T09 · Insecure Skill Coding Practices
- Location
scripts/query.py:41- Finding
API Key Is Automatically Persisted in a Plaintext Configuration File
- Content
View full analysis
Vulnerability Details
File Location:
scripts/query.py, lines 41–43 and 218–220
Vulnerability Type: Plaintext credential storage and unnecessary credential persistence
Risk Level: MediumVulnerable Code
python def save_config_to_default(cfg: Dict[str, Any]) -> None: with open(CONFIG_PATH, "w", encoding="utf-8") as f: json.dump(cfg, f, ensure_ascii=False, indent=2)The function is invoked unconditionally after resolving the API key:
python # Save the resolved API Key to configuration cfg["apiKey"] = api_key save_config_to_default(cfg)Technical Analysis
The script accepts the API key through three channels: the
--api-keycommand-line argument, theAPI_KEYenvironment variable, or an existingconfig.jsonfile. Regardless of the source, lines 218–220 automatically copy the resolved key intoconfig.json.This persistence is unnecessary when the user selected an ephemeral credential source such as an environment variable. It also contradicts the security expectation created by the README, which describes the environment variable as the recommended configuration method.
The file is created with Python's default
open()behavior and therefore relies on the process umask for its permissions. The script does not explicitly enforce owner-only permissions such as mode0600. Consequently, the credential may be exposed to other local accounts or processes depending on the runtime environment and file permissions. A plaintext file may also be collected by backup software, workspace synchronization, artifact packaging, or source-control operations.The API key is documented as authorizing access to sensitive vehicle information, including:
- Bound vehicle identifiers
- TUID, frame/VIN, and barcode values
- Exact current coordinates and street address
- Vehicle online, power, speed, and battery status
- Historical trip timestamps, start addresses, and destina ...[truncated 1544 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove unconditional credential persistence. Keys obtained from
API_KEYor--api-keyshould remain in memory only for the duration of the process. - Treat
config.jsonas an explicit input rather than automatically creating or modifying it during ordinary queries. - If credential storage is required, add an explicit opt-in option such as
--save-api-keyand clearly warn the user that the key will be stored locally. - Create any credential file with owner-only permissions from the outset, for example by using
os.open()with mode0o600. Verify and reject overly permissive permissions when reading an existing file. - Prefer an operating-system credential store or secret-management facility instead of a plaintext JSON file.
- Add
config.jsonto.gitignoreand relevant packaging exclusions to reduce the likelihood of accidental publication. - Avoid recommending command-line credential input because process arguments may be visible through process inspection, shell history, or execution logs.
- Document credential lifecycle, storage behavior, revocation instructions, and the sensitive API capabilities granted by the key.
- After implementing the change, advise existing users to delete plaintext
config.jsonfiles created unintentionally and rotate any key that may have been exposed.
- Remove unconditional credential persistence. Keys obtained from