T09 · Insecure Skill Coding Practices
Error
- Location
scripts/api_key_manager.py:118- Finding
Merchant credentials and access tokens are stored in plaintext without restrictive file permissions
- Content
View full analysis
None: """Save all API keys to file.""" self._ensure_dir() with open(self.api_keys_file, "w", encoding="utf-8") as f: for key in keys: f.write(key.to_line() + "\n") ``` ```python # Save to current context self._ensure_dir() with open(self.current_context_file, "w", encoding="utf-8") as f: f.write(selected.to_line() + "\n") ``` ```python def save_token_to_file(self, token: str) -> None: token_dir = os.path.dirname(self.access_token_file) if token_dir and not os.path.exists(token_dir): os.makedirs(token_dir, exist_ok=True) with open(self.access_token_file, "w", encoding="utf-8") as f: f.write(token) ``` ### Technical Analysis The Skill stores long-lived merchant credentials in `.kuaishou-localife-token/api_keys.txt` and duplicates the currently selected credential, including `app_secret`, in `current_context.txt`. It also caches the bearer-equivalent access token in a plaintext `access_token.txt` file. The files and containing directories are created without explicit restrictive permissions. Their effective permissions therefore depend on the process umask and any pre-existing file mode. The implementation also does not verify file ownership or correct permissions on existing files. Encryption at rest is not used, and the credential directory is located relative to the current working directory. This increases the possibility that it will be included in backups, workspace snapshots, archives, or source-control commits. The storage supports the declared authentication workflow, but retaining multiple plaintext application secrets and dupli ...[truncated 1429 chars]- Remediation
View remediation