T09 · Insecure Skill Coding Practices
Error
- Location
references/insight_generation.md:15- Finding
Uncontrolled Disclosure of Sensitive Insurance Data to External AI Providers
- Content
View full analysis
str: """调用 Kimi/DeepSeek 生成洞察""" api_key = os.environ.get("KIMI_API_KEY") if model == "kimi" else os.environ.get("DEEPSEEK_API_KEY") endpoint = "https://api.moonshot.cn/v1/chat/completions" if model == "kimi" else "https://api.deepseek.com/v1/chat/completions" prompt = build_prompt(summary) # 使用上述模板 resp = requests.post( endpoint, headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}, json={ "model": "moonshot-v1-8k" if model == "kimi" else "deepseek-chat", "messages": [{"role": "user", "content": prompt}], "temperature": 0.7, }, timeout=60, ) resp.raise_for_status() return resp.json()["choices"][0]["message"]["content"] ``` ### Technical Analysis The Skill is intended to process insurance datasets, which commonly contain personal data and commercially confidential information such as customer names, policy identifiers, claim information, premium amount ...[truncated 3188 chars]- Remediation
View remediation