T09 · Insecure Skill Coding Practices
Warning
- Location
reference/runtime.sh:14- Finding
Credential files are executed as shell code
- Content
View full analysis
- Remediation
View remediation
`, rejecting all other lines and shell syntax. 3. Validate the value against the expected API-key character set and length. 4. Require the file to be owned by the effective user. 5. Reject symbolic links and files with group or other permissions instead of merely warning. 6. Prefer a platform credential store or pass the secret directly through the process environment. A safer parser can read a single literal line without evaluating it: ```bash se_try_load_env_file() { local file="$1" local line key value [ -f "$file" ] || return 1 [ ! -L "$file" ] || { echo "Error: refusing to load an API key from a symbolic link." >&2 return 1 } [ "$(se_get_file_perm "$file")" = "600" ] || [ "$(se_get_file_perm "$file")" = "400" ] || { echo "Error: API-key file permissions must be 600 or 400." >&2 return 1 } IFS= read -r line < "$file" || return 1 key="${line%%=*}" value="${line#*=}" [ "$key" = "STOCK_API_KEY" ] || return 1 [[ "$value" =~ ^[A-Za-z0-9._-]+$ ]] || return 1 STOCK_API_KEY="$value" export STOCK_API_KEY } ``` If compatibility with the existing `export STOCK_API_KEY="..."` format is required, parse that exact format without invoking a shell. ]]>