affaan-m/ecc taste-application
Checked the catalogued skill at taste-application.
F; retained sample includes a critical finding · SD-013 · what this rule accepts as a false positive →
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
16 suppressed by AI triage
The import of urllib.request is used for legitimate HTTP requests to a trusted API.
Reference to https://fal.ai/models is an expected endpoint for the library's functionality.
The dry‑run host is a placeholder for local testing, not a malicious outbound call.
Link to https://fal.ai/dashboard/keys is a legitimate key‑management page.
Custom redirect handler validates URLs against approved hosts, preventing malicious redirects.
The download function performs safe HTTPS requests with size limits and host validation.
Duplicate reference to a safe outbound request handler, no malicious behavior.
The import of urllib.request is used for legitimate HTTP requests to a trusted API.
Reference to https://fal.ai/models is an expected endpoint for the library's functionality.
The dry‑run host is a placeholder for local testing, not a malicious outbound call.
Link to https://fal.ai/dashboard/keys is a legitimate key‑management page.
Custom redirect handler validates URLs against approved hosts, preventing malicious redirects.
The download function performs safe HTTPS requests with size limits and host validation.
Duplicate reference to a safe outbound request handler, no malicious behavior.
The absolute /tmp path is hardcoded in the script and not influenced by external input, so it does not pose a real traversal risk.
The code performs a dictionary lookup, not an outbound network call