T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/piaoin_invoice.py:39- Finding
API Key Stored in Plaintext Without Restrictive File Permissions
- Content
View full analysis
Path: path = env_path or (root / ENV_FILE) order = ["API_KEY", "BASE_URL", "USER_ROLE", "LAST_SYNC_DATE", "RUNTIME_MODE", "LAST_RUNTIME"] lines = [] for key in order: if key in data and data[key] != "": lines.append(f"{key}={data[key]}") for key in sorted(k for k in data if k not in order): lines.append(f"{key}={data[key]}") path.write_text("\n".join(lines) + "\n", encoding="utf-8") return path ``` ### Technical Analysis The `save_env()` function serializes the `API_KEY` into `.piaoin_evn` as plaintext. The file is created through `Path.write_text()` without explicitly setting owner-only permissions, validating ownership, or repairing unsafe permissions on an existing file. Consequently, the effective protection depends on the operating system, workspace configuration, and process umask. In a shared environment or workspace with permissive permissions, another local account or process may be able to read the credential. The state file could also be inadvertently committed to source control, copied into an artifact, or included in a backup. This behavior exceeds the minimum privilege necessary because persistent plaintext storage is not essential to making authenticated API requests. The credential could instead be supplied through an environment variable or protected credential store. ### Attack Path 1. A user runs the configuration command with a valid PAT, such as `config --api-key py_xxx`. 2. The application writes the complete PAT into `.piaoin_evn`. 3. The resulting file has permissions determined by the surrounding environment rather than explicit owner-only controls. 4. Another local user, p ...[truncated 875 chars]- Remediation
View remediation