T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/capabilities/configure/cmd.py:29- Finding
Access Key Exposure Through Command-Line Arguments, Plaintext Storage, and Diagnostic Output
- Content
View full analysis
``` `scripts/capabilities/configure/service.py:75-89` stores the credential in plaintext without enforcing restrictive permissions: ```python config.setdefault("skills", {}) config["skills"].setdefault("entries", {}) config["skills"]["entries"].setdefault(SKILL_NAME, {}) skill_entry = config["skills"]["entries"][SKILL_NAME] # apiKey 作为唯一写入目标，并移除旧格式 env.ALI_1688_AK 避免误导 skill_entry["apiKey"] = api_key if "env" in skill_entry and isinstance(skill_entry["env"], dict): skill_entry["env"].pop("ALI_1688_AK", None) if not skill_entry["env"]: del skill_entry["env"] CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) with open(CONFIG_PATH, "w", encoding="utf-8") as f: json.dump(config, f, ensure_ascii=False, indent=2) ``` `scripts/_auth.py:199-216` reveals the complete Access Key ID and the first eight characters of the secret when executed directly: ```python # 测试入口 if __name__ == "__main__": # 从环境变量获取 AK 进行测试 import os test_ak = os.environ.get("ALI_1688_AK") if not test_ak: print("❌ 请先设置环境变量 ALI_1688_AK") pri ...[truncated 2923 chars]- Remediation
View remediation