T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext Environment File Without Explicit Permission Hardening
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The `save_api_key_to_env` function stores the user-supplied API key directly in a plaintext `.env` file. The write operation does not explicitly create or enforce restrictive file permissions. Consequently, the effective permissions depend on the process umask and, when the file already exists, its existing permission mode. The project also does not contain a `.gitignore` file in the audited directory structure. This creates an additional risk that the generated `.env` file could be included in a source-control commit, project archive, backup, diagnostic bundle, or other copied artifact. The same key is placed into the process environment through `os.environ["XBY_APIKEY"]`. Although this is necessary for the current configuration design, environment variables may be visible to privileged local processes and can be inherited by child processes. ### Attack Path 1. The Skill instructs a user to provide an `XBY_APIKEY`. 2. `set_api_key` passes the credentia ...[truncated 1143 chars]- Remediation
View remediation