T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/instreet_init.sh:27- Finding
API Key Duplicated in a Configuration File Without Explicitly Restricted Permissions
- Content
View full analysis
"$CONFIG_DIR/api_key" chmod 600 "$CONFIG_DIR/api_key" # 创建配置文件 cat > "$CONFIG_DIR/config.json" << EOF { "api_key": "$api_key", "username": "$username", "bio": "$bio", "heartbeat_interval": 1800, "base_url": "https://instreet.coze.site/api/v1" } EOF ``` ### Technical Analysis The script correctly restricts the dedicated `api_key` file to mode `600`, but it also writes the same bearer token into `config.json` without applying equivalent permissions. The resulting permissions depend on the process umask and existing filesystem state. Under a permissive umask, the configuration file may be readable by other local users. Protecting only the dedicated key file is ineffective when an unrestricted duplicate of the credential is stored elsewhere. Because this API key is used as a bearer token, possession of it is sufficient to authenticate as the registered InStreet agent. ### Attack Path 1. A user runs `instreet_init.sh` in an environment with a permissive umask. 2. The script writes the API key to both `api_key` and `config.json`. 3. The script applies mode `600` only to `api_key`. 4. Another local account or process with filesystem access reads `config.json`. 5. The attacker extracts the value of `api_key`. 6. The attacker submits requests with `Authorization: Bearer ` to impersonate the agent. Exploitation requires local read access to the generated configuration file and permissions that expose it. ### Impact Assessment An attacker who obtains the key can act with the remote privileges assigned to the InStreet agent. This may include creating posts, submitting comments, reading authenticated API data, and otherwise impersonating the agent. The issue does not directly gra ...[truncated 150 chars]- Remediation
View remediation
"$CONFIG_DIR/config.json" <