T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/video_gen.js:134- Finding
Declared Model and Request-Scope Restrictions Are Not Enforced
- Content
View full analysis
0) return 'multi_image'; if (typeof params.image === 'string' && params.image) return 'image'; return 'text'; } function coerceBool(v, defaultVal = false) { if (v == null) return defaultVal; if (typeof v === 'boolean') return v; return String(v).toLowerCase() === 'true'; } function hasNonEmptyModel(params) { const m = params.model; return m != null && String(m).trim() !== ''; } function buildRequestBody(params) { const model = String(params.model).trim(); const body = { prompt: params.prompt, model, duration: Number(params.duration) || 5, }; if (params.aspect_ratio) body.aspect_ratio = params.aspect_ratio; if (params.resolution) body.resolution = params.resolution; if (params.generate_audio != null) body.generate_audio = coerceBool(params.generate_audio, false); if (params.negative_prompt) body.negative_prompt = params.negative_prompt; if (params.image) body.image = params.image; if (params.images) body.images = params.images.slice(0, 3); return body; } async function submitTask(params, apiKey) { if (!hasNonEmptyModel(params)) { return { ok: false, phase: 'failed', errorCode: 'MISSING_PARAM', errorMessage: "'model' is required in JSON parameters (no default model).", }; } const mode = detectMode(params); const pathMap = { text: '/v1/generation/text-to-video', image: '/v1/generation/image-to-video', multi_image: '/v1/generation/multi-image-to-video', }; const body = buildRequestBody(params); ``` The CLI additionally exposes out-of-scope operations at lines 456–463: ```javascript const valid = new Set([ 'wait', 'submit-text', 'submit-image' ...[truncated 3139 chars]- Remediation
View remediation