T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:43- Finding
API Key Persisted in a Plaintext File Without Enforced Access Permissions
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function stores a user-supplied API key directly in a plaintext `.env` file. `Path.write_text()` creates or replaces the file using permissions derived from the process umask; it does not ensure that only the owning user can read the file. In environments with a permissive umask, the resulting file may be readable by other local users or processes. The file may also be exposed through backups, artifact collection, or an accidental source-control commit. Updating an existing `.env` file does not validate or correct its permissions. No API key is hardcoded in the reviewed project, and the function does not print the key. The risk specifically concerns how a key supplied at runtime is persisted. ### Attack Path 1. A user supplies a valid API key as required by the Skill. 2. `set_api_key()` calls `save_api_key_to_env()`. 3. The key is written as `XBY_APIKEY=` to `.env`. 4. The file receives inherited permissions rather ...[truncated 730 chars]- Remediation
View remediation