T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:44- Finding
API Key Stored in a Plaintext File Without Enforced Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:44-66
Vulnerability Type: Plaintext storage of sensitive credentials
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return FalseTechnical Analysis
The function persistently writes the user-provided API key as plaintext into a
.envfile located relative to the process's current working directory. It usesPath.write_text()without explicitly creating the file with owner-only permissions or verifying the ownership and permissions of an existing file.For a newly created file, effective permissions depend on the process umask. An existing
.envfile retains its current access controls, which may allow unintended local users or processes to read the credential. Using a current-working-directory-relative path also increases the chance that the secret will be stored in a shared directory, backed up, packaged, or accidentally committed to source control.The function additionally copies the key into the process environment. Processes with sufficient local inspection privileges may be able to access that environment, although this does not indepen ...[truncated 1436 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer non-persistent, session-scoped credential injection through a protected environment or secret-management facility.
- If persistence is necessary, use an operating-system credential store or dedicated secret manager instead of a plaintext
.envfile. - Store configuration under a fixed, user-specific configuration directory rather than the current working directory.
- On POSIX systems, create the credential file atomically with owner-only mode
0600; verify that any existing file is owned by the expected user and is not a symbolic link. - Apply restrictive permissions to the parent directory, such as
0700, and reject files with unsafe ownership or access modes. - Avoid placing secrets in project directories. Add
.envto source-control, packaging, and backup exclusion rules. - Use atomic replacement with a temporary file created in the same protected directory to avoid partial writes and reduce race-condition exposure.
- Document credential revocation and rotation procedures so users can promptly invalidate a key after suspected disclosure.