T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:46- Finding
API Key Persisted in Plaintext Without File Permission Hardening
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function stores the user-provided API key as plaintext in a `.env` file located in the process's current working directory. The file is created using `Path.write_text()` without explicitly enforcing restrictive filesystem permissions, validating file ownership, checking whether the target is a symbolic link, or confirming that the working directory is private. The resulting permissions depend on the process umask and the state of any pre-existing `.env` file. In a shared or incorrectly configured environment, other local accounts or processes may be able to read the credential. Because the file is placed in the working directory, it may also be included inadvertently in source-control commits, archives, backups, or diagnostic bundles. The code additionally places the key in the process environment. Child processes created afterward may inherit it, increasing the credential's exposure scope. ### Attack Path 1. A user provides an Xiaobenyang API key as requi ...[truncated 1149 chars]- Remediation
View remediation