T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:44- Finding
API Key Persisted in a Plaintext Environment File
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function persistently writes the user's API key as plaintext to a predictable `.env` file in the current working directory. No file permissions are explicitly enforced, no symlink protection is applied, and the project does not contain a `.gitignore` demonstrating that the credential file is excluded from source control. The permissions assigned to a newly created file therefore depend on the process umask and surrounding environment. In a shared or improperly configured environment, the resulting file may be readable by other local users or processes. Because the location is relative to the working directory, the secret can also be written into a repository, shared workspace, backup, or archive without the user realizing it. This behavior is explicitly requested by `SKILL.md:17-19`, so it is not hidden credential theft. Nevertheless, the storage mechanism does not provide adequate protection for sensitive authentication material. ### Attack Path ...[truncated 948 chars]- Remediation
View remediation