T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext Environment File
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:45-79
Vulnerability Type: Plaintext credential storage with unrestricted file permissions
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """Store the API key in the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to store API key: {e}") return False def set_api_key(api_key: str) -> bool: """Set the API key and persist it to .env.""" if not api_key or not api_key.strip(): return False api_key = api_key.strip() if not save_api_key_to_env(api_key): return False settings.api_key = api_key return TrueTechnical Analysis
The Skill explicitly requests an API key from the user and persists it as an unencrypted
XBY_APIKEYentry in a.envfile located relative to the process working directory. The file is created throughPath.write_text()without explicitly setting restrictive permissions.Consequently, the actual access controls depend on the process umask and any permissions already present on the file. The implementation also rewrites an existing
.envfile without validating or tightening its permissions. This can expose the credential to other local users ...[truncated 1681 chars]- Remediation
View remediation
Remediation Suggestions
- Prefer session-only credential handling or an operating-system credential manager instead of writing secrets to the project directory.
- Obtain explicit user consent before persisting a credential; provide a non-persistent option.
- If file persistence is unavoidable, create
.envatomically with owner-only permissions such as0600. - Validate and tighten the permissions of an existing
.envfile before reading or rewriting it. - Resolve the storage path explicitly rather than relying on the current working directory.
- Add
.envto.gitignore, packaging exclusions, backup exclusions, and container build exclusions. - Avoid printing, logging, or returning the API key in errors.
- Document credential revocation and rotation procedures.
- Consider accepting the key through a process environment variable supplied by the runtime rather than collecting and storing it through the Skill.