T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:44- Finding
API Key Persisted in an Insecure Plaintext File
- Content
View full analysis
bool: try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The supplied API key is persisted in plaintext in a `.env` file located relative to the process's current working directory. The implementation does not enforce owner-only permissions, verify that the destination is a regular file, reject symbolic links, or perform an atomic file replacement. The default permissions of `Path.write_text()` are affected by the process umask. In an insufficiently restricted environment, the resulting file may be readable by other local accounts. Because the path is relative and symbolic links are followed, an attacker able to prepare the working directory could create `.env` as a symbolic link to another writable file. Calling `set_api_key()` would then rewrite that target with attacker-influenced content. Plaintext persistence also increases the chance that the credential will be copied into backups, build contexts, support archives, or source-control commits. ### Attack Path 1. An attacker obtains local access to the directory from wh ...[truncated 1186 chars]- Remediation
View remediation