T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:44- Finding
API Key Persisted in a Plaintext File Without Explicit Permission Controls
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function persistently writes the supplied API key to a plaintext `.env` file in the process's current working directory. It does not explicitly create the file with restrictive permissions, verify the permissions of an existing file, or repair permissions after writing. The effective permissions of a newly created file therefore depend on the process umask. If `.env` already exists, its potentially permissive permissions remain in effect. Using a path relative to the working directory also means the secret can be written to an unintended project, shared directory, or source-controlled workspace. The key is additionally copied into the process environment. This is expected for application configuration, but it expands the locations in which the credential is present and may expose it to process diagnostics or child processes created later by the host application. ### Attack Path 1. The skill asks the user for an API key. 2. The user supplies a valid crede ...[truncated 1200 chars]- Remediation
View remediation