T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/xcrawl_scraper.py:49- Finding
XCrawl API Key Is Stored in Plaintext and Exposed Through Process Arguments and Console Output
- Content
View full analysis
20 else (api_key if api_key else '(not set)') print(f" API Key: {api_key_display}") ``` ```python elif command == 'set-key': if len(sys.argv) < 3: print("用法: python xcrawl_scraper.py set-key ") return set_api_key(sys.argv[2]) ``` ### Technical Analysis The API key is accepted as a command-line argument and then written directly to `scripts/config.json` as plaintext. The `save_config` function does not apply restrictive file permissions, so access depends on the process umask and existing filesystem permissions. Passing a secret through `sys.argv` can expose it through shell history, process inspection utilities, process-accounting systems, diagnostic tooling, or command logging. The `config` command creates another disclosure channel: keys longer than 20 characters reveal their first 20 characters, while keys of 20 characters or fewer are printed in full. Although exploitation normally requires local filesystem, process, t ...[truncated 1492 chars]- Remediation
View remediation