T09 · Insecure Skill Coding Practices
Error
- Location
scripts/llm_client.py:283- Finding
API Credential Can Be Disclosed to an Unrelated LLM Endpoint
- Content
View full analysis
List[Dict[str, Any]]: if not any(direct.values()): return [] api_base = _normalize_api_base(str(direct.get("apiBase") or "")) api_key = str(direct.get("apiKey") or "").strip() model = str(direct.get("model") or "").strip() if api_base and api_key: return [{ "apiBase": api_base, "apiKey": api_key, "model": model or DEFAULT_MODEL, "resolvedFrom": source, }] if not provider_candidates: candidate = { "apiBase": api_base, "apiKey": api_key, "model": model or DEFAULT_MODEL, "resolvedFrom": source, } return [candidate] if candidate["apiBase"] and candidate["apiKey"] else [] hydrated: List[Dict[str, Any]] = [] for provider_candidate in provider_candidates: provider_api_key = _cfg_str(provider_candidate, "apiKey") if api_key and not api_base and not allow_api_key_override and provider_api_key and provider_api_key != api_key: continue candidate = dict(provider_candidate) if api_base: candidate["apiBase"] = api_base if api_key: candidate["apiKey"] = api_key if model: candidate["model"] = model provider_ref = _cfg_str(candidate, "providerRef") if provider_ref: candidate["modelRef"] = f"{provider_ref}/{model}" candidate["resolvedFrom"] = f"{source} <- {provider_candidate.get('resolvedFrom')}" hydrated.append(candidate) return _dedupe_can ...[truncated 2389 chars]- Remediation
View remediation