T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext Environment File
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:45-63, 70-78
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: MediumThe Skill automatically persists a user-supplied API key to a plaintext
.envfile. The relevant code is:python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False def set_api_key(api_key: str) -> bool: """设置API key并持久化到.env""" if not api_key or not api_key.strip(): return False api_key = api_key.strip() if not save_api_key_to_env(api_key): return False # 更新全局 settings 实例 settings.api_key = api_key return TrueTechnical Analysis
save_api_key_to_env()writes the credential directly into.envasXBY_APIKEY=<secret>. The file is created or replaced usingPath.write_text()without explicitly applying owner-only permissions, checking whether the destination is a symbolic link, using atomic replacement, or integrating with a protected credential store.Consequently, protection depends on the process umask and surrounding directory permissions. The credential can also be exposed if the project directory is copied, archived, bac ...[truncated 1706 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer session-only credential handling through a protected environment variable rather than automatically persisting the key.
- If persistence is necessary, obtain explicit user consent and use an operating-system credential manager or secret-management service.
- If a file must be used, create it with owner-only permissions such as
0600; verify the resulting permissions before storing the key. - Resolve the destination against a trusted application directory rather than the ambient working directory.
- Reject symbolic links and non-regular files, and perform the update through a securely created temporary file followed by an atomic replacement.
- Ensure
.envis excluded from version control, packaging, backups, diagnostics, and logs. - Avoid retaining the key in more process-global locations than necessary, and never include it in exception messages or diagnostic output.
- Document credential revocation and rotation procedures for users whose
.envfile may have been exposed.