{"data":{"skill":{"slug":"consiliency-spawn","name":"spawn","icon":"📦","repo":"https://github.com/Consiliency/treesitter-chunker/tree/main/.ai-dev-kit/skills/spawn","status":"approved","author":"Consiliency","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"2bca1540-fb51-475a-9d40-298ca4dc94ca","skill_id":"7b5c6c58-4519-4e98-8e03-7438f6ac9175","version":12,"content_hash":"v3:18789a6c1a8a9ebc818b76ac8686bbd38eb802a8:6e33576dcdea5824d6a486f854a089549fe3520627d0bae4d0f41a48220d4175:a92bcb1c88fe565c8883adb9bf6c07b1bc13ca512914608e5abd34f6470511fd:736b696c6c732f636f6e73696c69656e63792f737061776e:832fac0330b781f0197473c63359bca3","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The 86 findings include real shell quoting and temporary-file risks, alongside false positives from documentation, platform detection, and dictionary operations. Provider instructions also recommend disabling approval safeguards and, for Codex, the sandbox. No evidence found of credential theft, concealed malware, or instructions to manipulate this audit.","remediation":[{"issue":"Provider cookbooks recommend bypassing approvals and sandbox protections.","severity":"high","suggestion":"Keep approvals and workspace confinement enabled by default. Require explicit user consent before enabling unrestricted execution."},{"issue":"The macOS launcher inserts cwd and commands into shell and AppleScript text without correct escaping.","severity":"high","suggestion":"Quote cwd for the shell and escape AppleScript strings separately. Reject malformed inputs and test quotes, spaces, and shell metacharacters."},{"issue":"Windows uses POSIX quoting for PowerShell, and the WSL fallback interpolates command text across multiple shell parsers.","severity":"high","suggestion":"Use platform-specific argument handling and avoid nested shell interpolation. Test directory names and prompts containing quotes and metacharacters."},{"issue":"Background execution accepts arbitrary shell strings without a restricted execution boundary.","severity":"high","suggestion":"Offer an argument-list execution mode without shell=True. Require confirmation for shell mode and treat prompts and filenames as data."},{"issue":"Output, completion markers, and executable scripts use shared temporary paths without secure creation or private permissions.","severity":"medium","suggestion":"Create a private temporary directory with exclusive file creation. Use permissions 0600 for logs and 0700 for scripts, then remove artifacts."}],"risk_factor_evidence":[{"factor":"env_access","evidence":[{"file":"agent/cookbook/cursor-cli.md","line_end":128,"line_start":128},{"file":"agent/cookbook/cursor-cli.md","line_end":148,"line_start":148},{"file":"agent/fork_terminal.py","line_end":96,"line_start":96}]},{"factor":"external_commands","evidence":[{"file":"agent/fork_terminal.py","line_end":58,"line_start":58},{"file":"agent/fork_terminal.py","line_end":176,"line_start":176},{"file":"agent/fork_terminal.py","line_end":93,"line_start":93},{"file":"agent/fork_terminal.py","line_end":161,"line_start":161},{"file":"agent/fork_terminal.py","line_end":196,"line_start":196},{"file":"agent/fork_terminal.py","line_end":216,"line_start":216},{"file":"agent/fork_terminal.py","line_end":222,"line_start":222},{"file":"agent/fork_terminal.py","line_end":227,"line_start":227},{"file":"agent/fork_terminal.py","line_end":281,"line_start":281},{"file":"agent/fork_terminal.py","line_end":76,"line_start":76},{"file":"agent/fork_terminal.py","line_end":90,"line_start":90},{"file":"agent/fork_terminal.py","line_end":173,"line_start":173},{"file":"agent/fork_terminal.py","line_end":176,"line_start":176},{"file":"agent/fork_terminal.py","line_end":140,"line_start":140},{"file":"agent/fork_terminal.py","line_end":146,"line_start":146},{"file":"agent/fork_terminal.py","line_end":152,"line_start":152},{"file":"agent/SKILL.md","line_end":52,"line_start":52},{"file":"agent/SKILL.md","line_end":60,"line_start":60},{"file":"agent/SKILL.md","line_end":134,"line_start":134},{"file":"agent/SKILL.md","line_end":138,"line_start":138},{"file":"agent/SKILL.md","line_end":139,"line_start":139},{"file":"agent/SKILL.md","line_end":140,"line_start":140},{"file":"agent/SKILL.md","line_end":144,"line_start":144},{"file":"agent/SKILL.md","line_end":146,"line_start":146},{"file":"agent/SKILL.md","line_end":147,"line_start":147},{"file":"agent/SKILL.md","line_end":148,"line_start":148},{"file":"agent/SKILL.md","line_end":149,"line_start":149},{"file":"agent/SKILL.md","line_end":150,"line_start":150},{"file":"agent/SKILL.md","line_end":154,"line_start":154},{"file":"agent/SKILL.md","line_end":163,"line_start":156},{"file":"agent/SKILL.md","line_end":167,"line_start":163},{"file":"agent/SKILL.md","line_end":169,"line_start":167},{"file":"agent/SKILL.md","line_end":172,"line_start":169},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":58,"line_start":49},{"file":"SKILL.md","line_end":62,"line_start":58},{"file":"SKILL.md","line_end":79,"line_start":62},{"file":"SKILL.md","line_end":89,"line_start":79},{"file":"SKILL.md","line_end":90,"line_start":89},{"file":"terminal/SKILL.md","line_end":8,"line_start":8},{"file":"terminal/SKILL.md","line_end":22,"line_start":22},{"file":"terminal/SKILL.md","line_end":23,"line_start":23},{"file":"terminal/SKILL.md","line_end":31,"line_start":31},{"file":"terminal/SKILL.md","line_end":33,"line_start":33},{"file":"terminal/SKILL.md","line_end":43,"line_start":43},{"file":"terminal/SKILL.md","line_end":59,"line_start":59},{"file":"terminal/SKILL.md","line_end":72,"line_start":61},{"file":"terminal/SKILL.md","line_end":76,"line_start":72}]},{"factor":"filesystem","evidence":[{"file":"agent/fork_terminal.py","line_end":107,"line_start":107},{"file":"agent/fork_terminal.py","line_end":108,"line_start":108},{"file":"agent/fork_terminal.py","line_end":41,"line_start":41},{"file":"agent/fork_terminal.py","line_end":42,"line_start":42},{"file":"agent/fork_terminal.py","line_end":43,"line_start":43},{"file":"agent/fork_terminal.py","line_end":134,"line_start":134},{"file":"agent/fork_terminal.py","line_end":135,"line_start":135},{"file":"agent/fork_terminal.py","line_end":136,"line_start":136},{"file":"agent/fork_terminal.py","line_end":137,"line_start":137},{"file":"agent/fork_terminal.py","line_end":183,"line_start":183},{"file":"agent/fork_terminal.py","line_end":184,"line_start":184},{"file":"agent/fork_terminal.py","line_end":185,"line_start":185},{"file":"agent/fork_terminal.py","line_end":210,"line_start":210},{"file":"agent/fork_terminal.py","line_end":211,"line_start":211},{"file":"agent/fork_terminal.py","line_end":212,"line_start":212},{"file":"agent/fork_terminal.py","line_end":157,"line_start":157},{"file":"agent/fork_terminal.py","line_end":159,"line_start":159},{"file":"agent/fork_terminal.py","line_end":126,"line_start":126},{"file":"agent/prompts/fork-summary-user-prompt.md","line_end":13,"line_start":13},{"file":"agent/SKILL.md","line_end":138,"line_start":138},{"file":"agent/SKILL.md","line_end":139,"line_start":139},{"file":"terminal/SKILL.md","line_end":41,"line_start":41},{"file":"terminal/SKILL.md","line_end":59,"line_start":59}]}],"critical_findings":[],"high_findings":[{"title":"Python subprocess.run","locations":[{"file":"agent/fork_terminal.py","line_end":58,"line_start":58}],"confidence":0.98,"description":"subprocess.run(","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The AppleScript contains unescaped shell_cmd text, including unquoted cwd. Quotes or metacharacters in directory names can change the executed script."},{"title":"Python subprocess.run","locations":[{"file":"agent/fork_terminal.py","line_end":176,"line_start":176}],"confidence":0.96,"description":"subprocess.run(f\"cmd.exe /c 'start cmd /k wsl -- {command}'\", shell=True)","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The fallback interpolates command into nested Unix and Windows shell text with shell=True. Embedded quotes can cross parser boundaries and execute unintended commands."},{"title":"Python subprocess.Popen","locations":[{"file":"agent/fork_terminal.py","line_end":93,"line_start":93}],"confidence":0.94,"description":"subprocess.Popen(wt_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The argument list launches PowerShell with generated script text. POSIX shlex.quote does not safely escape PowerShell cwd values, allowing directory text to become code."},{"title":"Python subprocess.Popen","locations":[{"file":"agent/fork_terminal.py","line_end":216,"line_start":216}],"confidence":0.68,"description":"subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"Caller-supplied command text is executed with shell=True and no restricted argument mode. Legitimate shell use is intended, but untrusted interpolated data can execute commands."},{"title":"Python subprocess.Popen","locations":[{"file":"agent/fork_terminal.py","line_end":222,"line_start":222}],"confidence":0.68,"description":"subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The debug path executes arbitrary command text with shell=True. The caller trust boundary is unspecified, so unsafe interpolation remains a risk."},{"title":"Python subprocess.Popen","locations":[{"file":"agent/fork_terminal.py","line_end":227,"line_start":227}],"confidence":0.68,"description":"subprocess.Popen(command, shell=True, cwd=cwd)","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The fallback passes caller-supplied command directly to shell=True without validation. Requested shell execution is legitimate, but untrusted command construction is not protected."},{"title":"PowerShell invocation","locations":[{"file":"agent/fork_terminal.py","line_end":90,"line_start":90}],"confidence":0.94,"description":"\"wt.exe\", \"-w\", \"new\", \"powershell.exe\",","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"PowerShell receives generated script text using POSIX quoting for cwd. That mismatch can interpret directory-name characters as PowerShell syntax."},{"title":"Windows cmd.exe","locations":[{"file":"agent/fork_terminal.py","line_end":176,"line_start":176}],"confidence":0.96,"description":"subprocess.run(f\"cmd.exe /c 'start cmd /k wsl -- {command}'\", shell=True)","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"Command text is embedded in a cmd.exe command passed through another shell. Missing parser-specific escaping permits unintended interpretation of embedded quotes and metacharacters."},{"title":"Approval and sandbox safeguards disabled by default","locations":[{"file":"agent/cookbook/codex-cli.md","line_end":46,"line_start":44},{"file":"agent/cookbook/codex-cli.md","line_end":83,"line_start":69},{"file":"agent/cookbook/cursor-cli.md","line_end":43,"line_start":40}],"confidence":0.99,"description":"The Codex cookbook says: \"Always run with `--dangerously-bypass-approvals-and-sandbox` for full auto mode\". Cursor similarly recommends force-allowing commands, increasing exposure to destructive actions and injected repository instructions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"These are explicit operational instructions to remove approval controls, not merely flag descriptions. Codex examples also disable sandboxing."}],"medium_findings":[{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":41,"line_start":41}],"confidence":0.95,"description":"agent_output_file = f\"/tmp/fork-agent-{output_id}.json\" if log_agent_output else None","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"Agent output is written by tee into shared /tmp without private permissions or exclusive creation. Sensitive responses may be readable under common umasks."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":42,"line_start":42}],"confidence":0.95,"description":"debug_output_file = f\"/tmp/fork-debug-{output_id}.txt\" if log_to_file else None","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"Debug logs collect terminal output in shared /tmp without permission hardening. Logs may expose sensitive output to other local users."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":43,"line_start":43}],"confidence":0.88,"description":"done_file = f\"/tmp/fork-output-{output_id}.done\"","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The completion marker is not securely created or checked for ownership. Another local user who discovers the filename can spoof completion."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":134,"line_start":134}],"confidence":0.95,"description":"agent_output_file = f\"/tmp/fork-agent-{output_id}.json\" if log_agent_output else None","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The WSL script writes agent output into shared /tmp through tee. No private directory, restrictive permissions, or exclusive creation protects the response."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":135,"line_start":135}],"confidence":0.95,"description":"debug_output_file = f\"/tmp/fork-debug-{output_id}.txt\" if log_to_file else None","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The WSL debug log stores full terminal output in shared /tmp. Its creation does not enforce privacy or resist existing symlinks."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":136,"line_start":136}],"confidence":0.88,"description":"done_file = f\"/tmp/fork-output-{output_id}.done\"","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The WSL completion marker uses a shared temporary path without exclusive creation or ownership verification. A local attacker can spoof its existence."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":137,"line_start":137}],"confidence":0.96,"description":"script_file = f\"/tmp/fork-script-{output_id}.sh\"","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"A shell script containing caller commands is placed directly in shared /tmp. Later nonexclusive creation and permissions 0755 expose its contents and permit symlink attacks."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":183,"line_start":183}],"confidence":0.95,"description":"agent_output_file = f\"/tmp/fork-agent-{output_id}.json\" if log_agent_output else None","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The tmux branch saves agent output in shared /tmp using tee. It does not ensure private permissions or exclusive file creation."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":184,"line_start":184}],"confidence":0.95,"description":"debug_output_file = f\"/tmp/fork-debug-{output_id}.txt\" if log_to_file else None","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The tmux debug path stores terminal output in a shared temporary file. Sensitive output can remain readable under common umasks."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":185,"line_start":185}],"confidence":0.88,"description":"done_file = f\"/tmp/fork-output-{output_id}.done\"","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The tmux completion marker has no secure creation or ownership checks. Its existence can be spoofed by another local user."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":210,"line_start":210}],"confidence":0.95,"description":"agent_output_file = f\"/tmp/fork-agent-{output_id}.json\" if log_agent_output else None","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"Background execution writes responses into shared /tmp without permission hardening. Sensitive agent output can be exposed to other local users."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":211,"line_start":211}],"confidence":0.95,"description":"debug_output_file = f\"/tmp/fork-debug-{output_id}.txt\" if log_to_file else None","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The background debug file collects stdout and stderr without private permissions or exclusive creation. This creates disclosure and symlink risks."},{"title":"Temp directory access","locations":[{"file":"agent/fork_terminal.py","line_end":212,"line_start":212}],"confidence":0.88,"description":"done_file = f\"/tmp/fork-output-{output_id}.done\"","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The background completion marker is placed in shared /tmp and checked only for existence. Local users can forge completion after discovering its path."},{"title":"Python file write/append","locations":[{"file":"agent/fork_terminal.py","line_end":157,"line_start":157}],"confidence":0.98,"description":"with open(script_file, 'w') as f:","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"open(script_file, 'w') follows existing symlinks and truncates their targets. The script is created in shared /tmp without exclusive or no-follow flags."},{"title":"Python os file operations","locations":[{"file":"agent/fork_terminal.py","line_end":159,"line_start":159}],"confidence":0.98,"description":"os.chmod(script_file, 0o755)","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"chmod sets command-bearing scripts to 0755, exposing prompts to other local users. It also follows a substituted symlink when changing target permissions."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":12,"total_lines":1587,"audit_model":"codex","audited_at":"2026-10-13T14:45:11.02+00:00","created_at":"2026-10-13T18:55:10.923032+00:00","static_findings":[{"id":"blocker:agent/cookbook/codex-cli.md:29:system-reconnaissance","file":"agent/cookbook/codex-cli.md","pattern":"System reconnaissance","snippet":"if you have a paid OpenAI API account.","category":"blocker","line_end":29,"severity":"low","line_start":29},{"id":"env_access:agent/cookbook/cursor-cli.md:128:generic-api-secret-keys","file":"agent/cookbook/cursor-cli.md","pattern":"Generic API/secret keys","snippet":"| `-a, --api-key <KEY>` | API key (or use CURSOR_API_KEY env var) |","category":"env_access","line_end":128,"severity":"high","line_start":128},{"id":"env_access:agent/cookbook/cursor-cli.md:148:generic-api-secret-keys","file":"agent/cookbook/cursor-cli.md","pattern":"Generic API/secret keys","snippet":"| `CURSOR_API_KEY` | API key for authentication |","category":"env_access","line_end":148,"severity":"high","line_start":148},{"id":"blocker:agent/cookbook/opencode-cli.md:103:system-reconnaissance","file":"agent/cookbook/opencode-cli.md","pattern":"System reconnaissance","snippet":"| `--hostname <HOST>` | Hostname for server mode (default: 127.0.0.1) |","category":"blocker","line_end":103,"severity":"low","line_start":103},{"id":"external_commands:agent/fork_terminal.py:58:python-subprocess-run","file":"agent/fork_terminal.py","pattern":"Python subprocess.run","snippet":"subprocess.run(","category":"external_commands","line_end":58,"severity":"high","line_start":58},{"id":"external_commands:agent/fork_terminal.py:176:python-subprocess-run","file":"agent/fork_terminal.py","pattern":"Python subprocess.run","snippet":"subprocess.run(f\"cmd.exe /c 'start cmd /k wsl -- {command}'\", shell=True)","category":"external_commands","line_end":176,"severity":"high","line_start":176},{"id":"external_commands:agent/fork_terminal.py:93:python-subprocess-popen","file":"agent/fork_terminal.py","pattern":"Python subprocess.Popen","snippet":"subprocess.Popen(wt_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)","category":"external_commands","line_end":93,"severity":"high","line_start":93},{"id":"external_commands:agent/fork_terminal.py:161:python-subprocess-popen","file":"agent/fork_terminal.py","pattern":"Python subprocess.Popen","snippet":"subprocess.Popen(wt_cmd)","category":"external_commands","line_end":161,"severity":"high","line_start":161},{"id":"external_commands:agent/fork_terminal.py:196:python-subprocess-popen","file":"agent/fork_terminal.py","pattern":"Python subprocess.Popen","snippet":"subprocess.Popen(tmux_cmd)","category":"external_commands","line_end":196,"severity":"high","line_start":196},{"id":"external_commands:agent/fork_terminal.py:216:python-subprocess-popen","file":"agent/fork_terminal.py","pattern":"Python subprocess.Popen","snippet":"subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)","category":"external_commands","line_end":216,"severity":"high","line_start":216},{"id":"external_commands:agent/fork_terminal.py:222:python-subprocess-popen","file":"agent/fork_terminal.py","pattern":"Python subprocess.Popen","snippet":"subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)","category":"external_commands","line_end":222,"severity":"high","line_start":222},{"id":"external_commands:agent/fork_terminal.py:227:python-subprocess-popen","file":"agent/fork_terminal.py","pattern":"Python subprocess.Popen","snippet":"subprocess.Popen(command, shell=True, cwd=cwd)","category":"external_commands","line_end":227,"severity":"high","line_start":227},{"id":"external_commands:agent/fork_terminal.py:281:ruby-shell-backtick-execution","file":"agent/fork_terminal.py","pattern":"Ruby/shell backtick execution","snippet":"\"gemini\": [\"please authenticate\", \"run `gemini auth`\", \"not logged in\"],","category":"external_commands","line_end":281,"severity":"medium","line_start":281},{"id":"external_commands:agent/fork_terminal.py:76:powershell-invocation","file":"agent/fork_terminal.py","pattern":"PowerShell invocation","snippet":"# powershell by default, but we can run bash if WSL specific","category":"external_commands","line_end":76,"severity":"high","line_start":76},{"id":"external_commands:agent/fork_terminal.py:90:powershell-invocation","file":"agent/fork_terminal.py","pattern":"PowerShell invocation","snippet":"\"wt.exe\", \"-w\", \"new\", \"powershell.exe\",","category":"external_commands","line_end":90,"severity":"high","line_start":90},{"id":"external_commands:agent/fork_terminal.py:173:windows-cmd-exe","file":"agent/fork_terminal.py","pattern":"Windows cmd.exe","snippet":"# Fallback: use cmd.exe to start a new window with WSL","category":"external_commands","line_end":173,"severity":"high","line_start":173},{"id":"external_commands:agent/fork_terminal.py:176:windows-cmd-exe","file":"agent/fork_terminal.py","pattern":"Windows cmd.exe","snippet":"subprocess.run(f\"cmd.exe /c 'start cmd /k wsl -- {command}'\", shell=True)","category":"external_commands","line_end":176,"severity":"high","line_start":176},{"id":"external_commands:agent/fork_terminal.py:140:unix-shell-invocation","file":"agent/fork_terminal.py","pattern":"Unix shell invocation","snippet":"script_content = f'''#!/bin/bash -li","category":"external_commands","line_end":140,"severity":"medium","line_start":140},{"id":"external_commands:agent/fork_terminal.py:146:unix-shell-invocation","file":"agent/fork_terminal.py","pattern":"Unix shell invocation","snippet":"script_content = f'''#!/bin/bash -li","category":"external_commands","line_end":146,"severity":"medium","line_start":146},{"id":"external_commands:agent/fork_terminal.py:152:unix-shell-invocation","file":"agent/fork_terminal.py","pattern":"Unix shell invocation","snippet":"script_content = f'''#!/bin/bash -li","category":"external_commands","line_end":152,"severity":"medium","line_start":152},{"id":"filesystem:agent/fork_terminal.py:107:linux-proc-filesystem-access","file":"agent/fork_terminal.py","pattern":"Linux /proc filesystem access","snippet":"# WSL populates /proc/version with \"Microsoft\"","category":"filesystem","line_end":107,"severity":"high","line_start":107},{"id":"filesystem:agent/fork_terminal.py:108:linux-proc-filesystem-access","file":"agent/fork_terminal.py","pattern":"Linux /proc filesystem access","snippet":"with open(\"/proc/version\", \"r\") as f:","category":"filesystem","line_end":108,"severity":"high","line_start":108},{"id":"filesystem:agent/fork_terminal.py:41:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"agent_output_file = f\"/tmp/fork-agent-{output_id}.json\" if log_agent_output else None","category":"filesystem","line_end":41,"severity":"medium","line_start":41},{"id":"filesystem:agent/fork_terminal.py:42:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"debug_output_file = f\"/tmp/fork-debug-{output_id}.txt\" if log_to_file else None","category":"filesystem","line_end":42,"severity":"medium","line_start":42},{"id":"filesystem:agent/fork_terminal.py:43:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"done_file = f\"/tmp/fork-output-{output_id}.done\"","category":"filesystem","line_end":43,"severity":"medium","line_start":43},{"id":"filesystem:agent/fork_terminal.py:134:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"agent_output_file = f\"/tmp/fork-agent-{output_id}.json\" if log_agent_output else None","category":"filesystem","line_end":134,"severity":"medium","line_start":134},{"id":"filesystem:agent/fork_terminal.py:135:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"debug_output_file = f\"/tmp/fork-debug-{output_id}.txt\" if log_to_file else None","category":"filesystem","line_end":135,"severity":"medium","line_start":135},{"id":"filesystem:agent/fork_terminal.py:136:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"done_file = f\"/tmp/fork-output-{output_id}.done\"","category":"filesystem","line_end":136,"severity":"medium","line_start":136},{"id":"filesystem:agent/fork_terminal.py:137:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"script_file = f\"/tmp/fork-script-{output_id}.sh\"","category":"filesystem","line_end":137,"severity":"medium","line_start":137},{"id":"filesystem:agent/fork_terminal.py:183:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"agent_output_file = f\"/tmp/fork-agent-{output_id}.json\" if log_agent_output else None","category":"filesystem","line_end":183,"severity":"medium","line_start":183},{"id":"filesystem:agent/fork_terminal.py:184:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"debug_output_file = f\"/tmp/fork-debug-{output_id}.txt\" if log_to_file else None","category":"filesystem","line_end":184,"severity":"medium","line_start":184},{"id":"filesystem:agent/fork_terminal.py:185:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"done_file = f\"/tmp/fork-output-{output_id}.done\"","category":"filesystem","line_end":185,"severity":"medium","line_start":185},{"id":"filesystem:agent/fork_terminal.py:210:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"agent_output_file = f\"/tmp/fork-agent-{output_id}.json\" if log_agent_output else None","category":"filesystem","line_end":210,"severity":"medium","line_start":210},{"id":"filesystem:agent/fork_terminal.py:211:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"debug_output_file = f\"/tmp/fork-debug-{output_id}.txt\" if log_to_file else None","category":"filesystem","line_end":211,"severity":"medium","line_start":211},{"id":"filesystem:agent/fork_terminal.py:212:temp-directory-access","file":"agent/fork_terminal.py","pattern":"Temp directory access","snippet":"done_file = f\"/tmp/fork-output-{output_id}.done\"","category":"filesystem","line_end":212,"severity":"medium","line_start":212},{"id":"filesystem:agent/fork_terminal.py:157:python-file-write-append","file":"agent/fork_terminal.py","pattern":"Python file write/append","snippet":"with open(script_file, 'w') as f:","category":"filesystem","line_end":157,"severity":"medium","line_start":157},{"id":"filesystem:agent/fork_terminal.py:159:python-os-file-operations","file":"agent/fork_terminal.py","pattern":"Python os file operations","snippet":"os.chmod(script_file, 0o755)","category":"filesystem","line_end":159,"severity":"medium","line_start":159},{"id":"filesystem:agent/fork_terminal.py:126:python-glob-pattern-matching","file":"agent/fork_terminal.py","pattern":"Python glob/pattern matching","snippet":"matches = glob.glob(pattern)","category":"filesystem","line_end":126,"severity":"low","line_start":126},{"id":"env_access:agent/fork_terminal.py:96:python-environment-access","file":"agent/fork_terminal.py","pattern":"Python environment access","snippet":"temp_dir = os.environ.get(\"TEMP\", \"C:\\\\Temp\")","category":"env_access","line_end":96,"severity":"low","line_start":96},{"id":"sensitive:agent/fork_terminal.py:254:certificate-key-files","file":"agent/fork_terminal.py","pattern":"Certificate/key files","snippet":"raise ValueError(f\"Unknown provider: {provider}. Valid: {list(login_commands.keys())}\")","category":"sensitive","line_end":254,"severity":"high","line_start":254},{"id":"sensitive:agent/fork_terminal.py:299:certificate-key-files","file":"agent/fork_terminal.py","pattern":"Certificate/key files","snippet":"providers_to_check = [provider] if provider else AUTH_FAILURE_PATTERNS.keys()","category":"sensitive","line_end":299,"severity":"high","line_start":299},{"id":"blocker:agent/fork_terminal.py:9:system-reconnaissance","file":"agent/fork_terminal.py","pattern":"System reconnaissance","snippet":"import uuid","category":"blocker","line_end":10,"severity":"low","line_start":9},{"id":"blocker:agent/fork_terminal.py:40:system-reconnaissance","file":"agent/fork_terminal.py","pattern":"System reconnaissance","snippet":"output_id = str(uuid.uuid4())[:8]","category":"blocker","line_end":40,"severity":"low","line_start":40},{"id":"blocker:agent/fork_terminal.py:77:system-reconnaissance","file":"agent/fork_terminal.py","pattern":"System reconnaissance","snippet":"output_id = str(uuid.uuid4())[:8]","category":"blocker","line_end":77,"severity":"low","line_start":77},{"id":"blocker:agent/fork_terminal.py:133:system-reconnaissance","file":"agent/fork_terminal.py","pattern":"System reconnaissance","snippet":"output_id = str(uuid.uuid4())[:8]","category":"blocker","line_end":133,"severity":"low","line_start":133},{"id":"blocker:agent/fork_terminal.py:182:system-reconnaissance","file":"agent/fork_terminal.py","pattern":"System reconnaissance","snippet":"output_id = str(uuid.uuid4())[:8]","category":"blocker","line_end":182,"severity":"low","line_start":182},{"id":"blocker:agent/fork_terminal.py:209:system-reconnaissance","file":"agent/fork_terminal.py","pattern":"System reconnaissance","snippet":"output_id = str(uuid.uuid4())[:8]","category":"blocker","line_end":209,"severity":"low","line_start":209},{"id":"filesystem:agent/prompts/fork-summary-user-prompt.md:13:temp-directory-access","file":"agent/prompts/fork-summary-user-prompt.md","pattern":"Temp directory access","snippet":"agent_response_summary: Implemented full refactor of fork_terminal.py - added log_agent_output param","category":"filesystem","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:agent/SKILL.md:52:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> most require command chaining (e.g., `&& claude --continue`) to stay in interactive","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:agent/SKILL.md:60:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Include the next users request in the `Next User Request` field.","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:agent/SKILL.md:134:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `fork_terminal()` function supports three output controls:","category":"external_commands","line_end":134,"severity":"medium","line_start":134},{"id":"external_commands:agent/SKILL.md:138:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `log_agent_output` | `True` | `/tmp/fork-agent-*.json` | Clean agent JSON response |","category":"external_commands","line_end":138,"severity":"medium","line_start":138},{"id":"external_commands:agent/SKILL.md:139:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `log_to_file` | `False` | `/tmp/fork-debug-*.txt` | Full terminal output (debug) |","category":"external_commands","line_end":139,"severity":"medium","line_start":139},{"id":"external_commands:agent/SKILL.md:140:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `capture` | `False` | N/A | Block and return content directly |","category":"external_commands","line_end":140,"severity":"medium","line_start":140},{"id":"external_commands:agent/SKILL.md:144:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `capture` | `log_agent_output` | `log_to_file` | Behavior |","category":"external_commands","line_end":144,"severity":"medium","line_start":144},{"id":"external_commands:agent/SKILL.md:146:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `False` | `True` (default) | `False` | Returns agent JSON file path |","category":"external_commands","line_end":146,"severity":"medium","line_start":146},{"id":"external_commands:agent/SKILL.md:147:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `False` | `False` | `True` | Returns debug file path |","category":"external_commands","line_end":147,"severity":"medium","line_start":147},{"id":"external_commands:agent/SKILL.md:148:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `False` | `False` | `False` | Returns empty string |","category":"external_commands","line_end":148,"severity":"medium","line_start":148},{"id":"external_commands:agent/SKILL.md:149:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `True` | `True` | * | Blocks, returns agent JSON content |","category":"external_commands","line_end":149,"severity":"medium","line_start":149},{"id":"external_commands:agent/SKILL.md:150:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `True` | `False` | `True` | Blocks, returns debug content |","category":"external_commands","line_end":150,"severity":"medium","line_start":150},{"id":"external_commands:agent/SKILL.md:154:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"When `log_agent_output=True` (default), clean agent output is logged. Use `read_fork_output(file_pat","category":"external_commands","line_end":154,"severity":"medium","line_start":154},{"id":"external_commands:agent/SKILL.md:156:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":163,"severity":"medium","line_start":156},{"id":"external_commands:agent/SKILL.md:163:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":167,"severity":"medium","line_start":163},{"id":"external_commands:agent/SKILL.md:167:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For debugging, enable `log_to_file=True` to capture full terminal output (including stderr):","category":"external_commands","line_end":169,"severity":"medium","line_start":167},{"id":"external_commands:agent/SKILL.md:169:ruby-shell-backtick-execution","file":"agent/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":172,"severity":"medium","line_start":169},{"id":"filesystem:agent/SKILL.md:138:temp-directory-access","file":"agent/SKILL.md","pattern":"Temp directory access","snippet":"| `log_agent_output` | `True` | `/tmp/fork-agent-*.json` | Clean agent JSON response |","category":"filesystem","line_end":138,"severity":"medium","line_start":138},{"id":"filesystem:agent/SKILL.md:139:temp-directory-access","file":"agent/SKILL.md","pattern":"Temp directory access","snippet":"| `log_to_file` | `False` | `/tmp/fork-debug-*.txt` | Full terminal output (debug) |","category":"filesystem","line_end":139,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Both use the `fork_terminal` utility to create isolated terminal sessions.","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Both skills use the `fork_terminal` Python utility:","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":58,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":62,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `.claude/ai-dev-kit/dev-tools/orchestration/providers/` - Shell scripts for each provider","category":"external_commands","line_end":90,"severity":"medium","line_start":89},{"id":"external_commands:terminal/SKILL.md:8:ruby-shell-backtick-execution","file":"terminal/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Spawn a new terminal window to execute CLI commands. This skill is for generic command execution, NO","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:terminal/SKILL.md:22:ruby-shell-backtick-execution","file":"terminal/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Run `<command> --help` first to verify syntax and options","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:terminal/SKILL.md:23:ruby-shell-backtick-execution","file":"terminal/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Execute the command in a new terminal using `fork_terminal()`","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:terminal/SKILL.md:31:ruby-shell-backtick-execution","file":"terminal/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Spawn an AI agent (use `spawn:agent` instead)","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:terminal/SKILL.md:33:ruby-shell-backtick-execution","file":"terminal/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**STOP** -> Run `<command> --help` first -> Review output -> Then proceed","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:terminal/SKILL.md:43:ruby-shell-backtick-execution","file":"terminal/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. [ ] **CHECKPOINT**: Ran `<command> --help` and reviewed options","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:terminal/SKILL.md:59:ruby-shell-backtick-execution","file":"terminal/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `fork_terminal()` function is located at `../agent/fork_terminal.py`:","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:terminal/SKILL.md:61:ruby-shell-backtick-execution","file":"terminal/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":72,"severity":"medium","line_start":61},{"id":"external_commands:terminal/SKILL.md:72:ruby-shell-backtick-execution","file":"terminal/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":76,"severity":"medium","line_start":72},{"id":"filesystem:terminal/SKILL.md:41:path-traversal-sequence","file":"terminal/SKILL.md","pattern":"Path traversal sequence","snippet":"3. [ ] READ: '../agent/fork_terminal.py' to understand the tooling","category":"filesystem","line_end":41,"severity":"high","line_start":41},{"id":"filesystem:terminal/SKILL.md:59:path-traversal-sequence","file":"terminal/SKILL.md","pattern":"Path traversal sequence","snippet":"The `fork_terminal()` function is located at `../agent/fork_terminal.py`:","category":"filesystem","line_end":59,"severity":"high","line_start":59},{"id":"obfuscation:agent/fork_terminal.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","file":"agent/fork_terminal.py","pattern":"[HEURISTIC] Multiple bracket chains (6) - JSFuck/obfuscation pattern","snippet":"())[, ())[, ())[","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"blocker:agent/cookbook/codex-cli.md:29:system-reconnaissance","reason":"This sentence explains account eligibility for model selection. It does not inspect the host or enumerate accounts.","verdict":"false_positive","confidence":0.99},{"id":"env_access:agent/cookbook/cursor-cli.md:128:generic-api-secret-keys","reason":"The flag table documents an authentication option with a placeholder. No actual secret or instruction to collect credentials appears here.","verdict":"false_positive","confidence":0.98},{"id":"env_access:agent/cookbook/cursor-cli.md:148:generic-api-secret-keys","reason":"This table names the normal Cursor authentication environment variable. It contains no credential value or executable access to that variable.","verdict":"false_positive","confidence":0.99},{"id":"blocker:agent/cookbook/opencode-cli.md:103:system-reconnaissance","reason":"The documentation describes a server binding flag with a loopback default. It performs no hostname discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:agent/fork_terminal.py:58:python-subprocess-run","reason":"The AppleScript contains unescaped shell_cmd text, including unquoted cwd. Quotes or metacharacters in directory names can change the executed script.","verdict":"confirmed","severity":"high","confidence":0.98},{"id":"external_commands:agent/fork_terminal.py:176:python-subprocess-run","reason":"The fallback interpolates command into nested Unix and Windows shell text with shell=True. Embedded quotes can cross parser boundaries and execute unintended commands.","verdict":"confirmed","severity":"high","confidence":0.96},{"id":"external_commands:agent/fork_terminal.py:93:python-subprocess-popen","reason":"The argument list launches PowerShell with generated script text. POSIX shlex.quote does not safely escape PowerShell cwd values, allowing directory text to become code.","verdict":"confirmed","severity":"high","confidence":0.94},{"id":"external_commands:agent/fork_terminal.py:161:python-subprocess-popen","reason":"This call passes a fixed argument list to Windows Terminal and WSL, without shell=True. Unsafe temporary-script creation is assessed under separate filesystem findings.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:agent/fork_terminal.py:196:python-subprocess-popen","reason":"The tmux invocation implements the requested terminal launch and passes cwd as a separate argument. Shell commands are intentional here, not concealed execution.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:agent/fork_terminal.py:216:python-subprocess-popen","reason":"Caller-supplied command text is executed with shell=True and no restricted argument mode. Legitimate shell use is intended, but untrusted interpolated data can execute commands.","verdict":"confirmed","confidence":0.68},{"id":"external_commands:agent/fork_terminal.py:222:python-subprocess-popen","reason":"The debug path executes arbitrary command text with shell=True. The caller trust boundary is unspecified, so unsafe interpolation remains a risk.","verdict":"confirmed","confidence":0.68},{"id":"external_commands:agent/fork_terminal.py:227:python-subprocess-popen","reason":"The fallback passes caller-supplied command directly to shell=True without validation. Requested shell execution is legitimate, but untrusted command construction is not protected.","verdict":"confirmed","confidence":0.68},{"id":"external_commands:agent/fork_terminal.py:281:ruby-shell-backtick-execution","reason":"The backticks occur inside a Python string used to recognize authentication errors. The string is compared with output, never executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/fork_terminal.py:76:powershell-invocation","reason":"This line is a comment describing the terminal backend. The actual PowerShell execution is adjudicated separately.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/fork_terminal.py:90:powershell-invocation","reason":"PowerShell receives generated script text using POSIX quoting for cwd. That mismatch can interpret directory-name characters as PowerShell syntax.","verdict":"confirmed","severity":"high","confidence":0.94},{"id":"external_commands:agent/fork_terminal.py:173:windows-cmd-exe","reason":"This is a comment naming the fallback backend, not an execution statement. The unsafe fallback call is assessed at line 176.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/fork_terminal.py:176:windows-cmd-exe","reason":"Command text is embedded in a cmd.exe command passed through another shell. Missing parser-specific escaping permits unintended interpretation of embedded quotes and metacharacters.","verdict":"confirmed","severity":"high","confidence":0.96},{"id":"external_commands:agent/fork_terminal.py:140:unix-shell-invocation","reason":"The Bash shebang enables the explicitly requested terminal command and login environment. It is not itself an injection mechanism; temporary-script handling is assessed separately.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:agent/fork_terminal.py:146:unix-shell-invocation","reason":"This Bash script template implements the documented debug-output mode. Shell invocation is expected for a terminal launcher and is not concealed.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:agent/fork_terminal.py:152:unix-shell-invocation","reason":"The script runs the caller-requested command and keeps a terminal open. The shebang alone provides no evidence of malicious execution.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:agent/fork_terminal.py:107:linux-proc-filesystem-access","reason":"This comment explains WSL detection through kernel version text. It does not access process memory or sensitive system data.","verdict":"false_positive","confidence":1},{"id":"filesystem:agent/fork_terminal.py:108:linux-proc-filesystem-access","reason":"Only /proc/version is read to select the WSL terminal backend. This public kernel information is not credential or process-memory collection.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:agent/fork_terminal.py:41:temp-directory-access","reason":"Agent output is written by tee into shared /tmp without private permissions or exclusive creation. Sensitive responses may be readable under common umasks.","verdict":"confirmed","confidence":0.95},{"id":"filesystem:agent/fork_terminal.py:42:temp-directory-access","reason":"Debug logs collect terminal output in shared /tmp without permission hardening. Logs may expose sensitive output to other local users.","verdict":"confirmed","confidence":0.95},{"id":"filesystem:agent/fork_terminal.py:43:temp-directory-access","reason":"The completion marker is not securely created or checked for ownership. Another local user who discovers the filename can spoof completion.","verdict":"confirmed","confidence":0.88},{"id":"filesystem:agent/fork_terminal.py:134:temp-directory-access","reason":"The WSL script writes agent output into shared /tmp through tee. No private directory, restrictive permissions, or exclusive creation protects the response.","verdict":"confirmed","confidence":0.95},{"id":"filesystem:agent/fork_terminal.py:135:temp-directory-access","reason":"The WSL debug log stores full terminal output in shared /tmp. Its creation does not enforce privacy or resist existing symlinks.","verdict":"confirmed","confidence":0.95},{"id":"filesystem:agent/fork_terminal.py:136:temp-directory-access","reason":"The WSL completion marker uses a shared temporary path without exclusive creation or ownership verification. A local attacker can spoof its existence.","verdict":"confirmed","confidence":0.88},{"id":"filesystem:agent/fork_terminal.py:137:temp-directory-access","reason":"A shell script containing caller commands is placed directly in shared /tmp. Later nonexclusive creation and permissions 0755 expose its contents and permit symlink attacks.","verdict":"confirmed","confidence":0.96},{"id":"filesystem:agent/fork_terminal.py:183:temp-directory-access","reason":"The tmux branch saves agent output in shared /tmp using tee. It does not ensure private permissions or exclusive file creation.","verdict":"confirmed","confidence":0.95},{"id":"filesystem:agent/fork_terminal.py:184:temp-directory-access","reason":"The tmux debug path stores terminal output in a shared temporary file. Sensitive output can remain readable under common umasks.","verdict":"confirmed","confidence":0.95},{"id":"filesystem:agent/fork_terminal.py:185:temp-directory-access","reason":"The tmux completion marker has no secure creation or ownership checks. Its existence can be spoofed by another local user.","verdict":"confirmed","confidence":0.88},{"id":"filesystem:agent/fork_terminal.py:210:temp-directory-access","reason":"Background execution writes responses into shared /tmp without permission hardening. Sensitive agent output can be exposed to other local users.","verdict":"confirmed","confidence":0.95},{"id":"filesystem:agent/fork_terminal.py:211:temp-directory-access","reason":"The background debug file collects stdout and stderr without private permissions or exclusive creation. This creates disclosure and symlink risks.","verdict":"confirmed","confidence":0.95},{"id":"filesystem:agent/fork_terminal.py:212:temp-directory-access","reason":"The background completion marker is placed in shared /tmp and checked only for existence. Local users can forge completion after discovering its path.","verdict":"confirmed","confidence":0.88},{"id":"filesystem:agent/fork_terminal.py:157:python-file-write-append","reason":"open(script_file, 'w') follows existing symlinks and truncates their targets. The script is created in shared /tmp without exclusive or no-follow flags.","verdict":"confirmed","confidence":0.98},{"id":"filesystem:agent/fork_terminal.py:159:python-os-file-operations","reason":"chmod sets command-bearing scripts to 0755, exposing prompts to other local users. It also follows a substituted symlink when changing target permissions.","verdict":"confirmed","confidence":0.98},{"id":"filesystem:agent/fork_terminal.py:126:python-glob-pattern-matching","reason":"Glob searches fixed Windows Terminal installation paths to locate the executable. No private file contents or credentials are read.","verdict":"false_positive","confidence":0.94},{"id":"env_access:agent/fork_terminal.py:96:python-environment-access","reason":"Only TEMP is read to translate an output-file path for Windows. No secret-bearing environment variables are collected.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:agent/fork_terminal.py:254:certificate-key-files","reason":"keys() enumerates provider names in a Python dictionary for an error message. It does not open certificate or private-key files.","verdict":"false_positive","confidence":1},{"id":"sensitive:agent/fork_terminal.py:299:certificate-key-files","reason":"AUTH_FAILURE_PATTERNS.keys() returns dictionary provider names. There is no cryptographic-key access.","verdict":"false_positive","confidence":1},{"id":"blocker:agent/fork_terminal.py:9:system-reconnaissance","reason":"Importing uuid supports random temporary-file identifiers. The module import does not perform system reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:agent/fork_terminal.py:40:system-reconnaissance","reason":"uuid4 generates random output identifiers rather than collecting hardware or host identity. Temporary-file weaknesses are assessed separately.","verdict":"false_positive","confidence":0.99},{"id":"blocker:agent/fork_terminal.py:77:system-reconnaissance","reason":"This uuid4 call creates a random Windows output identifier. It does not enumerate system information or use a hardware identifier.","verdict":"false_positive","confidence":0.99},{"id":"blocker:agent/fork_terminal.py:133:system-reconnaissance","reason":"The random UUID fragment distinguishes WSL output artifacts. It does not inspect the host.","verdict":"false_positive","confidence":0.99},{"id":"blocker:agent/fork_terminal.py:182:system-reconnaissance","reason":"The uuid4 call generates a random tmux output identifier. No system reconnaissance occurs.","verdict":"false_positive","confidence":0.99},{"id":"blocker:agent/fork_terminal.py:209:system-reconnaissance","reason":"A random identifier is generated for background output artifacts. No host fingerprint or account information is collected.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:agent/prompts/fork-summary-user-prompt.md:13:temp-directory-access","reason":"This example conversation describes output paths in prose. It does not create or read temporary files.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:agent/SKILL.md:52:ruby-shell-backtick-execution","reason":"Markdown backticks format an example command chain. They are not Ruby or shell substitution operators in this document.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:agent/SKILL.md:60:ruby-shell-backtick-execution","reason":"Backticks format a prompt-template field name. The field label is not executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:134:ruby-shell-backtick-execution","reason":"Backticks format the Python function name in documentation. No shell substitution is performed.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:138:ruby-shell-backtick-execution","reason":"Backticks format table cells containing a parameter, boolean, and path. These cells are documentation, not shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:139:ruby-shell-backtick-execution","reason":"This table row documents debug logging with inline Markdown formatting. It does not execute the displayed path or parameter.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:140:ruby-shell-backtick-execution","reason":"Inline backticks format the capture parameter and its default. No executable backtick expression exists.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:144:ruby-shell-backtick-execution","reason":"The backticks delimit parameter names in a Markdown table header. They do not invoke commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:146:ruby-shell-backtick-execution","reason":"This table row formats boolean values and describes returned output. It contains no shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:147:ruby-shell-backtick-execution","reason":"Backticks format boolean settings in a documentation table. They are not command-substitution syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:148:ruby-shell-backtick-execution","reason":"This row documents disabled output settings using inline Markdown. No executable code is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:149:ruby-shell-backtick-execution","reason":"Markdown formats boolean values for blocking capture. The formatting does not execute a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:150:ruby-shell-backtick-execution","reason":"This table row describes debug capture behavior. Its backticks only format boolean values.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:154:ruby-shell-backtick-execution","reason":"Inline Markdown formats a logging option and output-reader function name. There is no Ruby or shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:156:ruby-shell-backtick-execution","reason":"Triple backticks open a Python documentation example. The example calls the documented API, not backtick-based shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:agent/SKILL.md:163:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. They are not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:167:ruby-shell-backtick-execution","reason":"Inline backticks format a debug configuration option before a Python example. No command substitution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:agent/SKILL.md:169:ruby-shell-backtick-execution","reason":"The backticks introduce a fenced Python example of debug logging. They are Markdown delimiters, not execution operators.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:agent/SKILL.md:138:temp-directory-access","reason":"The table documents the output-file location without accessing it. Actual insecure temporary-file handling is confirmed in fork_terminal.py.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:agent/SKILL.md:139:temp-directory-access","reason":"This row describes debug log paths rather than performing filesystem access. The implementation's privacy weaknesses are adjudicated separately.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Backticks format the utility name in explanatory prose. No shell expression is executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"This prose reference formats a Python utility name. The backticks are ordinary Markdown.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"Triple backticks delimit an example of the terminal API. They are not Ruby or shell substitution syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The detected delimiter closes a Markdown code block. It performs no execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"This fenced block displays the skill directory tree. It is not a shell program.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The triple backticks close the directory-tree display. No command substitution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"Backticks format a related tooling directory in a reference list. The path is not executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:terminal/SKILL.md:8:ruby-shell-backtick-execution","reason":"Inline Markdown formats the agent child-skill name. It is a routing reference, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:terminal/SKILL.md:22:ruby-shell-backtick-execution","reason":"The backticks format a documented help-check step. They do not invoke Ruby or shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:terminal/SKILL.md:23:ruby-shell-backtick-execution","reason":"Inline Markdown names the terminal-launch function. The formatting itself executes nothing.","verdict":"false_positive","confidence":1},{"id":"external_commands:terminal/SKILL.md:31:ruby-shell-backtick-execution","reason":"Backticks identify the alternate child skill for AI agents. No shell command is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:terminal/SKILL.md:33:ruby-shell-backtick-execution","reason":"Markdown formats a help-check instruction. This is not executable backtick substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:terminal/SKILL.md:43:ruby-shell-backtick-execution","reason":"This checklist item formats the help command in Markdown. It does not execute a backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:terminal/SKILL.md:59:ruby-shell-backtick-execution","reason":"Inline backticks format a function name and sibling source path. Neither is command-substitution syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:terminal/SKILL.md:61:ruby-shell-backtick-execution","reason":"The triple backticks introduce Python usage examples. The detected delimiter is not a shell execution operator.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:terminal/SKILL.md:72:ruby-shell-backtick-execution","reason":"This line closes a fenced documentation example. It does not execute code.","verdict":"false_positive","confidence":1},{"id":"filesystem:terminal/SKILL.md:41:path-traversal-sequence","reason":"The fixed relative path points to the bundled sibling agent utility. It is not attacker-controlled traversal outside the skill directory.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:terminal/SKILL.md:59:path-traversal-sequence","reason":"This documentation locates the existing sibling Python utility. The parent-directory segment is normal package navigation, not unauthorized filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:agent/fork_terminal.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The file is readable Python, beginning with a shebang and ordinary imports. Its dictionary and list expressions are not JSFuck or encoded payloads.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Approval and sandbox safeguards disabled by default","severity":"high","locations":[{"file":"agent/cookbook/codex-cli.md","line_end":46,"line_start":44},{"file":"agent/cookbook/codex-cli.md","line_end":83,"line_start":69},{"file":"agent/cookbook/cursor-cli.md","line_end":43,"line_start":40}],"confidence":0.99,"description":"The Codex cookbook says: \"Always run with `--dangerously-bypass-approvals-and-sandbox` for full auto mode\". Cursor similarly recommends force-allowing commands, increasing exposure to destructive actions and injected repository instructions.","confidence_reasoning":"These are explicit operational instructions to remove approval controls, not merely flag descriptions. Codex examples also disable sandboxing."}],"subject_marketplace_commit_sha":"18789a6c1a8a9ebc818b76ac8686bbd38eb802a8","subject_content_hash":"6e33576dcdea5824d6a486f854a089549fe3520627d0bae4d0f41a48220d4175","subject_tree_hash":"a92bcb1c88fe565c8883adb9bf6c07b1bc13ca512914608e5abd34f6470511fd","subject_plugin_path":"skills/consiliency/spawn","audit_payload_hash":"832fac0330b781f0197473c63359bca3","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"18789a6c1a8a9ebc818b76ac8686bbd38eb802a8","contentHash":"6e33576dcdea5824d6a486f854a089549fe3520627d0bae4d0f41a48220d4175","treeHash":"a92bcb1c88fe565c8883adb9bf6c07b1bc13ca512914608e5abd34f6470511fd","pluginPath":"skills/consiliency/spawn","auditPayloadHash":"832fac0330b781f0197473c63359bca3"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/consiliency-spawn/audits/12/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":23,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}