T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:39- Finding
API Key Exposure Through Command-Line Arguments and Insecure Plaintext Configuration
- Content
View full analysis
~/.qoder/apis/redfox.json` | ``` `scripts/fetch_astock_accounts.py:224`: ```python parser.add_argument("--api-key", help="API Key (不传则读取环境变量或配置文件)") ``` `scripts/fetch_subscribed_updates.py:202`: ```python parser.add_argument("--api-key", help="API Key（不传则读取环境变量或配置文件）") ``` The corresponding credential-loading logic accepts the exposed command-line value: ```python def get_api_key(cli_key=None): """Get API key: CLI arg > env var > config file.""" if cli_key: return cli_key env_key = os.environ.get(ENV_KEY) if env_key: return env_key if CONFIG_FILE.exists(): try: data = json.loads(CONFIG_FILE.read_text()) key = data.get("api_key") if key: return key except (json.JSONDecodeError, OSError): pass return None ``` ### Technical Analysis The Skill documents and implements an `--api-key` command-line option. Secrets passed as process arguments can be exposed through shell history, process inspection utilities, process-accounting systems, diagnostic tooling, terminal recordings, or automation logs. The documented configuration command also writes the API key to a plaintext file using ordinary shell redirection. It does not explicitly create the file with mode `0600`, verify ownership, or reject a file whose permissions allow access by other local users. The resulting permissions depend on the user's current `umask`. This behavior conflicts with the security guidance in `README.en.md`, which instructs users not to ex ...[truncated 1571 chars]- Remediation
View remediation
~/.qoder/apis/redfox.json chmod 600 ~/.qoder/apis/redfox.json ``` 5. Avoid placing the real key directly in documentation examples, prompts, CI logs, or terminal recordings. 6. Document key scope limitation, expiration, rotation, and immediate revocation procedures. 7. Add automated checks that warn or fail when the configuration file has unsafe ownership or permissions. ]]>