T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:46- Finding
API Key Persisted in a Predictable Plaintext File Without Explicit Permission Controls
- Content
View full analysis
bool: """Persist the API key to the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return False ``` ### Technical Analysis The supplied API key is written in plaintext to `.env` in the process's current working directory. The implementation does not create the file with an explicit restrictive mode, inspect or repair the permissions of an existing file, or ensure that the selected path is private to the current user. For a newly created file, effective permissions depend on the host process's umask. If `.env` already exists, `Path.write_text()` preserves its existing permissions, which may allow access by other local users or processes. The predictable working-directory location also increases the chance that the file is copied into backups, included in an archive, exposed through a development environment, or accidentally committed to source control. The same secret is also copied into the process environment. Child processes launched after this assignment may inherit the value, expanding the number of ...[truncated 1106 chars]- Remediation
View remediation