T09 · Insecure Skill Coding Practices
Error
- Location
reference/src/fetch_answers.py:16- Finding
API credentials and user content can be transmitted to an unrestricted configurable endpoint
- Content
View full analysis
str: """Call the OpenAI API.""" api_key = os.getenv("OPENAI_API_KEY") or os.getenv("LLM_API_KEY") api_base = os.getenv("OPENAI_API_BASE", "https://api.openai.com/v1") if not api_key: raise ValueError("Please set OPENAI_API_KEY or LLM_API_KEY") try: import openai client = openai.OpenAI(api_key=api_key, base_url=api_base) response = client.chat.completions.create( model=model, messages=[{"role": "user", "content": question}], temperature=0.1, max_tokens=2000, ) return response.choices[0].message.content except ImportError: import requests headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" } payload = { "model": model, "messages": [{"role": "user", "content": question}], "temperature": 0.1, "max_tokens": 2000 } resp = requests.post( f"{api_base}/chat/completions", headers=headers, json=payload, timeout=60 ) resp.raise_for_status() return resp.json()["choices"][0]["message"]["content"] ``` The same pattern is used by the processing modules: ```python api_key = os.getenv("LLM_API_KEY") api_base = os.getenv("LLM_API_BASE", "https://api.openai.com/v1") model = os.getenv("LLM_MODEL", "gpt-4o") client = openai.OpenAI(api_key=api_key, base_url=api_base) ``` ### Technical Analysis The op ...[truncated 2598 chars]- Remediation
View remediation