T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:49- Finding
API Key Persisted in a Plaintext File Without Permission Hardening
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:49-70
Vulnerability Type: Plaintext storage of sensitive credentials
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return FalseTechnical Analysis
The function permanently stores the user-provided API key as plaintext in a
.envfile located in the process's current working directory. When this file is created, its permissions are determined by the process umask. The implementation does not explicitly require owner-only permissions, verify the permissions of an existing file, or use a protected operating-system credential store.The use of a relative path also means the credential may be written into a shared workspace or project directory. Such a file can be exposed through local file access, workspace synchronization, backups, archive creation, or accidental source-control inclusion.
The function rewrites the file directly rather than creating a protected temporary file and replacing the destination atomically. This can also result in insecure permission inheritance or partial writes, although the principal security concern is plaintext credential exposure.
Attack Path
- A user supplies an Xiaoben ...[truncated 1094 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer runtime-only secret injection or an operating-system credential manager instead of writing the API key into the project directory.
- Obtain explicit user consent before persisting any credential and clearly identify the storage location.
- If file-based storage is unavoidable, use a dedicated per-user configuration directory outside the project or shared workspace.
- Create the credential file with owner-only permissions, such as mode
0600on POSIX systems, and reject or repair existing files with broader permissions. - Write updates atomically by creating a protected temporary file in the same directory, flushing it, applying restrictive permissions, and replacing the destination.
- Ensure
.envis excluded from source control, packaging, logging, workspace publication, and backups where practical. - Support credential revocation and rotation, and advise users to rotate any key that may already have been stored in an exposed workspace.
- Avoid printing or returning credential values in exception messages or diagnostic output.