T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext File Without Restrictive Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py, lines 45-62
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return TrueTechnical Analysis
The user-supplied API key is written directly to a
.envfile in plaintext. The implementation does not create the file with owner-only permissions, verify the permissions of an existing file, reject symbolic links, or use an operating-system credential store.A newly created file inherits permissions determined by the process umask. An existing file retains its current permissions. Consequently, the secret may be readable by other local principals or processes with access to the working directory. Writing through a predictable relative path also creates a potential symlink-based disclosure or overwrite concern when the working directory is not trusted.
Attack Path
- A user supplies an API key as required by the Skill.
set_api_key()invokessave_api_key_to_env().- The function stores the key as
XBY_APIKEY=<secret>in the working directory's.envfile. - Another local user or process reads a permissively accessible file, or the file is accidentally committ ...[truncated 456 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer obtaining the key from a process environment variable or operating-system secret store without persisting it in the project directory.
- If file persistence is required, create the file atomically with owner-only mode
0600. - Verify and correct permissions when updating an existing file.
- Reject symbolic links and other non-regular files before reading or writing the path.
- Store secrets in a user-specific configuration directory rather than the current working directory.
- Ensure
.envis excluded from version control, build artifacts, diagnostics, and backups. - Document credential rotation and revocation procedures.
- Avoid retaining the secret in process state longer than required.