T09 · Insecure Skill Coding Practices
- Location
scripts/config.py:43- Finding
API Key Persisted in a Plaintext File Without Access-Control Hardening
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py, lines 43-63
Vulnerability Type: Plaintext storage of sensitive credentials
Risk Level: MediumVulnerable Code
python def save_api_key_to_env(api_key: str) -> bool: """Store the API key in the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return FalseTechnical Analysis
The application persists the user-provided API key as plaintext in a working-directory-relative
.envfile. The implementation does not set or verify restrictive file permissions, reject symbolic links, use an atomic secure-file creation operation, or ensure that the destination is a private, Skill-specific configuration directory.Path.write_text()relies on the process umask when creating a file and preserves the existing permissions when replacing its contents. Consequently, an existing.envfile with permissive permissions can remain readable by unintended local users or processes. Because the path is relative to the current working directory, the secret may also be written into an unexpected directory, including a source repository that could later be archived or committed.Attack Path
- The Skill asks the user for an API key as required by `SKIL ...[truncated 1379 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer session-only credential handling or an operating-system credential store instead of persisting the key in plaintext.
- If file-based storage is necessary, use a fixed, Skill-specific configuration directory rather than the current working directory.
- Create the directory with permissions limited to the current user.
- Create the credential file atomically with mode
0600, and verify the resulting ownership and permissions. - Refuse to read from or write through symbolic links. Where supported, use secure open flags such as
O_NOFOLLOW,O_CREAT, andO_EXCL. - Write updates to a securely created temporary file in the same private directory and atomically replace the destination.
- Add
.envto version-control ignore rules and exclude it from logs, diagnostic bundles, build artifacts, and backups where appropriate. - Document credential rotation and revocation procedures for users whose
.envfile may have been exposed.