T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext Environment File Without Enforced Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:45-63
Vulnerability Type: Plaintext storage of sensitive credentials
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return TrueThe persistence behavior is also explicitly required by
SKILL.md:17-19:text - When XBY_APIKEY is absent from .env, the Skill must ask the user for an API key - After receiving the key, call scripts.config.set_api_key(api_key) to save itTechnical Analysis
The application writes the user-supplied API key directly into a plaintext
.envfile. The implementation does not use an operating-system credential store, encrypt the value, obtain explicit consent for persistent storage, or enforce restrictive file permissions such as mode0600.Path.write_text()creates a new file according to the process umask and preserves the permissions of an existing file. Consequently, the confidentiality of the key depends on external runtime configuration that this Skill neither verifies nor controls. The same key is also copied into the process environment, where it may be visible to sufficiently privileged local processes or inherited by child processes.This is not evidence that the Skill deliber ...[truncated 1517 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer session-only credential handling or an operating-system credential manager instead of storing the key in the project directory.
- Obtain explicit user consent before persisting the credential and clearly disclose the destination and retention period.
- If file persistence is unavoidable, create the credential file atomically with mode
0600and verify or correct permissions on existing files. - Store credentials in a user-specific configuration directory rather than the repository or working directory.
- Add
.envto.gitignoreand deployment artifact exclusion rules. - Avoid copying the key into the process environment unless required, and prevent unnecessary inheritance by child processes.
- Never include the key in logs, exception messages, telemetry, or API response objects.
- Provide key rotation and revocation guidance in case the file is exposed.