T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:55- Finding
API keys are entered visibly and persisted as plaintext shell configuration
- Content
View full analysis
> "$SHELL_RC" echo "# Finance Daily Report — DashScope API Key" >> "$SHELL_RC" echo "export DASHSCOPE_API_KEY=\"$INPUT_DASHSCOPE\"" >> "$SHELL_RC" echo -e "${GREEN}✓ 已写入 $SHELL_RC${NC}" fi fi fi ``` ```bash read -rp " 可选：输入豆包 API Key 作为备用模型（留空跳过）: " INPUT_DOUBAO if [ -n "$INPUT_DOUBAO" ]; then export DOUBAO_API_KEY="$INPUT_DOUBAO" if [ -n "$SHELL_RC" ] && ! grep -q "DOUBAO_API_KEY" "$SHELL_RC"; then echo "export DOUBAO_API_KEY=\"$INPUT_DOUBAO\"" >> "$SHELL_RC" echo -e "${GREEN}✓ DOUBAO_API_KEY 已写入 $SHELL_RC${NC}" fi fi ``` ### Technical Analysis The setup script uses `read -rp`, which does not suppress terminal echo. API keys are therefore displayed while the user types them and may be exposed to screen recording, terminal sharing, shoulder surfing, or terminal logging. The keys are subsequently written verbatim into `.bashrc` or `.zshrc`. These files are ordinary plaintext files and may be exposed through backups, diagnostic bundles, accidental repository commits, overly permissive home-directory permissions, or unrelated processes running under the same account. The script does not verify or harden the shell configuration file's permissions. It also writes user-controlled data into shell syntax without validating the expected API-key character set. A value containing shell substitution syntax such as `$(...)` would be stored literally and evaluated the next time the shell configurat ...[truncated 2010 chars]- Remediation
View remediation