T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Persisted in Plaintext Without Secure File Controls
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True ``` ### Technical Analysis The function stores the user-provided API key as plaintext in a `.env` file resolved relative to the process's current working directory. It does not enforce restrictive file permissions, verify file ownership, reject symbolic links, or use an atomic and securely created credential file. When a new file is created, its effective permissions depend on the process umask. An unsafe umask can make the credential readable by other local users. If `.env` already exists with permissive permissions, `Path.write_text()` does not correct those permissions. The use of a current-working-directory-relative path also creates a symbolic-link risk. If an attacker can prepare the working directory and replace `.env` with a symbolic link, the write operation follows that link. This can disclose the API key at an attacker-selected same-privilege location or overwrite the linked file with reconstructed environment-file content. The Skill instructions require collecting and saving the API key when it is absent, so this behavior occurs ...[truncated 1422 chars]- Remediation
View remediation