T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext Project File
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` The corresponding mandatory instruction is: ```markdown - 拿到用户提供的密钥后，调用 `scripts.config.set_api_key(api_key)` 保存，然后继续处理 ``` ### Technical Analysis The credential is stored as unencrypted text in `.env` using `Path.write_text()`. The implementation does not explicitly establish restrictive file permissions, reject symbolic links, use an operating-system credential store, or verify that `.env` is excluded from version control. Authentication requires transmitting the API key to the declared service, but permanent local storage is not necessary for individual API requests. Session-only memory or an existing environment variable would provide the required authentication with less exposure. Consequently, mandatory persistence exceeds the minimum privilege and data-retention requirement ...[truncated 1697 chars]- Remediation
View remediation