T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/config.py:44
- Finding
- API Key Persisted in an Insecure Plaintext File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/config.py:44-61` **Vulnerability Type**: Plaintext credential storage and unsafe file handling **Risk Level**: Medium ### Vulnerable Code ```python def save_api_key_to_env(api_key: str) -> bool: try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The supplied API key is persisted in plaintext in a `.env` file located relative to the process's current working directory. The implementation does not enforce owner-only permissions, verify that the destination is a regular file, reject symbolic links, or perform an atomic file replacement. The default permissions of `Path.write_text()` are affected by the process umask. In an insufficiently restricted environment, the resulting file may be readable by other local accounts. Because the path is relative and symbolic links are followed, an attacker able to prepare the working directory could create `.env` as a symbolic link to another writable file. Calling `set_api_key()` would then rewrite that target with attacker-influenced content. Plaintext persistence also increases the chance that the credential will be copied into backups, build contexts, support archives, or source-control commits. ### Attack Path 1. An attacker obtains local access to the directory from wh ...[truncated 1186 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid persistent storage by default. Keep the API key in process memory or obtain it from an existing secret-management facility. 2. If persistence is required, use an operating-system credential store or a dedicated secret manager rather than a project-level `.env` file. 3. Store configuration under a fixed, user-private directory rather than the current working directory. 4. Create the directory with owner-only permissions and create the secret file with mode `0600`. 5. Reject symbolic links and verify that existing destinations are regular files owned by the expected user. 6. Write to a securely created temporary file in the same directory, set restrictive permissions, flush it, and atomically replace the destination. 7. Add `.env` to version-control, packaging, backup, and diagnostic-export exclusions. 8. Support key revocation and rotation, and document that previously stored keys should be rotated if file exposure is suspected. ]]>