T09 · Insecure Skill Coding Practices
Error
- Location
config.json:3- Finding
Production-Like Database and API Credentials Committed in Plaintext
- Content
View full analysis
- Remediation
View remediation
Security audit
data-query
Security checks for vulnerabilities and agentic risk
Overview
This database dashboard skill is mostly purpose-aligned, but it ships operational-looking credentials and insecure HTTP/API defaults that users should review before installing.
Install only after replacing all shipped credentials, using HTTPS-only API endpoints, verifying database accounts are read-only and tightly scoped, and treating generated HTML as sensitive because it can contain SQL and use browser session tokens.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
src/verify/index.js:285- Finding
Passwords and JWT Authorization Tokens Transmitted over Plaintext HTTP
- Content
View full analysis
{ const url = new URL(pathname, config.api.base); const postData = JSON.stringify(body); const options = { hostname: url.hostname, port: url.port || 80, path: url.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': token || '', 'Content-Length': Buffer.byteLength(postData) } }; const req = http.request(options, res => { let data = ''; res.on('data', c => data += c); res.on('end', () => { try { resolve(JSON.parse(data)); } catch (e) { reject(new ApiError( `HTTP parse error: ${data.substring(0, 100)}` )); } }); }); req.on('error', reject); req.write(postData); req.end(); }); } ``` The login password is passed directly when encryption is disabled in `src/verify/index.js:320-330`: ```javascript async function getApiToken() { if (_cachedToken) return _cachedToken; const authConfig = config.security.apiAuth || {}; const username = authConfig.username || 'admin@wisdomidata'; const password = authConfig.password; if (!password) { throw new ApiError('API: passw ...[truncated 3236 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/security/encryptSql.js:15- Finding
Static SQL Encryption Key and Plaintext SQL Embedded in Generated Pages
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/knowledge/requirements.txt:4- Finding
Open-Ended Python Dependency Versions Permit Unreviewed Supply-Chain Updates
- Content
View full analysis
=1.0.0 # DM database support dmPython>=2.5.0; sys_platform != "darwin" # Cross-platform ODBC support pyodbc>=4.0.0 # Oracle support oracledb>=1.0.0 ``` ### Technical Analysis Each Python dependency uses a lower-bound version constraint without an upper bound or integrity hash. A future release satisfying the constraint can therefore be installed without having been reviewed with this project. Python package installation can execute build-backend and installation-related code. Database drivers may also include native components, increasing the impact of a compromised package release or dependency chain. The packages named in this file correspond to legitimate database libraries and are relevant to the Skill's declared functionality. No typosquatted or known malicious package was identified during this static review. The confirmed weakness is the absence of deterministic version and integrity controls, not evidence that the currently named packages are malicious. ### Attack Path 1. A user follows the documented knowledge-generation setup procedure. 2. The package installer resolves the newest version satisfying each `>=` constraint. 3. A future compromised release, compromised transitive dependency, or unexpected incompatible release is selected. 4. Package build or installation code runs with the privileges of the user performing installation. 5. Malicious code could read local credentials, alter generated knowledge files, or compromise the host environment. ### Impact Assessment If the dependency supply chain is compromised, installation-time code could obtain the installing user's privileges and access: - Environment variables containing database credentials. - Source files and generated schema knowledge. - Files writabl ...[truncated 296 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (556)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的核心能力是 NL2SQL 和可视化页面生成，而代码并不解析自然语言、也不生成查询或图表页面。它假定 SQL 已经存在，并围绕该 SQL 提供加密、解密、占位符计数、批量读取文件以及输出可粘贴配置片段等功能。虽然输出格式提到可粘贴到 HTML 页面，但这只是为页面配置准备加密后的 SQL，不等同于生成可部署的 HTML 可视化页面。因此该代码块的主要用途与声明严重不符，且包含未声明的能力，属于明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向用户查询场景的“NL2SQL + 可视化页面生成”技能；但提供的代码完全没有自然语言输入处理、SQL生成、SQL校验、图表配置构建、HTML页面生成或部署相关逻辑。相反，代码的核心功能是解析数据库结构导出文件（SQL/CSV/JSON）和字典文件，产出知识库文件供其他系统使用。这属于前置的数据准备/知识库构建工具，而不是声明中的查询与看板生成技能。虽然两者都与数据库知识有关，但主用途和实际能力均存在实质性偏差，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向终端查询与可视化生成的运行时技能；而代码是一个开发/运维性质的知识库重建工具。它通过数据库驱动连接数据库，查询 information_schema / USER_TAB_COLUMNS / wsd_base_dict 等系统或业务表，提取表结构、字段注释和枚举值，然后将结果写入本地 JSON 知识库文件。代码中没有任何自然语言处理、SQL 生成、SQL 校验、HTML 页面生成或图表渲染逻辑。相反，其主要功能是访问数据库元数据并同步本地知识库，这与声明的核心用途存在实质性不一致，因此应判定为 mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明的核心能力是自然语言转 SQL 和生成可视化 HTML 页面，但该代码片段的实际用途是一个配置模块。它负责读取 config.json、环境变量和默认配置，并组合出数据库、Oracle、API、安全认证和工作区配置。代码没有任何与自然语言理解、SQL 构造、SQL 校验、图表渲染或 HTML 页面生成相关的实现。因此该片段与声明用途存在明显的主功能不一致。另一个值得注意的差异是，代码处理并暴露了数据库连接、Oracle 连接和 API 认证等敏感配置，这些资源访问能力并未在声明中体现。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个高层业务技能：接收自然语言、生成 SQL、校验 SQL，并输出带图表的数据看板页面。而提供的代码片段仅实现了两个底层工具函数：在 HTML 字符串中定位
const <varName> = {...}赋值，解析其中 JSON，或在解析失败时提取对象键名。它不包含自然语言理解、数据库查询、SQL 构造、知识库利用、图表生成或页面生成逻辑。虽然 HTML 处理可能是某个页面验证流程的配套细节，但就该代码片段本身而言，其主要行为与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个 NL2SQL 与看板页面生成技能，核心能力应包括自然语言解析、SQL 生成/验证、以及根据结果生成可部署的可视化页面。而给出的代码块实际只是一段部署辅助脚本，负责对现成 HTML 文件做资源路径替换并复制到目标目录。它的主要目的与声明的主要目的明显不同。虽然“生成后部署 HTML 页面”可被视为整体流程中的一个后处理环节，但当前代码本身并未实现声明中的核心能力，反而体现了未声明的文件部署与路径重写能力，因此属于明显的描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
核心不匹配点在于声明把该技能描述为“自然语言转SQL与可视化页面生成技能”，且强调“基于挂载的知识库上下文直接生成SQL”。但这段代码并不做自然语言理解、语义解析或 SQL 生成；它要求输入已经是 SQL、SQL 文件或 sqlMap JSON，然后负责验证、转换、加密并生成 HTML 页面。因此其主要实际职责更像“SQL 驱动的图表页面生成/部署器”，而不是 NL2SQL 生成器。另一方面，代码确实与图表页面生成、SQL 验证、可部署 HTML 输出高度相关，所以并非完全偏离声明，只是声明中最关键的 NL2SQL 能力在该代码块中缺失，构成实质性描述-行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的核心能力是“从自然语言与知识库上下文生成 SQL，并生成图表页面”。但该代码片段并不涉及自然语言理解、知识库访问、SQL 生成或页面生成。它的主要职责是对已存在的 HTML 页面进行完整性校验和有限自动修复，属于后处理/验证工具，而非所声明技能的主体功能。虽然声明中提到‘验证后生成HTML页面’，校验可以算相关支撑环节，但此代码的全部内容都集中在校验与修复，没有实现声明中的主要生成能力，因此描述与实际行为存在明显不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的核心能力是NL2SQL和数据看板页面生成，而提供的代码块仅执行加密与解密操作。虽然示例字符串是SQL，且注释提到与Java端NL2SQL服务保持一致，但这只是对SQL文本进行安全封装的配套工具，不等同于自然语言解析、SQL生成、验证或前端可视化页面生成。代码的主要目的与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向数据分析/可视化的技能：接收自然语言查询、生成 SQL、校验 SQL，并输出可部署的图表页面。而给出的代码片段只包含一个密码加密工具函数，用于与后端登录接口兼容的 AES-128-CBC 加密。两者在核心目的、功能领域和行为上均明显不一致。该代码既没有任何 NL2SQL、知识库读取、SQL 构造/校验，也没有页面或图表生成逻辑；相反，它实现了一个未声明的认证相关能力。因此应判定为描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的核心能力是“自然语言转 SQL”和“生成可部署的数据看板页面”。但实际代码仅处理模板文件管理，主要围绕本地文件系统中的 HTML 模板进行读取、保存、版本记录和回滚，并做简单占位符校验。虽然校验中出现了如 {{ENCRYPTED_SQL}}、{{CHART_CONFIG}} 等占位符，说明它可能是更大系统中页面生成功能的辅助模块，但该代码块本身并不执行自然语言理解、SQL 构造、SQL 校验、图表配置生成或完整页面渲染部署。因此该代码块的实际主用途与声明的技能主用途存在明显偏差，且包含未在声明中体现的文件系统模板版本管理能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向最终业务的“自然语言转 SQL + 可视化页面生成”技能，核心能力应包括理解自然语言、生成 SQL、校验 SQL、并产出 HTML 图表页面。而给出的代码并未实现这些能力。它只是在文件系统中读取模板文件或接收 HTML 字符串，然后依据预设正则规则检查模板是否含有 token 管理逻辑、登录弹窗、CryptoJS CDN、API_AUTH_BASE、SQL/图表配置占位符以及若干函数名。代码既没有自然语言处理，也没有数据库访问、SQL 构造、知识库使用、图表页面生成逻辑。其主用途是模板质量验证，与声明的主用途存在明显且实质性的偏差，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
该描述强调的是“从自然语言生成 SQL，并进一步生成可视化 HTML 页面”的生产型技能；而代码块本身主要是“验证器”。核心函数 verify/verifyByMysql/verifyByOracle/verifyByApi 都是在校验并执行已有 SQL，返回行数、字段、样例数据和错误建议。batchVerifyHtml 也不是生成页面，而是读取现有 HTML，提取 ENCRYPTED_SQL、SQL_PLAIN 和图表配置后，逐条调用后端 API 做验证。代码还包含数据库连接池、API 登录取 token、SQL 加密传输、CLI 参数解析等执行/验证相关能力，这些都超出声明且资源访问更强。虽然描述中提到‘验证后生成页面’，其中“验证”与代码部分重合，但缺失了声明中的两大核心功能——NL2SQL 生成与 HTML 页面生成，因此属于实质性描述与行为不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a data-querying and dashboard-generation skill. The supplied code chunk does not implement any of those capabilities. Instead, it is part of pip, Python's package installer, defining a version and forwarding execution to pip's internal entrypoint wrapper. This is a materially different primary purpose and unrelated functionality, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says the skill should translate natural language into SQL and generate visualization/dashboard HTML pages using knowledge-base context. The provided code does none of that. It is a standard pip launcher that sanitizes sys.path, optionally adds a wheel path, and dispatches to pip's command-line interface. Its primary purpose is package management, which is materially unrelated to the declared skill behavior. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向数据查询与可视化生成的技能，但提供的代码片段与此完全无关。该代码仅用于运行特定副本的 pip：先检查 Python 版本是否满足要求，再通过自定义 finder 重定向对 pip 的导入，最后调用 runpy.run_module("pip") 启动 pip。代码中没有任何与自然语言处理、数据库访问、SQL 生成/校验、知识库上下文利用、或可视化页面生成相关的逻辑。因此其实际行为与声明用途存在明显且实质性的不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says the skill converts natural language to SQL and generates HTML visualization/dashboard pages based on knowledge-base context. The supplied code does none of that. It is a pip internal module that initializes logging and forwards execution to pip's command-line entrypoint wrapper. Its primary purpose is package-management tool startup, which is materially unrelated to SQL generation, data querying, or visualization page creation. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向数据查询与可视化生成的业务技能，但代码内容完全属于 Python 包管理/构建基础设施。该模块围绕 build environment 展开：创建临时目录与 sitecustomize.py，隔离 system site-packages，管理 PATH/PYTHONPATH，检查 requirement 冲突/缺失，并使用 pip 安装构建依赖，必要时还会解析依赖、构建 wheel、处理安装错误。代码中没有任何与自然语言理解、数据库访问、SQL 生成、SQL 校验、图表渲染或 HTML 看板输出相关的逻辑。因此其主要目的、能力和涉及资源均与声明严重不符，属于明显描述-行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says the skill should convert natural-language queries into SQL and generate HTML visualization/dashboard pages. The supplied code does none of that. It is unrelated infrastructure code from pip for managing cached wheel files: hashing link metadata, building cache paths, scanning directories, selecting compatible cached wheels based on supported tags, creating ephemeral temp caches, and reading/writing origin.json metadata. This is a materially different primary purpose and involves undeclared filesystem/package-management behavior rather than SQL generation or visualization output.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear mismatch between the declared skill description and the supplied code. The description claims a data-query and dashboard-generation capability, but the actual code chunk is an unrelated package initializer for pip's internal CLI subsystem. It contains no functional logic beyond a docstring and explicitly does not import submodules. Therefore, the code does not implement, support, or meaningfully relate to the declared NL-to-SQL and visualization functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向数据查询与看板生成的技能，核心能力应包括自然语言理解、SQL 生成/验证，以及可视化页面输出。但实际代码属于 pip 的自动补全实现，与数据查询、知识库、SQL、图表或 HTML 页面完全无关。代码触发条件依赖 PIP_AUTO_COMPLETE、COMP_WORDS、COMP_CWORD 等 shell 自动补全环境变量，资源访问也主要是本地 Python 环境元数据和文件系统目录读取。这是明显的主功能不一致，且包含未声明的本地环境/文件系统补全能力，因此应判定为描述与行为严重不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向数据查询与可视化生成的技能，核心能力应包括解析自然语言、生成SQL、可能结合知识库上下文、校验SQL，并输出HTML图表页面。但提供的代码片段来自 pip 的 base_command.py，是一个通用命令行命令基类：创建参数解析器、配置日志、处理调试模式和异常、设置 PIP_NO_INPUT/PIP_EXISTS_ACTION 等环境变量、检查是否处于 virtualenv、验证缓存目录权限，并最终调用具体命令的 run()。代码中没有任何与自然语言理解、SQL生成、数据库连接、知识库使用、图表渲染或HTML页面生成相关的行为。其主要目的与声明用途完全不同，因此属于明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个“自然语言转SQL与可视化页面生成”技能，核心能力应包括理解自然语言、结合知识库生成SQL、执行/验证查询、以及输出HTML图表页面。给出的代码却是 pip 的内部模块 cmdoptions.py，内容集中在定义 Option/OptionGroup、解析 CLI 参数、检查 pip 安装限制和配置项。它处理的是 Python 包管理场景，而非数据查询或看板生成。虽然代码中存在少量文件路径、网络索引、证书、代理等选项处理，但这些都服务于 pip 包安装，不是声明中的支持细节，而是完全不同的主用途，因此属于明显的描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是面向数据查询与可视化生成的高层业务技能，但提供的代码仅实现了上下文管理：维护一个主执行上下文标志位，进入 main_context 时建立 ExitStack，并允许通过 enter_context 注册其他上下文资源。代码中没有任何与自然语言处理、SQL 生成、数据查询、图表渲染、HTML 生成或页面部署相关的逻辑。其主要用途与声明完全不同，因此属于明显的描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向数据查询与可视化生成的业务技能，应涉及自然语言解析、SQL 生成/校验、HTML 图表页面生成等能力。但提供的代码与这些功能完全无关：它属于 pip 的 CLI/网络层实现，用于构建 PipSession、配置 index URLs、CA 证书、客户端证书、代理、超时，以及检查 pip 是否为最新版本。代码的主要目的、资源访问对象（包索引/网络）和行为都与声明严重不一致，因此应判定为明显不匹配。
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/generate/validate_page.js:284
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/pygments/formatters/__init__.py:91
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/generate/page.js:76
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/verify/index.js:620
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- CHANGES.md:79
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/verify/index.js:247
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- templates/cockpit_template.html:671
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- templates/html_page_template.html:371
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- venv_dm/lib/python3.14/site-packages/pip/_internal/network/auth.py:97
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/requests/adapters.py:257
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/requests/sessions.py:322
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:423
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/connectionpool.py:991
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py:231
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/socks.py:102
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- src/generate/page.js:726
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- venv_dm/lib/python3.14/site-packages/pip/_internal/network/session.py:312
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/truststore/_macos.py:371
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/truststore/_windows.py:458
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:454
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py:113
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/securetransport.py:794
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/util/ssl_.py:140