T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run.py:183- Finding
Arbitrary LLM Endpoint Can Expose API Credentials and Sensitive Medical Data
- Content
View full analysis
str: url = f"{base.rstrip('/')}/chat/completions" headers = {"Authorization": f"Bearer {appkey}"} if appkey else {} payload = { "model": model, "messages": [{"role": "user", "content": prompt}], "temperature": 0, } response = _http_post(url, payload, headers, timeout=timeout) try: return str(response["choices"][0]["message"]["content"]).strip() except (KeyError, IndexError, TypeError) as exc: raise RuntimeError(f"Unexpected LLM response: {response}") from exc ``` ```python parser.add_argument( "--base", default=DEFAULT_LLM_BASE, help=f"内部大模型 base URL（默认：{DEFAULT_LLM_BASE}）。", ) parser.add_argument("--model", default=DEFAULT_LLM_MODEL, help=f"模型名称（默认：{DEFAULT_LLM_MODEL}）。") parser.add_argument("--timeout", type=int, default=0, help="HTTP 超时秒数；0 表示一直等待（默认：0）。") parser.add_argument("--appkey", required=True, help="必须传入。内部医疗大模型鉴权 key，使用 Bearer 方式认证。") ``` ### Technical Analysis The `--base` argument accepts an arbitrary URL and is used directly to construct the LLM request destination. The code performs no validation of the URL scheme, destination hostname, port, or origin before attaching the Bearer credential and sending the complete generated prompt. The prompt can contain sensitive medical-record content. Consequently, anyone able to control the command-line arguments or the workflow configuration can redirect both the medical data and the API credential to an attacker-controlled server. The unrestricted URL may also permit requests to network services reachable from the execution environment. The vulnerability is especially significant because the ...[truncated 1620 chars]- Remediation
View remediation