harden: the api in Api.js

[anupamme]

Summary

Harden input handling in src/Api.js (flagged by multi_agent_ai).

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	src/Api.js:11
Assessment	Defensive hardening
Chain Complexity	2-step

Description: The Api.js module uses fetch() to make HTTP requests. The _sendVerbatim method accepts a 'path' parameter that can be an external URL (detected via regex /^[a-zA-Z]+:///). While the code distinguishes between internal API paths and external URLs, there is no URL validation or allowlist mechanism to prevent requests to internal network resources or cloud metadata endpoints.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/Api.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security