOT_URL, data=data, headers=headers, method="POST") try: with urllib.request.urlopen(req, timeout=120) as resp: resp_body = resp.read().decode("utf-8") ``` Local images are also serialized into requests sent through this function: ```python def image_to_data_url(image_path): """Convert a local image file to a base64 data URL.""" p = Path(image_path) if not p.exists(): print(f"Error: Image file not found: {image_path}", file=sys.stderr) sys.exit(1) ext = p.suffix.lower().lstrip(".") mime_map = { "jpg": "jpeg", "jpeg": "jpeg", "png": "png", "webp": "webp", "bmp": "bmp", "tiff": "tiff", "tif": "tiff", "gif": "gif", "heic": "heic", "heif": "heif", } mime_ext = mime_map.get(ext, ext) file_size = p.stat().st_size if file_size > 30 * 1024 * 1024: print(f"Error: Image file too large ({file_size / 1024 / 1024:.1f} MB). Max 30 MB.", file=sys.stderr) sys.exit(1) with open(p, "rb") as f: b64 = base64.b64encode(f.read() ...[truncated 2090 chars]- Remediation
View remediation