T09 · Insecure Skill Coding Practices
Error
- Location
scripts/oneabc.js:2- Finding
Credentials and Sensitive Request Data Can Be Sent to Arbitrary Configured Endpoints
- Content
View full analysis
{ const h = {}; h['Author' + 'ization'] = ACCESS_CREDENTIAL; h['Content-Type'] = 'application/json'; return h; })(), body: JSON.stringify({ model, messages: [{ role: 'user', content: prompt }], max_tokens: maxTokens }) }); const data = await response.json(); if (data.error) return `❌ Error: ${data.error.message}`; return data.choices?.[0]?.message?.content || JSON.stringify(data, null, 2); } ``` ```javascript const response = await fetch(`${BASE_URL}/v1/models`, { headers: (() => { const h = {}; h['Author' + 'ization'] = ACCESS_CREDENTIAL; return h; })() }); ``` `scripts/send_whatsapp.py`: ```python SERVICE_URL = os.environ.get('GREEN_API_URL') INSTANCE_ID = os.environ.get('GREEN_API_INSTANCE_ID') SERVICE_CREDENTIAL = ( os.environ.get('GREEN_API_CREDENTIAL') or os.environ.get('SERVICE_CREDENTIAL') ) def send_message(phone, message): phone = phone.strip().replace('+', '').replace(' ', '') chat_id = f"{phone}@c.us" url = f"{SERVICE_URL}/waInstance{INSTANCE_ID}/sendMessage/{SERVICE_CREDENTIAL}" response = requests.post( url, json={'chatId': chat_id, 'message': message}, timeout=30 ) result = response.json() return ('idMessage' in resul ...[truncated 3443 chars]- Remediation
View remediation