T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sdk_client.py:31- Finding
Unrestricted API endpoint overrides can disclose credentials and sensitive task data
- Content
View full analysis
Tuple[Optional[str], Optional[str]]: return _env("ARK_SKILL_API_BASE"), _env("ARK_SKILL_API_KEY") ``` `scripts/sdk_client.py:86-89` ```python configuration = volcenginesdkcore.Configuration() host = os.environ.get("VOLC_HOST") if host: configuration.host = host ``` `scripts/sdk_client.py:118-126` ```python api_base, api_key = read_env_ark_proxy() if api_base and api_key: return self._call_via_ark_proxy( method=method, action=action, body=body, api_base=api_base, api_key=api_key, ) ``` `scripts/sdk_client.py:147-187` ```python def _call_via_ark_proxy( self, *, method: str, action: str, body: Dict[str, Any], api_base: str, api_key: str, ) -> Dict[str, Any]: url = f"{api_base.rstrip('/')}/?Action={urllib.parse.quote(action)}&Version={urllib.parse.quote(self.version)}" headers = { "ServiceName": self.service, "Authorization": f"Bearer {api_key}", "Accept": "application/json", } resolved_method = (method or "POST").upper() if resolved_method == "GET": if body: query = urllib.parse.urlencode(body, doseq=True) url = f"{url}&{query}" data = None else: headers["Content-Type"] = "application/json" data = json.dumps(body or {}, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url, data=data, headers=headers, method=resolved_method ) try: with urllib.request.urlopen(req, timeout=30) as resp: resp_body = resp.read() try: parsed = json.loads(resp_body.d ...[truncated 4339 chars]- Remediation
View remediation