T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:47- Finding
API Key Persisted in Plaintext Without Enforced File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:47-60
Vulnerability Type: Plaintext sensitive-data storage with unsafe inherited permissions
Risk Level: MediumVulnerable Code
python if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return TrueTechnical Analysis
The application stores the user-supplied API key as plaintext in a
.envfile relative to the process's current working directory. The write operation does not explicitly create the file with restrictive permissions, verify file ownership, reject symbolic links, or correct unsafe permissions on an existing file.The resulting permissions depend on the process umask and any permissions already assigned to
.env. In an unsafe deployment environment, another local user or process may be able to read the credential. Writing through a predictable relative path also increases exposure to working-directory mistakes and symbolic-link attacks when an attacker can modify that directory.Exploitation requires local access to the file or control over the directory in which the application runs. The code does not establish that the file is universally readable, so exposure is conditional on deployment permissions.
Attack Path
- A user supplies an API key as required by the Skill.
set_api_key()passes the secret tosave_api_key_to_env().- The function writes the key as
XBY_APIKEY=<secret>into.envin the current working directory. - The file inherits permissions determined by the process umask or ...[truncated 836 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer an operating-system credential manager, secret-management service, or runtime environment variable instead of persistent plaintext storage.
- If file persistence is unavoidable, use a dedicated per-user configuration directory rather than the current working directory.
- Create the credential file atomically with owner-only permissions equivalent to
0600. - Verify that the destination is a regular file owned by the expected user, and reject symbolic links or unexpected ownership.
- Check and correct the permissions of an existing
.envfile before writing credentials. - Write to a securely created temporary file, apply restrictive permissions, and atomically replace the destination to avoid partial writes and race conditions.
- Document where the key is stored, which external service receives it, and how users can rotate or revoke it.
- Ensure the
.envfile is excluded from version control, backups, diagnostic bundles, and application logs.