T09 · Insecure Skill Coding Practices
Error
- Location
scripts/analyze.mjs:54- Finding
API Key and Document Disclosure Through Unvalidated Network Destinations
- Content
View full analysis
= "2025-11-01" ? { inputs: [{ url: source.url }] } : { url: source.url }; res = await fetch(analyzeUrl, { method: "POST", headers: { "Content-Type": "application/json", "Ocp-Apim-Subscription-Key": apiKey, }, body: JSON.stringify(body), }); } else { // Binary data from stdin res = await fetch(analyzeUrl, { method: "POST", headers: { "Content-Type": "application/octet-stream", "Ocp-Apim-Subscription-Key": apiKey, }, body: source.data, }); } if (res.status !== 202) { const text = await res.text(); console.error(`Submit failed (${res.status}): ${text}`); exit(1); } const operationLocation = res.headers.get("operation-location"); const body = await res.json(); return { operationLocation, id: body.id }; } async function pollResult(operationLocation, apiKey) { for (let i = 0; i < MAX_POLL_ATTEMPTS; i++) { await sleep(POLL_INTERVAL_MS); const res = await fetch(operationLocation, { headers: { "Ocp-Apim-Subscription-Key": apiKey }, }); const data = await res.json(); if (data.status === "Succeeded") return data; if (data.status === "Failed") { console.error("Analysis failed:", JSON.stringify(data, null, 2)); exit(1); } process.stderr.write("."); } console.error("\nTimeout w ...[truncated 4089 chars]- Remediation
View remediation