T09 · Insecure Skill Coding Practices
Warning
- Location
es_search.py:69- Finding
API Credentials Are Stored and Disclosed in Plaintext
- Content
View full analysis
bool: """ Store parameters in the configuration file. """ config_file = get_config_file_path() try: config_data = { 'app_key': app_key } if token: config_data['token'] = token with open(config_file, 'w', encoding='utf-8') as f: json.dump(config_data, f, ensure_ascii=False, indent=2) return True except Exception as e: print(f'Failed to save configuration: {str(e)}', file=sys.stderr) return False ``` ```python def show_config() -> str: """ Display the current configuration file contents. """ config_file = get_config_file_path() try: if os.path.exists(config_file): with open(config_file, 'r', encoding='utf-8') as f: config_data = json.load(f) return json.dumps(config_data, ensure_ascii=False, indent=2) else: return 'Configuration file does not exist' except Exception as e: return f'Failed to read configuration file: {str(e)}' ``` ```python parser.add_argument( '--save-config', nargs='+', metavar=('APP_KEY', 'TOKEN'), help='Save app_key and optional token to the configuration file' ) ``` ### Technical Analysis The Skill accepts credentials as command-line arguments and writes them directly to `config.json` without encryption or explicit restrictive file permissions. The resulting permissions depend on the process umask and may allow access by other local users or processes. Command-line credentials may also be exposed through shell history, process inspection, terminal recording, and automation logs. The `--show-config` operation returns the complete configuratio ...[truncated 1239 chars]- Remediation
View remediation