T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:43- Finding
API Credential Persisted in a Plaintext Environment File
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:43-64
Vulnerability Type: Plaintext storage of sensitive credentials
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return FalseTechnical Analysis
The function persistently writes the API key to a plaintext
.envfile located relative to the process working directory. It does not create the file with an explicit owner-only permission mode, verify the permissions of an existing file, use atomic replacement, or store the credential through a protected operating-system credential facility.The confidentiality of the key consequently depends on the process umask, existing file permissions, working-directory access controls, backup policies, and source-control practices. Because the path is relative, the actual storage location also changes according to the directory from which the Skill is invoked.
The same secret is copied into the process environment. Child processes and other processes with sufficient local privileges may be able to obtain environment values, depending on the operating system and process isolation configuration.
Attack
...[truncated 1263 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer storing the credential in an operating-system secret manager, such as Keychain, Credential Manager, Secret Service, or a managed deployment secret store.
- If persistence is unnecessary, retain the key only in process memory and require callers to inject it through a protected runtime environment.
- If file-based persistence is required:
- Store the file in an explicit per-user configuration directory rather than the current working directory.
- Create it with owner-only permissions (
0600on POSIX systems). - Validate and reject insecure permissions on an existing file.
- Write updates to a securely created temporary file and atomically replace the destination.
- Avoid following symbolic links and verify that the destination is a regular file owned by the expected user.
- Add
.envto.gitignoreand relevant package-exclusion rules, and enable secret scanning in version control and CI. - Document credential rotation procedures and advise users to rotate any key that may already have been committed, backed up insecurely, or exposed to other local users.
- Avoid placing the key in the process environment unless required, and prevent untrusted child processes from inheriting it.