T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:44- Finding
API Key Persisted in a Plaintext Environment File
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py, lines 44–67
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False def set_api_key(api_key: str) -> bool: """设置API key并持久化到.env""" if not api_key or not api_key.strip(): return False api_key = api_key.strip() if not save_api_key_to_env(api_key): return FalseTechnical Analysis
The application takes an API key supplied by the user and persistently writes it to
.envas unencrypted text.Path.write_text()relies on the process environment and current umask when creating the file; the code does not explicitly enforce owner-only permissions. It also does not reject symbolic links or use an atomic, securely created file.Consequently, the credential may become accessible to other local users or processes with permission to read the project directory. It may also be exposed through backups, workspace archiving, or an accidental source-control commit. If
.envis an attacker-controlled symbolic link, the write may target another file writable by the process.Attack Path
- The user supplies an API key as required ...[truncated 1173 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer session-only credential handling or an operating-system credential store instead of persistent plaintext storage.
- If file-based storage is unavoidable, securely create the file with owner-only permissions (
0600) and verify the resulting permissions. - Reject symbolic links and other unexpected file types before reading or writing
.env. - Write updates to a securely created temporary file in the same directory, apply restrictive permissions, and atomically replace the destination.
- Add
.envto.gitignoreand relevant packaging or backup exclusion rules. - Avoid printing, logging, or returning API-key values in error messages.
- Document credential rotation and revocation procedures so users can invalidate a key after suspected disclosure.
- Consider obtaining the key from a secret-management service or inherited environment variable without copying it to disk.