T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:46- Finding
API Key Persisted in Plaintext Without File Security Controls
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py, lines 46-64
Vulnerability Type: Insecure sensitive-data storage and unsafe file handling
Risk Level: MediumThe application persists the supplied API key in a plaintext
.envfile located in the process's current working directory.python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return FalseTechnical Analysis
Path(".env")resolves relative to the current working directory rather than a fixed, application-controlled configuration directory. The function writes the API key as an unencryptedXBY_APIKEYvalue and does not:- Enforce owner-only file permissions.
- Check whether
.envis a symbolic link. - Verify that the destination is a regular file.
- Use atomic file creation or replacement.
- Prevent the file from being placed in a version-controlled directory.
File permissions created by
Path.write_text()depend on the process umask. Under a permissive environment, the resulting file may be readable by other local users or processes. If an attacker can prepare the working directory, a malicious.envsymbolic link could redirect the write to another file accessible ...[truncated 1766 chars]- Remediation
View remediation
Remediation Suggestions
- Avoid persistent storage by default. Keep the API key in a session-scoped environment variable or use the host platform's secret-management facility.
- If persistence is necessary, use an operating-system credential store such as Keychain, Credential Manager, Secret Service, or an appropriately configured external secret manager.
- Store configuration in a fixed, user-private directory rather than the current working directory.
- Create the file atomically with owner-only permissions such as
0600; validate permissions after creation. - Reject symbolic links and non-regular files before reading or writing the destination. Where supported, use no-follow filesystem flags.
- Avoid read-modify-write operations on a predictable shared path. Write to a securely created temporary file in the same private directory and atomically replace the destination.
- Ensure
.envis excluded from version control, packaging, logs, backups, and diagnostic output. - Document key rotation and revocation procedures so users can invalidate credentials after suspected exposure.