other
Error
- Location
review.py:237- Finding
Administrative Content Is Disclosed to a Hard-Coded External Moderation Domain
- Content
View full analysis
Dict[str, Any]: """调用技术部统一审核 API（POST /v2/moderations）""" try: import requests as req except ImportError: raise RuntimeError("API 审核需要 requests 库: pip install requests") mod_cfg = config["moderation"] api_url = mod_cfg["api_url"].rstrip("/") payload = { "content": text, "type": mod_cfg.get("type", "post"), "model": "auto", "strictness": mod_cfg.get("strictness", "standard"), } headers = { "X-Project-Key": mod_cfg["api_key"], "Content-Type": "application/json", } last_err = None for attempt in range(3): try: resp = req.post( f"{api_url}/v2/moderations", json=payload, headers=headers, timeout=15 ) if resp.status_code == 429: time.sleep(2 * (attempt + 1)) continue resp.raise_for_status() data = resp.json() return data.get("data", {}).get("result", {}) except Exception as e: last_err = e if attempt < 2: time.sleep(2) raise RuntimeError(f"审核 API 失败（重试3次）: {last_err}") ``` ### Technical Analysis When an API key is configured, the Skill transmits pending administrative content to the configured moderation endpoint. The example configuration supplies `https://zyaokkmo.cc` as the default endpoint, while the documentation describes it only as a technical-department API and does not establish its ownership, authorization, retention policy, or permitted data c ...[truncated 1789 chars]- Remediation
View remediation