T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:41- Finding
API Key Persisted in an Insecure Plaintext File
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:41-63
Vulnerability Type: Plaintext credential storage and unsafe secret-file handling
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """Store the API key in the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return FalseTechnical Analysis
The function persists a user-provided API credential in a plaintext
.envfile relative to the current working directory. It does not create the file with an explicitly restrictive permission mode, correct permissions on an existing file, reject symbolic links, or perform an atomic replacement.Consequently, the effective location and security properties of the credential depend on the process working directory, umask, preexisting file permissions, and filesystem state. If
.envalready has permissive permissions,Path.write_text()does not make it private. If an attacker with local write access can prepare.envas a symbolic link, the code follows that link when reading and writing.The function also copies the credential into
os.environ. Processes spawned after this assignment may inherit the API key even when they do not require access to it, ...[truncated 1604 chars]- Remediation
View remediation
Remediation Suggestions
- Prefer an operating-system credential manager or an application-provided secret store instead of plaintext project files.
- If file storage is unavoidable, use a dedicated per-user configuration directory rather than the current working directory.
- Create the secret file with exclusive creation and mode
0600, and verify that the destination is a regular file owned by the expected user. - Reject symbolic links using platform-appropriate no-follow operations, such as
O_NOFOLLOWwhere available. - Write updates to a securely created temporary file in the same directory, set restrictive permissions, flush and synchronize it, and atomically replace the destination.
- Correct the permissions of an existing credential file before reading or updating it, or refuse to use files that are accessible by other users.
- Avoid assigning the key to
os.environunless downstream libraries strictly require it. Keep the secret in narrowly scoped application memory instead. - Ensure
.envis excluded from source control and document clearly that the key is stored locally and sent tohttps://mcp.xiaobenyang.com/api.