T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:43- Finding
API Key Persisted in a Plaintext File Without Enforced Access Controls
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function persists a user-supplied API key in a plaintext `.env` file. It does not explicitly enforce restrictive permissions, perform an atomic write, reject symbolic links, or resolve the file to a dedicated protected configuration directory. For a newly created file, effective permissions depend on the process umask. For an existing file, potentially permissive permissions remain unchanged. Because `Path(".env")` is relative to the current working directory rather than the project or user configuration directory, the secret may also be written into an unintended directory, including a source repository. If an attacker can prepare the current working directory, a symbolic-link attack may redirect the write to another file writable by the victim. The replacement operation would then overwrite any existing `XBY_APIKEY=` line or append the secret to the targeted file. ### Attack Path 1. A user invokes the Skill without a configured API key. 2. The Skill requ ...[truncated 1388 chars]- Remediation
View remediation