T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:44- Finding
API Key Persisted in Plaintext Without Restrictive File Permissions
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function stores the API key directly in a plaintext `.env` file. `Path.write_text()` creates the file using permissions derived from the process umask and preserves the permissions of an existing file. The code neither creates the file with an explicit owner-only mode such as `0600` nor verifies that an existing `.env` file is not readable by other users. Consequently, in a shared or incorrectly configured runtime environment, another local user or process may be able to read the API key. The relative path also means the secret is written into the current working directory, which may be a shared location or inadvertently included in backups, archives, or source-control operations. The key is additionally placed in the process environment. Although this is not ordinarily exposed to unrelated users on a correctly secured operating system, privileged processes, crash diagnostics, or process-inspection facilities may reveal it. ### Attack Path 1. A user supplies a vali ...[truncated 1027 chars]- Remediation
View remediation