T09 · Insecure Skill Coding Practices
Error
- Location
scripts/job_hunter.py:86- Finding
Gemini API Key Exposed Through Process Arguments and Insecure Plaintext Storage
- Content
View full analysis
None: """Persist *data* as JSON to *path*, creating directories as needed.""" ensure_dir() with open(path, "w") as f: json.dump(data, f, indent=2, ensure_ascii=False) ``` ```python def cmd_setkey(api_key: str) -> None: """Store the Gemini API key in the config file.""" config = load_config() config["gemini_api_key"] = api_key save_json(CONFIG_FILE, config) print(json.dumps({"status": "ok", "message": "Gemini API key saved"}, indent=2)) ``` ```python command = sys.argv[1] commands: dict[str, Any] = { "search": lambda: cmd_search(sys.argv[2]), "setkey": lambda: cmd_setkey(sys.argv[2]), "save": lambda: cmd_save(sys.argv[2]), "saved": lambda: cmd_saved(), "unsave": lambda: cmd_unsave(sys.argv[2]), "history": lambda: cmd_history(), "rerun": lambda: cmd_rerun(sys.argv[2]), } ``` ### Technical Analysis The documented setup procedure passes the Gemini API key as a command-line argument. Depending on the host environment, command-line arguments may be exposed through process inspection, shell history, audit facilities, terminal logs, or Agent execution transcripts. The key is subsequently placed in `config.json` as unencrypted JSON. Although storage of an API credential may be necessary for optional AI scoring, `save_json()` relies entirely on the proces ...[truncated 1342 chars]- Remediation
View remediation