T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext Project File
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True ``` ### Technical Analysis The function stores a user-supplied API key as plaintext in a predictable `.env` file in the process's current working directory. It uses `Path.write_text()` without explicitly creating the file with owner-only permissions or validating the permissions of an existing file. The project also does not include a `.gitignore` file demonstrating that `.env` is excluded from source control. Consequently, the credential may be exposed through local filesystem access, project archives, backups, logs from ancillary tooling, or accidental repository commits. The API client later uses this credential as the `XBY-APIKEY` authentication header. Disclosure therefore provides access equivalent to the authority assigned to the affected API key. ### Attack Path 1. A user provides an API key as instructed by the Skill. 2. `set_api_key()` invokes `save_api_key_to_env()`. 3. The function writes `XBY_APIKEY=` into `.env` without enforcing restrictive permissions. 4. Another local process or user with access to the project directory reads the file, or ...[truncated 875 chars]- Remediation
View remediation