T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:42- Finding
API Key Stored in a Plaintext File Without Permission Hardening
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py, lines 42-63
Vulnerability Type: Plaintext credential storage
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return FalseTechnical Analysis
The API key is written in plaintext to a predictable
.envfile in the current working directory.Path.write_text()neither applies an explicit restrictive permission mode nor verifies the file's owner. A newly created file therefore inherits permissions determined by the process umask, while an existing file retains its current permissions.The project also provides no evidence that
.envis excluded from source control, backups, artifact packaging, or access by other processes. Consequently, the credential may become available to local users or project-integrated tooling with read access.Attack Path
- A user supplies an
XBY_APIKEYas required by the Skill. set_api_key()callssave_api_key_to_env().- The key is saved as plaintext in the working directory's
.envfile. - Another local user, process, development tool, backup system, or accidentally published repository obtains the file.
- The exposed key is reused to authenticate to the XiaoBenYan ...[truncated 363 chars]
- A user supplies an
- Remediation
View remediation
Remediation Suggestions
- Prefer a platform secret manager, protected credential store, or session-only environment variable instead of persistent plaintext storage.
- If file persistence is essential, create the file atomically with owner-only mode
0600. - Verify the file is a regular file owned by the expected user before reading or replacing it.
- Avoid following symbolic links when creating or updating the credential file.
- Store credentials in a fixed, access-controlled configuration directory rather than the process working directory.
- Add
.envto.gitignoreand artifact exclusion rules. - Document credential rotation and immediately rotate any key believed to have been exposed.
- Avoid placing the secret in multiple locations, such as both a file and mutable process environment, unless operationally necessary.