T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext File Without Enforced Access Controls
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True ``` ### Technical Analysis The user-provided API key is stored directly in a plaintext `.env` file. `Path.write_text()` does not explicitly create or enforce owner-only permissions, so the resulting access controls depend on the process umask and any permissions already assigned to the file. The path is also relative to the current working directory rather than anchored to a known private configuration directory. Consequently, the credential may be written into a shared directory, project checkout, backup location, or source-controlled workspace. If `.env` already exists with permissive permissions, rewriting it does not correct those permissions. The implementation also does not protect against the destination being a symbolic link. In an attacker-controlled working directory, a local attacker could potentially arrange for `.env` to point to another writable file, causing the credential to be placed in an unintended location. ### Attack Path 1. A user is instructed to provide an `XBY_APIKEY`. 2. The Agent calls `set_api_key()`, which invokes ...[truncated 1024 chars]- Remediation
View remediation