T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:42- Finding
API Key Persisted in a Plaintext File Without Permission Hardening
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function stores the supplied API key as plaintext in a working-directory-relative `.env` file. It does not explicitly set restrictive file permissions, validate that the destination is a regular file rather than a symbolic link, or ensure that the file is stored outside a source repository. For a newly created file, effective permissions depend on the process umask. For an existing file, `Path.write_text()` retains the existing file's permission model. Consequently, the key may be readable by other local users or processes when the surrounding environment or existing permissions are permissive. The use of a relative path also means the destination changes with the process working directory. This can unintentionally place the credential inside a repository, shared directory, backup scope, or other location not intended for secret storage. ### Attack Path 1. A user supplies an API key as required by the Skill workflow. 2. The Skill calls `set_api_key()`, whi ...[truncated 1102 chars]- Remediation
View remediation