T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Persisted in Plaintext Without Restrictive File Permissions
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function stores the user-provided API key directly in a plaintext `.env` file. `Path.write_text()` does not explicitly enforce owner-only permissions; newly created permissions depend on the process umask, while an existing file retains its current permissions. The implementation also does not verify whether `.env` is a symbolic link before overwriting it. Consequently, the credential may be exposed to other local users or processes that can read the project directory. The file may also be copied into backups or accidentally committed if repository exclusion controls are absent. If an attacker can manipulate the working directory and create a `.env` symlink, the write may be redirected to another file writable by the Skill process. ### Attack Path 1. A user supplies a valid Xiaobenyang API key as required by the Skill. 2. `set_api_key()` passes the credential to `save_api_key_to_env()`. 3. The function writes `XBY_APIKEY= ...[truncated 1051 chars]- Remediation
View remediation