T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:44- Finding
API Key Persisted in a Plaintext Working-Directory File Without Enforced Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py, lines 44-64
Vulnerability Type: Plaintext credential storage with uncontrolled file permissions
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return FalseTechnical Analysis
The function persistently writes the user-provided API key in plaintext to
.env, resolved relative to the process's current working directory. It does not enforce restrictive permissions, verify that the destination is a regular file rather than a symbolic link, use atomic file replacement, or ensure that the destination is outside a source-controlled project.The resulting file permissions depend on the operating system and process umask. In a permissive environment, another local account or process may be able to read the credential. Because the path depends on the working directory, the secret may also be placed in an unrelated project and subsequently exposed through source-control commits, backups, indexing services, or shared workspaces.
Persisting the credential is not the minimum privilege necessary to make an authenticated API request. Session-only credential ...[truncated 1567 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not persist the key by default. Keep it in memory for the active session and request explicit, informed consent before any cross-session storage.
- Prefer an operating-system credential manager such as Windows Credential Manager, macOS Keychain, or a Linux Secret Service provider.
- If file storage is unavoidable, use a dedicated per-user configuration directory rather than the current working directory.
- Create the credential file with owner-only permissions (
0600) using secure low-level creation flags, and verify permissions after creation. - Reject symbolic links and verify that the destination is a regular file owned by the expected user.
- Write through a securely created temporary file and atomically replace the destination to reduce race conditions and partial writes.
- Ensure
.envand equivalent secret files are excluded from source control, packaging, diagnostics, and backups where appropriate. - Avoid copying the key into
os.environunless subprocess inheritance is explicitly required; the reviewed implementation does not require subprocess access. - Provide a credential-removal function and document key rotation and revocation procedures for users whose keys may have been exposed.