T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext File Without Explicit Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py, lines 45-65
Vulnerability Type: Plaintext storage of sensitive credentials
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return FalseTechnical Analysis
The function stores a user-provided API key directly in a plaintext
.envfile. It does not explicitly create or enforce restrictive file permissions. The file path is also relative to the process working directory rather than a dedicated, validated configuration directory.Consequently, the secret may be written into an unintended project directory and become accessible to other local users or processes according to the effective directory permissions and process umask. It may also be included in source-control commits, archives, backups, or diagnostic bundles.
The API client later uses this credential in the
XBY-APIKEYrequest header. Exposure therefore permits use of the affected user's API identity within the authorization scope assigned by the remote service.Attack Path
- The Skill asks the user to provide an API key.
set_api_key()passes that key to `save_api_key_t ...[truncated 1018 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer session-only credential handling or a platform-provided secret manager or operating-system keyring.
- Obtain explicit user consent before persisting the key.
- Store persistent configuration in a dedicated per-user configuration directory rather than the current working directory.
- Create the secret file atomically with owner-only permissions, such as mode
0600on POSIX systems, and verify existing-file ownership and permissions before modifying it. - Ensure
.envis excluded from version control, packaging, backups, logs, and diagnostic exports. - Avoid retaining the credential in more locations than necessary.
- Provide key rotation and deletion functionality, and instruct affected users to revoke any credential that may already have been exposed.