T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext Environment File Without Explicit Access Controls
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True ``` ### Technical Analysis The function writes the API key directly into a plaintext `.env` file. It does not explicitly create the file with restrictive permissions, verify the permissions of an existing file, use an operating-system credential store, or perform an atomic protected write. The effective permissions therefore depend on the process umask and any permissions already assigned to `.env`. In a shared or improperly configured environment, another local account or process may be able to read the credential. The repository also contains no demonstrated `.gitignore` protection, creating an additional risk that the file could be committed or included in backups and build artifacts. This issue does not independently grant remote code execution or elevated operating-system privileges. Exploitation requires access to the generated file, a repository copy containing it, or an exposed backup. ### Attack Path 1. A user supplies a valid Xiaobenyang API key. 2. `set_api_key()` invokes `save_api_key_to_env()`. 3. The function stores the key as `XBY_APIKEY= ...[truncated 903 chars]- Remediation
View remediation