T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:43- Finding
API Key Persisted in a Plaintext Environment File Without Enforced Access Controls
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function stores the user-provided API key directly in a plaintext `.env` file. The file is created or overwritten with `Path.write_text()` without explicitly enforcing owner-only permissions. Its resulting permissions therefore depend on the process environment and operating-system umask. The implementation also does not verify the permissions of an existing `.env` file, use an operating-system credential store, or offer session-only credential handling. The Skill instructions make persistence part of the normal API-key setup workflow. Although the API key is not deliberately logged by this code, plaintext persistence expands the number of locations from which it can be recovered. The file may be exposed to other local processes or users where filesystem permissions permit access, included in backups or deployment artifacts, or committed to source control accidentally. ### Attack Path 1. A user supplies an API key as required by the Skill workflow. 2. The ...[truncated 1086 chars]- Remediation
View remediation