T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext Environment File
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True ``` ### Technical Analysis The skill stores the user-provided API key directly in a plaintext `.env` file in the current working directory. No encryption, operating-system credential storage, ownership validation, or explicit restrictive file permissions are used. When the file is newly created, its permissions depend entirely on the process umask. When an existing file is overwritten, potentially insecure permissions are retained. The current working directory is also used instead of a fixed, application-specific configuration directory, increasing the possibility of writing the credential into a shared workspace or source repository. ### Attack Path 1. A user provides an API key as required by the skill. 2. `set_api_key()` invokes `save_api_key_to_env()`. 3. The key is written as `XBY_APIKEY=` to `.env`. 4. An unrelated local process, another user with workspace access, a backup process, or a source-control operation obtains the `.env` file. 5. The exposed key is reused to make requests under the victim's API account. ### Impact Assessment Successful exploi ...[truncated 388 chars]- Remediation
View remediation