T09 · Insecure Skill Coding Practices
Warning
- Location
snooker.py:118- Finding
Plaintext API Key Storage and Command-Line Secret Exposure
- Content
View full analysis
None: SNOOKER_DIR.mkdir(parents=True, exist_ok=True) api_key = "" i = 0 while i < len(args): if args[i] == "--api-key" and i + 1 < len(args): api_key = args[i + 1]; i += 2 else: i += 1 if not api_key: api_key = input("X-Requested-By API key: ").strip() CONFIG_FILE.write_text(json.dumps({"apiKey": api_key}, indent=2)) ``` ### Technical Analysis The setup command permits the Snooker API key to be supplied through the `--api-key` command-line argument. Secrets passed this way may be recorded in shell history and can be visible to local process-inspection mechanisms while the command is running. The key is subsequently written in plaintext to `~/.nanobot/workspace/snooker/config.json`. The code does not explicitly set restrictive permissions on either the configuration directory or file. Effective permissions therefore depend on the user's environment and `umask`. In an environment with permissive defaults, another local account or process may be able to read the credential. The interactive fallback uses `input()`, which echoes the API key to the terminal while it is entered. This creates an additional opportunity for visual disclosure or terminal-session logging. The separate behavior of transmitting the key in the `X-Requested-By` header to the fixed HTTPS endpoint `https://api.snooker.org/` is consistent with the documented authentication requirement and does not, by itself, indicate unauthorized exfiltration. ### Attack Path 1. A user invokes the setup command using `snooker.py setup --api-key SECRET`. 2. The secret is retained in shell history or observed through process inspection while the command is running. 3. The script writes ...[truncated 1124 chars]- Remediation
View remediation