T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/resolve_key.py:29- Finding
Overbroad Loading of Unrelated Secrets from Environment Files
- Content
View full analysis
dict: env = {} env.update(load_env_file(Path.home() / ".env")) env.update(load_env_file(Path(".env"))) env.update(os.environ) return env def get_key(env: dict) -> str: key = env.get("OPENROUTER_API_KEY", "").strip() ``` ```typescript // references/typescript_template.md:57-67 function resolveEnv(): Record { // 1. Project .env 2. ~/.env 3. process.env (already exported) const projectEnv = loadEnvFile(path.join(process.cwd(), ".env")); const globalEnv = loadEnvFile(path.join(os.homedir(), ".env")); // Later entries win — process.env takes precedence return { ...globalEnv, ...projectEnv, ...process.env as Record }; } const ENV = resolveEnv(); function getApiKey(): string { const key = ENV["OPENROUTER_API_KEY"]?.trim(); ``` ### Technical Analysis The Skill requires only a limited set of OpenRouter-related values, principally `OPENROUTER_API_KEY`, `OPENROUTER_PREFERRED_MODELS`, `OPENROUTER_TIER_A`, and `OPENROUTER_TIER_B`. Instead, the implementations parse every entry in the project `.env`, the global `~/.env`, and the complete process environment into Skill-controlled dictionaries. Global `.env` files commonly contain unrelated da ...[truncated 1370 chars]- Remediation
View remediation
dict[str, str]: values = load_env_file(path) return {key: values[key] for key in ALLOWED_KEYS if key in values} ``` - Avoid retaining the API key longer than necessary and never include it in logs, exceptions, or diagnostic state. ]]>