T09 · Insecure Skill Coding Practices
Warning
- Location
agnet_cli.py:74- Finding
Credential file is written without enforcing restrictive permissions
- Content
View full analysis
None: """Append or update AGNET_USERNAME and AGNET_API_KEY in .env file""" env_path = Path(".env") # Read existing .env content env_content = "" if env_path.exists(): with open(env_path, "r") as f: env_content = f.read() # Update or add AGNET_USERNAME if "AGNET_USERNAME=" in env_content: env_content = _update_env_var(env_content, "AGNET_USERNAME", f'"{username}"') else: env_content += f'\nAGNET_USERNAME="{username}"\n' # Update or add AGNET_API_KEY if "AGNET_API_KEY=" in env_content: env_content = _update_env_var(env_content, "AGNET_API_KEY", f'"{api_key}"') else: env_content += f'AGNET_API_KEY="{api_key}"\n' # Write back to .env with open(env_path, "w") as f: f.write(env_content) # Update current environment os.environ["AGNET_USERNAME"] = username os.environ["AGNET_API_KEY"] = api_key ``` ### Technical Analysis The registration workflow writes the AgNet username and API key into `.env`. The same file is expected to contain `CLIENT_EVM_WALLET_SECRET`, an EVM private key with authority to sign payments. The file is opened with the process's default creation mode, as modified by its umask. The implementation neither creates the file explicitly with mode `0600` nor validates and corrects the permissions of an existing file. On systems with permissive umasks, the resulting credential file may be readable by other local users or processes. Although `SKILL.md` advises users to execute `chmod 600 .env`, documentation does not enforce the security boundary. The update is also performed directly rather than through a securely created temporary file and atomic replacement. The code ...[truncated 1240 chars]- Remediation
View remediation