api_endpoint accepts any string; malformed URLs are not caught early.
Risk: Silent connection failures or SSRF vectors in downstream HTTP client.
Proposed fix: Validate the endpoint against URI/URL schema during configuration and raise on invalid input.
api_endpointaccepts any string; malformed URLs are not caught early.Risk: Silent connection failures or SSRF vectors in downstream HTTP client.
Proposed fix: Validate the endpoint against URI/URL schema during configuration and raise on invalid input.