T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:43- Finding
API Key Persisted in a Plaintext File Without Permission Hardening
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function stores the API key directly in a `.env` file in the current working directory. The credential is written in plaintext, and the implementation neither creates the file with restrictive permissions nor verifies or corrects the permissions of an existing file. The effective permissions therefore depend on the process umask and any pre-existing `.env` file mode. In a shared environment, the resulting file may be readable by other local users or processes. Working-directory storage also increases the chance that the file will be copied into backups, build artifacts, archives, or source-control commits. The same credential is placed in the process environment, which can expose it to child processes and to process-inspection mechanisms permitted by the host operating system. ### Attack Path 1. The user provides an API key as required by the Skill. 2. `set_api_key()` calls `save_api_key_to_env()`. 3. The function writes `XBY_APIKEY=` ...[truncated 997 chars]- Remediation
View remediation