T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext File Without Enforced Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:45-63
Related Instruction Location:SKILL.md:17-18, 34
Vulnerability Type: Plaintext credential storage with insecure file permissions
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return FalseThe associated Skill instructions require this behavior:
markdown - When the API key is obtained from the user, call `scripts.config.set_api_key(api_key)` to save it and continue processing.Technical Analysis
The Skill collects an API credential from the user and writes it directly to a plaintext
.envfile. The file is addressed relative to the process's current working directory, andPath.write_text()does not explicitly enforce restrictive permissions such as owner-only mode0600.The resulting permissions depend on the process umask and any pre-existing file permissions. In shared execution environments, another local account or process may be able to read the credential. Because the destination is the current working directory, the key may also be written into an unrelated project directory, included in a backup, o ...[truncated 1438 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer an operating-system credential store, platform secret manager, or session-only in-memory storage instead of a plaintext project file.
- If file persistence is necessary, place the credential in a dedicated per-user configuration directory rather than the current working directory.
- Create the secret file atomically with owner-only permissions, such as mode
0600on POSIX systems. - Verify and correct permissions when updating an existing file.
- Use a temporary file in the same protected directory, flush it, set its permissions, and atomically replace the destination.
- Ensure
.envand equivalent secret files are excluded from source control, build artifacts, telemetry, and backups where appropriate. - Inform the user before persisting the credential and offer a non-persistent configuration option.
- Apply server-side key scoping, rotation, expiration, rate limits, and revocation so disclosure has limited consequences.