T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:48- Finding
API Key Persisted in a Plaintext File Without Enforced Access Controls
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function writes the user-provided API key directly into a plaintext `.env` file. `Path.write_text()` creates or rewrites the file according to the process umask and does not explicitly enforce owner-only permissions. If `.env` already exists, the function also rewrites it without checking its ownership, file type, or current access mode. In a shared, incorrectly permissioned, backed-up, or externally synchronized workspace, the credential may consequently become accessible outside the intended process. The API key is additionally copied into the process environment. This is conventional for configuration, but it increases exposure to processes or diagnostic systems that are able to inspect the environment. This issue does not by itself provide remote access to the host. Exploitation requires access to the workspace, its backups, or another local disclosure channel. ### Attack Path 1. A user supplies an API key as required by the ...[truncated 1099 chars]- Remediation
View remediation