📦
سجل التدقيق
nature-downloader - 2 عمليات التدقيق
مقارنة الإصدارات
التغييرات في القدرات والنتائج عبر الإصدارات المدقّقة، الأحدث أولاً.
إصدار التدقيق 2 الأحدث
١٨ أغسطس ٢٠٢٦، ٠٨:٣٤ ص
Most scanner matches are documentation, tests, fixed imports, status constants, or expected local file operations. Confirmed risks include CAPTCHA circumvention, unrestricted authenticated fetching, arbitrary credential forwarding, command-line secret exposure, and unbounded direct downloads. No prompt injection text was found. Static review was capped at 400/766 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
65
الملفات التي تم فحصها
8,255
الأسطر التي تم تحليلها
18
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة
مخاوف أمنية مؤكدة (6)
مرتفع
SKILL.md:154-162scripts/lib/anti-bot.mjs:426-523scripts/lib/anti-bot.mjs:579-629scripts/lib/anti-bot.mjs:641-773
Automated CAPTCHA Circumvention
The skill detects CAPTCHA gaps and simulates human-like drags or checkbox clicks to defeat provider verification controls.
The implementation explicitly calculates CAPTCHA gaps, generates human-like movement, retries alternate profiles, and checks whether verification passed.
مرتفع
API Key Forwarded to Arbitrary Endpoint
A configured IEEE endpoint accepts any URL, and the downloader appends the stored API key before sending the request.
The endpoint is stored without hostname validation, then converted to a URL and receives the API key as a query parameter.
مرتفع
scripts/batch_download.mjs:82-105scripts/batch_download.mjs:378-380scripts/browser_pdf_downloader.mjs:35-42scripts/browser_pdf_downloader.mjs:71-88
Unrestricted Authenticated URL Fetching
User-supplied URLs are fetched directly or inside an authenticated browser without scheme, hostname, or private-network restrictions.
The CLI accepts arbitrary URL strings and passes them to fetch or browser navigation without an allowlist or private-address check.
مرتفع
Command-Line Secret Exposure
API keys and institutional tokens can be passed as command arguments, exposing them through shell history and process listings.
The parser defines API-key, insttoken, and authtoken arguments, and cmd_set stores those argument values as credentials.
متوسط
Unbounded Direct Download Buffering
Direct downloads buffer the entire response in memory before validation and writing, with no byte limit.
The response arrayBuffer is fully materialized before content checks, and this path has no Content-Length or streamed byte cap.
متوسط
Unrestricted CDP Proxy Destination
The CLI accepts any proxy URL and sends browser-control payloads to it without requiring loopback or explicit trust.
The proxy argument is only trimmed, then receives target identifiers, URLs, selectors, and generated browser JavaScript through HTTP requests.
عناصر مراجعة القدرات (7)
هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.
مرتفع
Generic API/secret keys
api_key = args.api_key or os.environ.get("LIT_DL_API_KEY") or getpass.getpass("API key: ")
The API key may come from --api-key, exposing the secret through shell history and process arguments.
مرتفع
Generic API/secret keys
set_cmd.add_argument("--api-key", help="Prefer the hidden prompt or LIT_DL_API_KEY over command-line
This defines a command-line API-key option, which exposes secrets to shell history and local process inspection.
مرتفع
Fetch API call
const response = await fetch(pdfUrl, { headers: { Accept: "application/pdf, text/html, application/x
This fetches the user-supplied --pdf-url without protocol, hostname, or private-network validation.
مرتفع
Fetch API call
const r = await fetch(${fetchTarget}, { credentials: "include" });
This fetches a supplied URL with credentials inside an authenticated browser context, creating an authenticated request and local-network access risk.
مرتفع
Fetch API call
const js = `fetch('http://localhost:0/cdp',{
This request carries raw CDP mouse commands used to imitate human input and defeat verification controls.
مرتفع
Fetch API call
const r=await fetch(${JSON.stringify(url)},{credentials:'include'});
This downloads a selected URL with browser credentials and transfers the response from the authenticated page into a local file.
متوسط
Fetch API call
const response = await fetch(url, {
This generic fetch sends browser-control requests to a configurable proxy URL without restricting the destination to a trusted local service.
عوامل الخطر
🌐 الوصول إلى الشبكة (50)
data/publishers.json:4 data/publishers.json:11 data/publishers.json:18 data/school.schema.json:2 data/schools.yaml:5 docs/nature-downloader-reference-research-2026-07-15.md:23 examples/carsi-retry-template.tsv:2 examples/manifest-template.tsv:2 examples/publisher-verification-template.tsv:2 README_EN.md:32 README_EN.md:33 README_EN.md:53 README_EN.md:119 README.md:44 README.md:45 README.md:65 README.md:135 references/delivery-verification-and-failures.md:48 references/institutional-browser-workflow.md:142 references/institutional-browser-workflow.md:160 references/institutional-browser-workflow.md:160 scripts/batch_download.mjs:379 scripts/batch_download.mjs:13 scripts/batch_download.mjs:14 scripts/batch_download.mjs:235 scripts/batch_download.mjs:309 scripts/batch_download.mjs:425 scripts/batch_download.mjs:14 scripts/browser_pdf_downloader.mjs:88 scripts/browser_pdf_downloader.mjs:17 scripts/browser_pdf_downloader.mjs:18 scripts/browser_pdf_downloader.mjs:17 scripts/browser_pdf_downloader.mjs:18 scripts/cdp_open_url.mjs:6 scripts/cdp_open_url.mjs:6 scripts/configure_credentials.py:89 scripts/configure_credentials.py:110 scripts/configure_credentials.py:14 scripts/configure_credentials.py:89 scripts/configure_credentials.py:96 scripts/configure_credentials.py:99 scripts/configure_credentials.py:101 scripts/configure_credentials.py:110 scripts/configure_credentials.py:92 scripts/configure_credentials.py:98 scripts/configure_credentials.py:100 scripts/lib/anti-bot.mjs:651 scripts/lib/anti-bot.mjs:29 scripts/lib/anti-bot.mjs:651 scripts/lib/anti-bot.mjs:29
🔑 متغيرات البيئة (50)
data/publishers.json:7 data/publishers.json:14 data/publishers.json:21 scripts/batch_download.mjs:685 scripts/batch_download.mjs:685 scripts/configure_credentials.py:20 scripts/configure_credentials.py:57 scripts/configure_credentials.py:55 scripts/configure_credentials.py:57 scripts/configure_credentials.py:58 scripts/configure_credentials.py:60 scripts/configure_credentials.py:70 scripts/configure_credentials.py:90 scripts/configure_credentials.py:98 scripts/configure_credentials.py:106 scripts/configure_credentials.py:135 scripts/lib/credentials.mjs:8 scripts/lib/credentials.mjs:13 scripts/lib/credentials.mjs:39 scripts/lib/credentials.mjs:51 scripts/lib/credentials.mjs:58 scripts/lib/credentials.mjs:70 scripts/lib/credentials.mjs:44 scripts/lib/manifest.mjs:4 scripts/lib/manifest.mjs:19 scripts/lib/publisher-providers.mjs:23 scripts/lib/publisher-providers.mjs:31 scripts/lib/publisher-providers.mjs:40 scripts/lib/publisher-providers.mjs:62 scripts/lib/routing.mjs:20 scripts/lib/school-config.mjs:7 scripts/lib/school-config.mjs:12 scripts/lib/school-config.mjs:32 scripts/lib/settings.mjs:5 scripts/lib/settings.mjs:10 src/config.py:22 src/config.py:53 src/config.py:55 src/config.py:60 src/config.py:106 tests/python/test_config_credentials.py:19 tests/python/test_config_credentials.py:36 tests/python/test_config_wizard.py:68 tests/python/test_config_wizard.py:69 tests/python/test_config_wizard.py:89 tests/python/test_config_wizard.py:90 tests/python/test_config_wizard.py:107 tests/python/test_config_wizard.py:122 tests/python/test_config_wizard.py:140 tests/python/test_config_wizard.py:158
📁 الوصول إلى نظام الملفات (50)
data/school.schema.json:4 data/school.schema.json:4 docs/nature-downloader-reference-research-2026-07-15.md:23 docs/nature-downloader-reference-research-2026-07-15.md:78 docs/nature-downloader-reference-research-2026-07-15.md:23 docs/nature-downloader-reference-research-2026-07-15.md:78 docs/superpowers/plans/2026-06-21-nature-downloader-merge.md:48 docs/superpowers/plans/2026-06-21-nature-downloader-merge.md:48 README_EN.md:38 README_EN.md:65 README_EN.md:73 README_EN.md:155 README_EN.md:38 README_EN.md:65 README_EN.md:73 README_EN.md:155 README.md:50 README.md:79 README.md:87 README.md:160 README.md:50 README.md:79 README.md:87 README.md:160 references/delivery-verification-and-failures.md:117 references/delivery-verification-and-failures.md:124 references/institutional-browser-workflow.md:110 scripts/batch_download.mjs:228 scripts/batch_download.mjs:229 scripts/batch_download.mjs:440 scripts/batch_download.mjs:680 scripts/batch_download.mjs:438 scripts/batch_download.mjs:229 scripts/batch_download.mjs:440 scripts/batch_download.mjs:241 scripts/batch_download.mjs:244 scripts/batch_download.mjs:288 scripts/batch_download.mjs:291 scripts/batch_download.mjs:180 scripts/batch_download.mjs:187 scripts/batch_download.mjs:213 scripts/batch_download.mjs:775 scripts/browser_pdf_downloader.mjs:119 scripts/browser_pdf_downloader.mjs:147 scripts/browser_pdf_downloader.mjs:147 scripts/browser_pdf_downloader.mjs:120 scripts/configure_credentials.py:11 scripts/configure_credentials.py:36 scripts/configure_credentials.py:38 scripts/configure_credentials.py:41
⚙️ الأوامر الخارجية (50)
references/delivery-verification-and-failures.md:62-64 references/delivery-verification-and-failures.md:59 references/delivery-verification-and-failures.md:144 references/institutional-browser-workflow.md:110-112 references/institutional-browser-workflow.md:142-144 references/institutional-browser-workflow.md:139 scripts/batch_download.mjs:142 scripts/batch_download.mjs:149 scripts/batch_download.mjs:170 scripts/batch_download.mjs:175 scripts/batch_download.mjs:180 scripts/batch_download.mjs:197 scripts/batch_download.mjs:199 scripts/batch_download.mjs:200 scripts/batch_download.mjs:213 scripts/batch_download.mjs:222 scripts/batch_download.mjs:227 scripts/batch_download.mjs:241 scripts/batch_download.mjs:244 scripts/batch_download.mjs:256 scripts/batch_download.mjs:263 scripts/batch_download.mjs:276-282 scripts/batch_download.mjs:288 scripts/batch_download.mjs:291 scripts/batch_download.mjs:300 scripts/batch_download.mjs:309 scripts/batch_download.mjs:321 scripts/batch_download.mjs:334 scripts/batch_download.mjs:335 scripts/batch_download.mjs:343 scripts/batch_download.mjs:381 scripts/batch_download.mjs:404 scripts/batch_download.mjs:425 scripts/batch_download.mjs:494 scripts/batch_download.mjs:629 scripts/batch_download.mjs:687 scripts/batch_download.mjs:754 scripts/batch_download.mjs:769 scripts/batch_download.mjs:771 scripts/batch_download.mjs:777 scripts/batch_download.mjs:781 scripts/batch_download.mjs:784 scripts/batch_download.mjs:816 scripts/browser_pdf_downloader.mjs:16-21 scripts/browser_pdf_downloader.mjs:50 scripts/browser_pdf_downloader.mjs:86-101 scripts/browser_pdf_downloader.mjs:106 scripts/browser_pdf_downloader.mjs:112 scripts/browser_pdf_downloader.mjs:114 scripts/browser_pdf_downloader.mjs:115
⚡ يحتوي على سكربتات (8)
دقّقه: codex
١٨ أغسطس ٢٠٢٦، ٠٨:٣٤ ص
Most scanner matches are documentation, tests, fixed imports, status constants, or expected local file operations. Confirmed risks include CAPTCHA circumvention, unrestricted authenticated fetching, arbitrary credential forwarding, command-line secret exposure, and unbounded direct downloads. No prompt injection text was found. Static review was capped at 400/766 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
65
الملفات التي تم فحصها
8,255
الأسطر التي تم تحليلها
18
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة
مخاوف أمنية مؤكدة (6)
مرتفع
SKILL.md:154-162scripts/lib/anti-bot.mjs:426-523scripts/lib/anti-bot.mjs:579-629scripts/lib/anti-bot.mjs:641-773
Automated CAPTCHA Circumvention
The skill detects CAPTCHA gaps and simulates human-like drags or checkbox clicks to defeat provider verification controls.
The implementation explicitly calculates CAPTCHA gaps, generates human-like movement, retries alternate profiles, and checks whether verification passed.
مرتفع
API Key Forwarded to Arbitrary Endpoint
A configured IEEE endpoint accepts any URL, and the downloader appends the stored API key before sending the request.
The endpoint is stored without hostname validation, then converted to a URL and receives the API key as a query parameter.
مرتفع
scripts/batch_download.mjs:82-105scripts/batch_download.mjs:378-380scripts/browser_pdf_downloader.mjs:35-42scripts/browser_pdf_downloader.mjs:71-88
Unrestricted Authenticated URL Fetching
User-supplied URLs are fetched directly or inside an authenticated browser without scheme, hostname, or private-network restrictions.
The CLI accepts arbitrary URL strings and passes them to fetch or browser navigation without an allowlist or private-address check.
مرتفع
Command-Line Secret Exposure
API keys and institutional tokens can be passed as command arguments, exposing them through shell history and process listings.
The parser defines API-key, insttoken, and authtoken arguments, and cmd_set stores those argument values as credentials.
متوسط
Unbounded Direct Download Buffering
Direct downloads buffer the entire response in memory before validation and writing, with no byte limit.
The response arrayBuffer is fully materialized before content checks, and this path has no Content-Length or streamed byte cap.
متوسط
Unrestricted CDP Proxy Destination
The CLI accepts any proxy URL and sends browser-control payloads to it without requiring loopback or explicit trust.
The proxy argument is only trimmed, then receives target identifiers, URLs, selectors, and generated browser JavaScript through HTTP requests.
عناصر مراجعة القدرات (7)
هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.
مرتفع
Generic API/secret keys
api_key = args.api_key or os.environ.get("LIT_DL_API_KEY") or getpass.getpass("API key: ")
The API key may come from --api-key, exposing the secret through shell history and process arguments.
مرتفع
Generic API/secret keys
set_cmd.add_argument("--api-key", help="Prefer the hidden prompt or LIT_DL_API_KEY over command-line
This defines a command-line API-key option, which exposes secrets to shell history and local process inspection.
مرتفع
Fetch API call
const response = await fetch(pdfUrl, { headers: { Accept: "application/pdf, text/html, application/x
This fetches the user-supplied --pdf-url without protocol, hostname, or private-network validation.
مرتفع
Fetch API call
const r = await fetch(${fetchTarget}, { credentials: "include" });
This fetches a supplied URL with credentials inside an authenticated browser context, creating an authenticated request and local-network access risk.
مرتفع
Fetch API call
const js = `fetch('http://localhost:0/cdp',{
This request carries raw CDP mouse commands used to imitate human input and defeat verification controls.
مرتفع
Fetch API call
const r=await fetch(${JSON.stringify(url)},{credentials:'include'});
This downloads a selected URL with browser credentials and transfers the response from the authenticated page into a local file.
متوسط
Fetch API call
const response = await fetch(url, {
This generic fetch sends browser-control requests to a configurable proxy URL without restricting the destination to a trusted local service.
عوامل الخطر
🌐 الوصول إلى الشبكة (50)
data/publishers.json:4 data/publishers.json:11 data/publishers.json:18 data/school.schema.json:2 data/schools.yaml:5 docs/nature-downloader-reference-research-2026-07-15.md:23 examples/carsi-retry-template.tsv:2 examples/manifest-template.tsv:2 examples/publisher-verification-template.tsv:2 README_EN.md:32 README_EN.md:33 README_EN.md:53 README_EN.md:119 README.md:44 README.md:45 README.md:65 README.md:135 references/delivery-verification-and-failures.md:48 references/institutional-browser-workflow.md:142 references/institutional-browser-workflow.md:160 references/institutional-browser-workflow.md:160 scripts/batch_download.mjs:379 scripts/batch_download.mjs:13 scripts/batch_download.mjs:14 scripts/batch_download.mjs:235 scripts/batch_download.mjs:309 scripts/batch_download.mjs:425 scripts/batch_download.mjs:14 scripts/browser_pdf_downloader.mjs:88 scripts/browser_pdf_downloader.mjs:17 scripts/browser_pdf_downloader.mjs:18 scripts/browser_pdf_downloader.mjs:17 scripts/browser_pdf_downloader.mjs:18 scripts/cdp_open_url.mjs:6 scripts/cdp_open_url.mjs:6 scripts/configure_credentials.py:89 scripts/configure_credentials.py:110 scripts/configure_credentials.py:14 scripts/configure_credentials.py:89 scripts/configure_credentials.py:96 scripts/configure_credentials.py:99 scripts/configure_credentials.py:101 scripts/configure_credentials.py:110 scripts/configure_credentials.py:92 scripts/configure_credentials.py:98 scripts/configure_credentials.py:100 scripts/lib/anti-bot.mjs:651 scripts/lib/anti-bot.mjs:29 scripts/lib/anti-bot.mjs:651 scripts/lib/anti-bot.mjs:29
🔑 متغيرات البيئة (50)
data/publishers.json:7 data/publishers.json:14 data/publishers.json:21 scripts/batch_download.mjs:685 scripts/batch_download.mjs:685 scripts/configure_credentials.py:20 scripts/configure_credentials.py:57 scripts/configure_credentials.py:55 scripts/configure_credentials.py:57 scripts/configure_credentials.py:58 scripts/configure_credentials.py:60 scripts/configure_credentials.py:70 scripts/configure_credentials.py:90 scripts/configure_credentials.py:98 scripts/configure_credentials.py:106 scripts/configure_credentials.py:135 scripts/lib/credentials.mjs:8 scripts/lib/credentials.mjs:13 scripts/lib/credentials.mjs:39 scripts/lib/credentials.mjs:51 scripts/lib/credentials.mjs:58 scripts/lib/credentials.mjs:70 scripts/lib/credentials.mjs:44 scripts/lib/manifest.mjs:4 scripts/lib/manifest.mjs:19 scripts/lib/publisher-providers.mjs:23 scripts/lib/publisher-providers.mjs:31 scripts/lib/publisher-providers.mjs:40 scripts/lib/publisher-providers.mjs:62 scripts/lib/routing.mjs:20 scripts/lib/school-config.mjs:7 scripts/lib/school-config.mjs:12 scripts/lib/school-config.mjs:32 scripts/lib/settings.mjs:5 scripts/lib/settings.mjs:10 src/config.py:22 src/config.py:53 src/config.py:55 src/config.py:60 src/config.py:106 tests/python/test_config_credentials.py:19 tests/python/test_config_credentials.py:36 tests/python/test_config_wizard.py:68 tests/python/test_config_wizard.py:69 tests/python/test_config_wizard.py:89 tests/python/test_config_wizard.py:90 tests/python/test_config_wizard.py:107 tests/python/test_config_wizard.py:122 tests/python/test_config_wizard.py:140 tests/python/test_config_wizard.py:158
📁 الوصول إلى نظام الملفات (50)
data/school.schema.json:4 data/school.schema.json:4 docs/nature-downloader-reference-research-2026-07-15.md:23 docs/nature-downloader-reference-research-2026-07-15.md:78 docs/nature-downloader-reference-research-2026-07-15.md:23 docs/nature-downloader-reference-research-2026-07-15.md:78 docs/superpowers/plans/2026-06-21-nature-downloader-merge.md:48 docs/superpowers/plans/2026-06-21-nature-downloader-merge.md:48 README_EN.md:38 README_EN.md:65 README_EN.md:73 README_EN.md:155 README_EN.md:38 README_EN.md:65 README_EN.md:73 README_EN.md:155 README.md:50 README.md:79 README.md:87 README.md:160 README.md:50 README.md:79 README.md:87 README.md:160 references/delivery-verification-and-failures.md:117 references/delivery-verification-and-failures.md:124 references/institutional-browser-workflow.md:110 scripts/batch_download.mjs:228 scripts/batch_download.mjs:229 scripts/batch_download.mjs:440 scripts/batch_download.mjs:680 scripts/batch_download.mjs:438 scripts/batch_download.mjs:229 scripts/batch_download.mjs:440 scripts/batch_download.mjs:241 scripts/batch_download.mjs:244 scripts/batch_download.mjs:288 scripts/batch_download.mjs:291 scripts/batch_download.mjs:180 scripts/batch_download.mjs:187 scripts/batch_download.mjs:213 scripts/batch_download.mjs:775 scripts/browser_pdf_downloader.mjs:119 scripts/browser_pdf_downloader.mjs:147 scripts/browser_pdf_downloader.mjs:147 scripts/browser_pdf_downloader.mjs:120 scripts/configure_credentials.py:11 scripts/configure_credentials.py:36 scripts/configure_credentials.py:38 scripts/configure_credentials.py:41
⚙️ الأوامر الخارجية (50)
references/delivery-verification-and-failures.md:62-64 references/delivery-verification-and-failures.md:59 references/delivery-verification-and-failures.md:144 references/institutional-browser-workflow.md:110-112 references/institutional-browser-workflow.md:142-144 references/institutional-browser-workflow.md:139 scripts/batch_download.mjs:142 scripts/batch_download.mjs:149 scripts/batch_download.mjs:170 scripts/batch_download.mjs:175 scripts/batch_download.mjs:180 scripts/batch_download.mjs:197 scripts/batch_download.mjs:199 scripts/batch_download.mjs:200 scripts/batch_download.mjs:213 scripts/batch_download.mjs:222 scripts/batch_download.mjs:227 scripts/batch_download.mjs:241 scripts/batch_download.mjs:244 scripts/batch_download.mjs:256 scripts/batch_download.mjs:263 scripts/batch_download.mjs:276-282 scripts/batch_download.mjs:288 scripts/batch_download.mjs:291 scripts/batch_download.mjs:300 scripts/batch_download.mjs:309 scripts/batch_download.mjs:321 scripts/batch_download.mjs:334 scripts/batch_download.mjs:335 scripts/batch_download.mjs:343 scripts/batch_download.mjs:381 scripts/batch_download.mjs:404 scripts/batch_download.mjs:425 scripts/batch_download.mjs:494 scripts/batch_download.mjs:629 scripts/batch_download.mjs:687 scripts/batch_download.mjs:754 scripts/batch_download.mjs:769 scripts/batch_download.mjs:771 scripts/batch_download.mjs:777 scripts/batch_download.mjs:781 scripts/batch_download.mjs:784 scripts/batch_download.mjs:816 scripts/browser_pdf_downloader.mjs:16-21 scripts/browser_pdf_downloader.mjs:50 scripts/browser_pdf_downloader.mjs:86-101 scripts/browser_pdf_downloader.mjs:106 scripts/browser_pdf_downloader.mjs:112 scripts/browser_pdf_downloader.mjs:114 scripts/browser_pdf_downloader.mjs:115
⚡ يحتوي على سكربتات (8)
دقّقه: codex