T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:36- Finding
API Key Persisted in a Plaintext File Without Enforced Access Controls
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False def set_api_key(api_key: str) -> bool: """设置API key并持久化到.env""" if not api_key or not api_key.strip(): return False api_key = api_key.strip() if not save_api_key_to_env(api_key): ``` ### Technical Analysis The Skill requires users to provide an API key and passes it to `set_api_key()`. The key is then stored as plaintext in the workspace-level `.env` file and copied into the process environment. `Path.write_text()` does not explicitly enforce owner-only permissions. When creating the file, its effective permissions depend on the process umask and execution environment. When replacing an existing file, the function also does not verify that the file has safe ownership or permissions. Consequently, the credential may be readable by other local users, workspace-sharing services, backup systems, diagnostic collectors, or processes with access to the project directory. The code also performs no symlink check before re ...[truncated 1779 chars]- Remediation
View remediation