T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Stored in a Plaintext .env File Without Enforced Access Controls
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key ``` The Skill documentation explicitly directs the agent to collect and persist the credential: ```markdown - On first use, if `.env` does not contain `XBY_APIKEY`, the user must be asked for an API key. - After receiving the key, call `scripts.config.set_api_key(api_key)` to save it. ``` ### Technical Analysis The API key is written directly into a plaintext `.env` file. `Path.write_text()` creates the file according to the process umask and does not explicitly enforce owner-only permissions such as `0600`. Consequently, the confidentiality of the credential depends on external runtime settings. In an environment with a permissive umask, shared working directory, broad backup access, or accidental source-control inclusion, another user or process may be able to read the key. The implementation also places the key in `os.environ`, where it remains available to the current process and may be inherited by subsequently launched child processes. No command execution was found in this project, but expo ...[truncated 1216 chars]- Remediation
View remediation