T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/book_summarizer.py:147- Finding
Unrestricted Model Endpoint Can Receive Extracted Document Content over Plaintext HTTP
- Content
View full analysis
str: url = os.environ.get("LOCAL_MODEL_URL", "http://localhost:11434/api/generate") model = os.environ.get("LOCAL_MODEL", "llama3") payload = { "model": model, "prompt": f"\n{system}\n\n\n\n{user}\n", "stream": False, "options": {"num_predict": max_tokens}, } try: import urllib.request, json as _json data = _json.dumps(payload).encode() req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"}) with urllib.request.urlopen(req, timeout=120) as r: resp = _json.loads(r.read()) return resp.get("response", "") ``` The extracted chapter content is incorporated directly into model requests: ```python for chunk_idx, chunk in enumerate(chunks): prompt = self.llm._chapter_prompt(i, title) user = prompt.format(content=chunk) raw = self.llm.call(self.llm._system_prompt(), user, max_tokens=2048) parsed = self._parse_json(raw) if parsed: chapter_notes.append(parsed) ``` ### Technical Analysis The Skill legitimately requires network transmission when a user explicitly chooses a cloud-based OpenAI or Anthropic model. However, the local-model implementation exceeds the minimum privileges expected from its declared local Ollama mode. If `LOCAL_MODEL_URL` exists in the process environment, the applicat ...[truncated 2825 chars]- Remediation
View remediation