T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:42- Finding
API Key Persisted in a Plaintext File Without Explicit Permission Hardening
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The Skill requires the user to supply an API key and persists that credential directly in a `.env` file. The file is created or overwritten with `Path.write_text()` without explicitly setting restrictive permissions, verifying the target file type, rejecting symbolic links, or using an atomic secure-file creation procedure. The effective permissions therefore depend on the process environment and operating-system umask. In an environment with permissive defaults, another local account or process may be able to read the credential. Storing the key in the project working directory also increases the likelihood that it will be copied into backups, build contexts, archives, or version-control commits. The code additionally places the key in the process environment. This is common configuration behavior, but it can expose the credential to child processes or process-inspection mechanisms where permitted by the oper ...[truncated 1204 chars]- Remediation
View remediation