T09 · Insecure Skill Coding Practices
Warning
- Location
shiye.py:14- Finding
Unrestricted API Endpoint Can Exfiltrate Documents and API Credentials
- Content
View full analysis
Vulnerability Details
File Location:
shiye.py, lines 14-20, 47-58, and 97-119
Vulnerability Type: Unrestricted transmission of sensitive information to a configurable network endpoint
Risk Level: MediumVulnerable Code
python # ⚠️ 把你的 API Key 填在这里（必填） API_KEY = "sk-your-api-key-here" # 模型服务地址（一般不用改） API_BASE = "https://api.deepseek.com/v1" # 也可以用环境变量（优先） API_KEY = os.environ.get("SHIYE_API_KEY", API_KEY) API_BASE = os.environ.get("SHIYE_API_BASE", API_BASE)python def call_model(model_id: str, prompt: str) -> str: body = json.dumps({ "model": model_id, "messages": [ {"role": "system", "content": "你是JSON输出机器人。只输出JSON，绝不输出Markdown、解释或报告。违反则任务失败。"}, {"role": "user", "content": prompt} ], "temperature": 0, "max_tokens": 2000, }).encode() req = Request( f"{API_BASE}/chat/completions", data=body, headers={"Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}"}, ) try: with urlopen(req, timeout=300) as resp: return json.loads(resp.read())["choices"][0]["message"]["content"]python prompt = f"""你是 AI 质量评审专家。对照以下标准，逐条打分（1-5分），给出扣分理由。 === 评分标准 === {criteria_text} === 待评审内容（以下为完整文件内容，无截断） === {sample_content[:16000]} === 输出格式 === 只输出 JSON：{{"scores":[{{"criterion":"<标准名>","score":<1-5>,"reason":"<理由>"}}],"overall":<平均分，1位小数>,"top_issue":"<最严重问题>","note":"<建议，30字内>"}} 只输出 JSON。不要 Markdown、不要报告、不要解释。违反指令=失败。"""Technical Analysis
The remote model requests necessarily contain the material being reviewed, including up to 16,000 characters of the selected file. The request also carries the configured API key as a bearer credential.
Remote inference is consistent with the Skill's declared purpose. However, the destination is taken directly from the `SHI ...[truncated 1890 chars]
- Remediation
View remediation
Remediation Suggestions
- Require an
https://URL and reject plaintext HTTP or unsupported schemes. - Use an allowlist of approved API hostnames by default.
- If custom endpoints are required, make them an explicit opt-in and require user confirmation before the first transmission.
- Resolve and validate redirects so an approved endpoint cannot redirect requests to an untrusted destination.
- Display the destination hostname and the amount of content that will be uploaded before making a request.
- Clearly document that selected file contents are sent to an external service and may be retained under that provider's policies.
- Offer content redaction, local preprocessing, and a configurable upload limit for sensitive documents.
- Do not encourage users to place real secrets directly in source code. Obtain credentials from a protected secret store or environment variable.
- Use separate credentials with minimal provider permissions, quotas, and rotation support.
- Consider requiring explicit consent for each new destination and each file classified as potentially sensitive.
- Require an