T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config_store.py:82- Finding
Plaintext API Secret Storage and Command-Line Credential Exposure
- Content
View full analysis
Dict[str, str]: plain = str(client_secret or "").strip() if not plain: return {"client_secret": "", "client_secret_enc": "", "client_secret_storage": "plain"} if _is_windows_platform(): encrypted = _dpapi_encrypt_text(plain) if encrypted: return {"client_secret": "", "client_secret_enc": encrypted, "client_secret_storage": "dpapi"} return {"client_secret": plain, "client_secret_enc": "", "client_secret_storage": "plain"} ``` ```python def _write_text_atomic(path: str, text: str) -> None: directory = os.path.dirname(os.path.abspath(path)) or "." os.makedirs(directory, exist_ok=True) fd, tmp_path = tempfile.mkstemp(prefix=".config_", suffix=".tmp", dir=directory) try: with os.fdopen(fd, "w", encoding="utf-8", newline="\n") as f: f.write(text) if not text.endswith("\n"): f.write("\n") f.flush() os.fsync(f.fileno()) os.replace(tmp_path, path) finally: if os.path.exists(tmp_path): os.remove(tmp_path) ``` ```python def set_credentials(client_id: str, client_secret: str, timeout: int = 15) -> Dict[str, Any]: config = load_config() encoded = encode_client_secret_for_storage(client_secret) config["naver_api"].update( { "client_id": str(client_id or "").strip(), "client_secret": encoded["client_secret"], "client_secret_enc": encoded["client_secret_enc"], "client_secret_storage": encoded["client_secret_storage"], "timeout": max(5, min(60, int(timeout))), } ) save_config(co ...[truncated 2228 chars]- Remediation
View remediation