📦
監査履歴
security-guardian - 11 監査
バージョン比較
監査済みバージョン間の機能と検出結果の変化（新しい順）。
| バージョン | 日付 | 結果 | レビュー項目 | 前バージョンとの変化 |
|---|---|---|---|---|
| v11 最新 | 21. Juli 2026, 10:02 | 確認された検出結果なし | 0 | 機能の変化なし |
| v10 | 19. Juli 2026, 02:14 | 2 確認済み | 0 | 機能の変化なし |
| v9 | 7. Juli 2026, 19:21 | 確認された検出結果なし | 0 | 機能の変化なし |
| v8 | 5. Juli 2026, 04:09 | 確認された検出結果なし | 0 | 機能の変化なし |
| v7 | 5. Juli 2026, 04:09 | 確認された検出結果なし | 0 | 機能の変化なし |
| v6 | 28. Juni 2026, 15:16 | 1 確認済み | 1 | 環境変数 |
| v5 | 16. Jan. 2026, 19:37 | 確認された検出結果なし | 0 | 機能の変化なし |
| v4 | 16. Jan. 2026, 19:37 | 確認された検出結果なし | 0 | 外部コマンドネットワークアクセススクリプトを含むファイルシステムへのアクセス |
| v3 | 10. Jan. 2026, 11:28 | 確認された検出結果なし | 0 | 機能の変化なし |
| v2 | 10. Jan. 2026, 11:28 | 確認された検出結果なし | 0 | 機能の変化なし |
| v1 | 10. Jan. 2026, 11:28 | 確認された検出結果なし | 0 | 基準 |
監査バージョン 11 最新
21. Juli 2026, 10:02
All 400 static matches are false positives in a French-language application-security reference skill. The flagged strings appear in educational examples, checklists, or defensive detection guidance, and no executable code, credential access, or outbound network behavior was found. No prompt-injection text was found in the reviewed skill instructions.
27
スキャンされたファイル
8,195
解析済み行数
5
レビュー項目
0
誤検知を無視
リスク要因
🌐 ネットワークアクセス (50)
api-security/cors-configuration.md:29 api-security/cors-configuration.md:91 api-security/cors-configuration.md:97 api-security/cors-configuration.md:124 api-security/cors-configuration.md:125 api-security/cors-configuration.md:171 api-security/cors-configuration.md:173 api-security/cors-configuration.md:232 authentication/oauth-security.md:93 checklists/owasp-top-10.md:101 logging-monitoring/security-logging.md:101 secrets-management/secrets-detection.md:18 vulnerabilities/command-injection.md:60 vulnerabilities/csrf.md:57 vulnerabilities/csrf.md:230 vulnerabilities/csrf.md:40 vulnerabilities/csrf.md:41 vulnerabilities/csrf.md:42 vulnerabilities/csrf.md:48 vulnerabilities/csrf.md:57 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:277 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:352 vulnerabilities/ssrf.md:393 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:353 vulnerabilities/ssrf.md:355 vulnerabilities/ssrf.md:38 vulnerabilities/ssrf.md:39 vulnerabilities/ssrf.md:40 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:59 vulnerabilities/ssrf.md:60 vulnerabilities/ssrf.md:61 vulnerabilities/ssrf.md:286 vulnerabilities/ssrf.md:287 vulnerabilities/ssrf.md:288 vulnerabilities/ssrf.md:289 vulnerabilities/ssrf.md:290 vulnerabilities/ssrf.md:295 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:297
📁 ファイルシステムへのアクセス (30)
input-validation/file-upload-security.md:32 input-validation/file-upload-security.md:143 input-validation/sanitization.md:74 input-validation/sanitization.md:75 vulnerabilities/command-injection.md:183 vulnerabilities/command-injection.md:344 vulnerabilities/command-injection.md:99 vulnerabilities/command-injection.md:100 vulnerabilities/path-traversal.md:333 vulnerabilities/path-traversal.md:14 vulnerabilities/path-traversal.md:15 vulnerabilities/path-traversal.md:24 vulnerabilities/path-traversal.md:25 vulnerabilities/path-traversal.md:36 vulnerabilities/path-traversal.md:42 vulnerabilities/path-traversal.md:48 vulnerabilities/path-traversal.md:49 vulnerabilities/path-traversal.md:179 vulnerabilities/path-traversal.md:253 vulnerabilities/path-traversal.md:294 vulnerabilities/path-traversal.md:301 vulnerabilities/path-traversal.md:307 vulnerabilities/path-traversal.md:313 vulnerabilities/path-traversal.md:268 vulnerabilities/path-traversal.md:269 vulnerabilities/path-traversal.md:266 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:285 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:284
🔑 環境変数 (1)
⚙️ 外部コマンド (47)
SKILL.md:54 SKILL.md:61 SKILL.md:70 SKILL.md:77 SKILL.md:84 SKILL.md:91 SKILL.md:98 SKILL.md:105 SKILL.md:111 SKILL.md:188 SKILL.md:189 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:138 vulnerabilities/command-injection.md:325 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:206 vulnerabilities/command-injection.md:326 vulnerabilities/command-injection.md:359 vulnerabilities/command-injection.md:210 vulnerabilities/command-injection.md:335 vulnerabilities/command-injection.md:33 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:29-34 vulnerabilities/command-injection.md:78-79 vulnerabilities/command-injection.md:79-81 vulnerabilities/command-injection.md:221-223 vulnerabilities/command-injection.md:297-299 vulnerabilities/command-injection.md:322-327 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:87 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:32 vulnerabilities/command-injection.md:261 vulnerabilities/command-injection.md:74 vulnerabilities/command-injection.md:75 vulnerabilities/sql-injection.md:34-37 vulnerabilities/sql-injection.md:43-44 vulnerabilities/sql-injection.md:105-110
⚡ スクリプトを含む (32)
vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:39 vulnerabilities/command-injection.md:85 vulnerabilities/command-injection.md:88 vulnerabilities/command-injection.md:92 vulnerabilities/command-injection.md:229 vulnerabilities/command-injection.md:232 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:40 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:233 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:87 vulnerabilities/xss.md:53 vulnerabilities/xss.md:328 vulnerabilities/xss.md:56 vulnerabilities/xss.md:330 vulnerabilities/xss.md:52 vulnerabilities/xss.md:43 vulnerabilities/xss.md:50 vulnerabilities/xss.md:412 vulnerabilities/xss.md:51
監査者: claude
19. Juli 2026, 02:14
All 398 static detections are Markdown examples, checklist terms, or inline references; no packaged executable code performs the flagged actions. Two examples labeled correct contain unsafe remediation patterns that could introduce path traversal or XXE if copied. No prompt injection or malicious exfiltration intent was found.
26
スキャンされたファイル
7,813
解析済み行数
7
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (2)
高
Unsafe path containment examples labeled correct
The recommended Node.js, Python, and Java checks use raw string prefixes. Sibling paths sharing the base prefix can pass these checks.
The examples are explicitly labeled correct and use startsWith without a path-separator boundary or component-aware comparison.
高
Unsafe PHP XXE remediation labeled correct
The PHP example enables entity substitution and DTD loading while presenting the configuration as safe. This can preserve XXE or entity-expansion risk.
The example passes LIBXML_NOENT and LIBXML_DTDLOAD to loadXML, directly contradicting the goal of disabling DTD and entity processing.
リスク要因
🌐 ネットワークアクセス (50)
api-security/cors-configuration.md:29 api-security/cors-configuration.md:91 api-security/cors-configuration.md:97 api-security/cors-configuration.md:124 api-security/cors-configuration.md:125 api-security/cors-configuration.md:171 api-security/cors-configuration.md:173 api-security/cors-configuration.md:232 authentication/oauth-security.md:93 checklists/owasp-top-10.md:101 logging-monitoring/security-logging.md:101 secrets-management/secrets-detection.md:18 vulnerabilities/command-injection.md:60 vulnerabilities/csrf.md:57 vulnerabilities/csrf.md:230 vulnerabilities/csrf.md:40 vulnerabilities/csrf.md:41 vulnerabilities/csrf.md:42 vulnerabilities/csrf.md:48 vulnerabilities/csrf.md:57 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:277 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:352 vulnerabilities/ssrf.md:393 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:353 vulnerabilities/ssrf.md:355 vulnerabilities/ssrf.md:38 vulnerabilities/ssrf.md:39 vulnerabilities/ssrf.md:40 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:59 vulnerabilities/ssrf.md:60 vulnerabilities/ssrf.md:61 vulnerabilities/ssrf.md:286 vulnerabilities/ssrf.md:287 vulnerabilities/ssrf.md:288 vulnerabilities/ssrf.md:289 vulnerabilities/ssrf.md:290 vulnerabilities/ssrf.md:295 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:297
📁 ファイルシステムへのアクセス (30)
input-validation/file-upload-security.md:32 input-validation/file-upload-security.md:143 input-validation/sanitization.md:74 input-validation/sanitization.md:75 vulnerabilities/command-injection.md:183 vulnerabilities/command-injection.md:344 vulnerabilities/command-injection.md:99 vulnerabilities/command-injection.md:100 vulnerabilities/path-traversal.md:333 vulnerabilities/path-traversal.md:14 vulnerabilities/path-traversal.md:15 vulnerabilities/path-traversal.md:24 vulnerabilities/path-traversal.md:25 vulnerabilities/path-traversal.md:36 vulnerabilities/path-traversal.md:42 vulnerabilities/path-traversal.md:48 vulnerabilities/path-traversal.md:49 vulnerabilities/path-traversal.md:179 vulnerabilities/path-traversal.md:253 vulnerabilities/path-traversal.md:294 vulnerabilities/path-traversal.md:301 vulnerabilities/path-traversal.md:307 vulnerabilities/path-traversal.md:313 vulnerabilities/path-traversal.md:268 vulnerabilities/path-traversal.md:269 vulnerabilities/path-traversal.md:266 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:285 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:284
🔑 環境変数 (1)
⚙️ 外部コマンド (47)
SKILL.md:54 SKILL.md:61 SKILL.md:70 SKILL.md:77 SKILL.md:84 SKILL.md:91 SKILL.md:98 SKILL.md:105 SKILL.md:111 SKILL.md:188 SKILL.md:189 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:138 vulnerabilities/command-injection.md:325 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:206 vulnerabilities/command-injection.md:326 vulnerabilities/command-injection.md:359 vulnerabilities/command-injection.md:210 vulnerabilities/command-injection.md:335 vulnerabilities/command-injection.md:33 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:29-34 vulnerabilities/command-injection.md:78-79 vulnerabilities/command-injection.md:79-81 vulnerabilities/command-injection.md:221-223 vulnerabilities/command-injection.md:297-299 vulnerabilities/command-injection.md:322-327 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:87 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:32 vulnerabilities/command-injection.md:261 vulnerabilities/command-injection.md:74 vulnerabilities/command-injection.md:75 vulnerabilities/sql-injection.md:34-37 vulnerabilities/sql-injection.md:43-44 vulnerabilities/sql-injection.md:105-110
⚡ スクリプトを含む (32)
vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:39 vulnerabilities/command-injection.md:85 vulnerabilities/command-injection.md:88 vulnerabilities/command-injection.md:92 vulnerabilities/command-injection.md:229 vulnerabilities/command-injection.md:232 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:40 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:233 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:87 vulnerabilities/xss.md:53 vulnerabilities/xss.md:328 vulnerabilities/xss.md:56 vulnerabilities/xss.md:330 vulnerabilities/xss.md:52 vulnerabilities/xss.md:43 vulnerabilities/xss.md:50 vulnerabilities/xss.md:412 vulnerabilities/xss.md:51
監査者: codex
7. Juli 2026, 19:21
All 399 static findings were adjudicated as false positives after reviewing the Markdown context. The flagged strings are educational vulnerability examples, checklists, or remediation guidance, not executable code or credential access flows. No evidence found for prompt injection, data exfiltration intent, or malicious instructions.
27
スキャンされたファイル
8,195
解析済み行数
5
レビュー項目
0
誤検知を無視
リスク要因
🌐 ネットワークアクセス (97)
api-security/cors-configuration.md:29 api-security/cors-configuration.md:91 api-security/cors-configuration.md:97 api-security/cors-configuration.md:124 api-security/cors-configuration.md:125 api-security/cors-configuration.md:171 api-security/cors-configuration.md:173 api-security/cors-configuration.md:232 authentication/oauth-security.md:93 checklists/owasp-top-10.md:101 logging-monitoring/security-logging.md:101 secrets-management/secrets-detection.md:18 vulnerabilities/command-injection.md:60 vulnerabilities/csrf.md:57 vulnerabilities/csrf.md:230 vulnerabilities/csrf.md:40 vulnerabilities/csrf.md:41 vulnerabilities/csrf.md:42 vulnerabilities/csrf.md:48 vulnerabilities/csrf.md:57 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:277 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:352 vulnerabilities/ssrf.md:393 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:353 vulnerabilities/ssrf.md:355 vulnerabilities/ssrf.md:38 vulnerabilities/ssrf.md:39 vulnerabilities/ssrf.md:40 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:59 vulnerabilities/ssrf.md:60 vulnerabilities/ssrf.md:61 vulnerabilities/ssrf.md:286 vulnerabilities/ssrf.md:287 vulnerabilities/ssrf.md:288 vulnerabilities/ssrf.md:289 vulnerabilities/ssrf.md:290 vulnerabilities/ssrf.md:295 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:297 vulnerabilities/ssrf.md:302 vulnerabilities/ssrf.md:303 vulnerabilities/ssrf.md:39 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:164 vulnerabilities/ssrf.md:165 vulnerabilities/ssrf.md:173 vulnerabilities/ssrf.md:174 vulnerabilities/ssrf.md:175 vulnerabilities/ssrf.md:176 vulnerabilities/ssrf.md:177 vulnerabilities/ssrf.md:286 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:297 vulnerabilities/ssrf.md:332 vulnerabilities/ssrf.md:333 vulnerabilities/ssrf.md:334 vulnerabilities/ssrf.md:335 vulnerabilities/ssrf.md:336 vulnerabilities/ssrf.md:337 vulnerabilities/ssrf.md:338 vulnerabilities/ssrf.md:339 vulnerabilities/ssrf.md:352 vulnerabilities/ssrf.md:354 vulnerabilities/ssrf.md:355 vulnerabilities/ssrf.md:75 vulnerabilities/ssrf.md:324 vulnerabilities/ssrf.md:322 vulnerabilities/xss.md:75 vulnerabilities/xxe.md:299 vulnerabilities/xxe.md:300 vulnerabilities/xxe.md:50 vulnerabilities/xxe.md:59 vulnerabilities/xxe.md:65 vulnerabilities/xxe.md:165 vulnerabilities/xxe.md:166 vulnerabilities/xxe.md:167 vulnerabilities/xxe.md:168 vulnerabilities/xxe.md:299 vulnerabilities/xxe.md:300 vulnerabilities/xxe.md:315 vulnerabilities/xxe.md:316 vulnerabilities/xxe.md:317 vulnerabilities/xxe.md:299
📁 ファイルシステムへのアクセス (30)
input-validation/file-upload-security.md:32 input-validation/file-upload-security.md:143 input-validation/sanitization.md:74 input-validation/sanitization.md:75 vulnerabilities/command-injection.md:183 vulnerabilities/command-injection.md:344 vulnerabilities/command-injection.md:99 vulnerabilities/command-injection.md:100 vulnerabilities/path-traversal.md:333 vulnerabilities/path-traversal.md:14 vulnerabilities/path-traversal.md:15 vulnerabilities/path-traversal.md:24 vulnerabilities/path-traversal.md:25 vulnerabilities/path-traversal.md:36 vulnerabilities/path-traversal.md:42 vulnerabilities/path-traversal.md:48 vulnerabilities/path-traversal.md:49 vulnerabilities/path-traversal.md:179 vulnerabilities/path-traversal.md:253 vulnerabilities/path-traversal.md:294 vulnerabilities/path-traversal.md:301 vulnerabilities/path-traversal.md:307 vulnerabilities/path-traversal.md:313 vulnerabilities/path-traversal.md:268 vulnerabilities/path-traversal.md:269 vulnerabilities/path-traversal.md:266 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:285 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:284
🔑 環境変数 (1)
⚙️ 外部コマンド (47)
SKILL.md:54 SKILL.md:61 SKILL.md:70 SKILL.md:77 SKILL.md:84 SKILL.md:91 SKILL.md:98 SKILL.md:105 SKILL.md:111 SKILL.md:188 SKILL.md:189 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:138 vulnerabilities/command-injection.md:325 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:206 vulnerabilities/command-injection.md:326 vulnerabilities/command-injection.md:359 vulnerabilities/command-injection.md:210 vulnerabilities/command-injection.md:335 vulnerabilities/command-injection.md:33 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:29-34 vulnerabilities/command-injection.md:78-79 vulnerabilities/command-injection.md:79-81 vulnerabilities/command-injection.md:221-223 vulnerabilities/command-injection.md:297-299 vulnerabilities/command-injection.md:322-327 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:87 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:32 vulnerabilities/command-injection.md:261 vulnerabilities/command-injection.md:74 vulnerabilities/command-injection.md:75 vulnerabilities/sql-injection.md:34-37 vulnerabilities/sql-injection.md:43-44 vulnerabilities/sql-injection.md:105-110
⚡ スクリプトを含む (32)
vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:39 vulnerabilities/command-injection.md:85 vulnerabilities/command-injection.md:88 vulnerabilities/command-injection.md:92 vulnerabilities/command-injection.md:229 vulnerabilities/command-injection.md:232 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:40 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:233 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:87 vulnerabilities/xss.md:53 vulnerabilities/xss.md:328 vulnerabilities/xss.md:56 vulnerabilities/xss.md:330 vulnerabilities/xss.md:52 vulnerabilities/xss.md:43 vulnerabilities/xss.md:50 vulnerabilities/xss.md:412 vulnerabilities/xss.md:51
監査者: codex
5. Juli 2026, 04:09
The static findings are false positives caused by Markdown security documentation, exploit payload examples, and defensive checklists. I found no executable package code, no credential exfiltration flow, and no prompt injection attempt in the reviewed files.
26
スキャンされたファイル
7,813
解析済み行数
5
レビュー項目
147
誤検知を無視
静的解析の誤検知を無視 (147)
これらの静的マッチはセマンティックレビューで却下されたか、スキーマのみのトークンに一致したため、透明性のために表示されていますが、品質スコアには影響しません。
重大
AWS/Azure metadata endpoint
- [ ] Cloud metadata IPs bloqués (169.254.169.254) ?
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
SSH private key file
id_rsa
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
PHP shell_exec
- shell_exec("command " + input)
Force-confirmed external_commands/critical static finding; AI dismissal overridden.
重大
PHP shell_exec
- [ ] Utilisation de exec(), system(), shell_exec() ?
Force-confirmed external_commands/critical static finding; AI dismissal overridden.
重大
System password file access
Input: && cat /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
Command: command && cat /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access · 2 件
Input: ../../etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
Command: cat /var/app/files/../../etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
→ Lecture de /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- Lecture de fichiers sensibles (/etc/passwd, /etc/shadow)
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Recursive delete on root/home
Input: __import__('os').system('rm -rf /')
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
SSH directory access
- Private keys (.ssh/id_rsa)
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
SSH directory access · 2 件
/root/.ssh/id_rsa
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
SSH private key file
- Private keys (.ssh/id_rsa)
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
SSH private key file · 2 件
/root/.ssh/id_rsa
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
SSH private key file · 2 件
C:\Users\Administrator\.ssh\id_rsa
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
Windows SAM/registry hive access
..\..\..\..\windows\system32\config\sam
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
Windows SAM/registry hive access
C:\Windows\System32\config\sam
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
System password file access
Path: /var/www/files/../../etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
Résultat: /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
../../../etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access · 3 件
/etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access · 2 件
../../etc/passwd%00.jpg
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
....//....//....//etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
..././..././..././etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- /etc/passwd, /etc/shadow
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- [ ] Tester ../../../etc/passwd ?
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access · 2 件
/etc/shadow
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
....//....//etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
..;/..;/etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
..\/..\/..\/etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint · 2 件
http://169.254.169.254/latest/meta-data/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
http://169.254.169.254/latest/user-data/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
http://169.254.169.254/latest/meta-data/iam/security-credentials/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
http://169.254.169.254/metadata/instance?api-version=2021-02-01
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
- [ ] Tester http://169.254.169.254 (metadata) ?
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
http://169.254.169.254.nip.io (wildcard DNS)
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
169.254.169.254 AWS, Azure, GCP
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
- Accès à 169.254.169.254
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
GCP metadata endpoint
http://metadata.google.internal/computeMetadata/v1/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
GCP metadata endpoint
metadata.google.internal
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
Alibaba Cloud metadata endpoint
100.100.100.200 Alibaba Cloud
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
System password file access
file:///etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
### Keylogging
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
GCP metadata endpoint
http://metadata.google.internal/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS credentials directory
~/.aws/credentials
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
System password file access · 2 件
<!ENTITY xxe SYSTEM "file:///etc/passwd">
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
<!ENTITY % file SYSTEM "file:///etc/passwd">
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- /etc/shadow
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- [ ] Tester avec file:///etc/passwd ?
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
This combination is common in credential stealers and RATs
Force-confirmed obfuscation/critical static finding; AI dismissal overridden.
重大
[HEURISTIC] DANGEROUS COMBINATION: Network + Credentials + Evasion techniques
This combination suggests data exfiltration with anti-detection
Force-confirmed obfuscation/critical static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Cross-Origin Resource Sharing : mécanisme permettant à des ressources web d'être accédées depuis un
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Indépendant des clients
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Stocker JTI des tokens révoqués
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Rotation des refresh tokens ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Alerter utilisateur des risques
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
# Sécurité des Mots de Passe
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
## Stockage des Mots de Passe
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Expiration des tokens ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Usage unique des tokens ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Accès direct à des objets via identifiant sans vérification d'autorisation.
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
**Séparation des Devoirs**
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Pas d'algorithmes faibles (MD5, SHA1, DES, RC4) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
## Gestion des Secrets
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
## Gestion des Erreurs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Pas d'algorithmes faibles (MD5, SHA1, DES) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Séparation des environnements (dev/staging/prod) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Pas d'algorithmes faibles (DES, RC4) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
# Gestion des PII (Personally Identifiable Information)
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Overly permissive chmod
✅ Pas de chmod 777
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
# Sanitization des Entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Nettoyage et normalisation des données utilisateur avant traitement ou stockage.
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
## Ordre des Opérations
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Enregistrement des événements de sécurité pour détection, investigation, forensics, et compliance.
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Validation et sanitization des entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Sécurité des APIs (REST, GraphQL)
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Protection des données (PII, GDPR)
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Analyser le code pour détecter des failles
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Vérifier la gestion des secrets
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Proposer des patterns sécurisés
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Vérifier le chiffrement des données
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Contrôler la validation des entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Proposer des correctifs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 1. Analyse des Vulnérabilités
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Sécurité des mots de passe
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Gestion des sessions/tokens (JWT)
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Gestion des clés
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 4. Gestion des Secrets
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Rotation des clés/tokens
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 5. Validation des Entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 7. Protection des Données
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Gestion des PII
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Chiffrement des données
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
6. **Constructif** : Proposer des solutions, pas juste critiquer
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Malware type keywords
- Installation de backdoors
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Utiliser des APIs natives plutôt que shell commands
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 3. Paramétrage des Commandes
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
**Utiliser des Arguments**
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Limitation des fonctionnalités disponibles
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
vulnerabilities/command-injection.md:268vulnerabilities/csrf.md:276vulnerabilities/nosql-injection.md:268vulnerabilities/path-traversal.md:244vulnerabilities/sql-injection.md:208vulnerabilities/ssrf.md:265vulnerabilities/xss.md:353vulnerabilities/xxe.md:263
Weak cryptographic algorithm · 8 件
### Validation des Correctifs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Sanitization des inputs (dernier recours) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Attaque forçant un utilisateur authentifié à exécuter des actions non désirées sur une application w
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] GET requests modifient des données ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Validation des tokens côté serveur ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Injection de code malveillant dans les requêtes NoSQL (MongoDB, CouchDB, Redis, etc.), permettant de
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 2. Sanitization des Inputs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Validation de type des paramètres ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Sanitization des operators ($) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
// Whitelist des champs autorisés
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Accès non autorisé à des fichiers et répertoires en dehors du dossier prévu, via manipulation de che
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Séparation des répertoires
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Validation insuffisante des entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Séparation de la structure SQL et des données
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 3. Validation des Entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Échappement des caractères spéciaux SQL
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Séparation des comptes par fonction
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Whitelist stricte des valeurs autorisées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Validation stricte des entrées ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Exploitation permettant à l'attaquant de forcer le serveur à effectuer des requêtes HTTP vers des de
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
1. Application fait des requêtes HTTP basées sur input utilisateur
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
4. Contournement des firewalls et ACLs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Injection de scripts malveillants (JavaScript) dans des pages web, exécutés dans le navigateur de la
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Capture des frappes clavier
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Whitelist des sources autorisées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
**Protection des Cookies**
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Suppression des event handlers
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
// Utiliser des parsers récents avec config sécurisée par défaut
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Whitelist des structures autorisées
Force-confirmed blocker/high static finding; AI dismissal overridden.
リスク要因
🌐 ネットワークアクセス (97)
api-security/cors-configuration.md:29 api-security/cors-configuration.md:91 api-security/cors-configuration.md:97 api-security/cors-configuration.md:124 api-security/cors-configuration.md:125 api-security/cors-configuration.md:171 api-security/cors-configuration.md:173 api-security/cors-configuration.md:232 authentication/oauth-security.md:93 checklists/owasp-top-10.md:101 logging-monitoring/security-logging.md:101 secrets-management/secrets-detection.md:18 vulnerabilities/command-injection.md:60 vulnerabilities/csrf.md:57 vulnerabilities/csrf.md:230 vulnerabilities/csrf.md:40 vulnerabilities/csrf.md:41 vulnerabilities/csrf.md:42 vulnerabilities/csrf.md:48 vulnerabilities/csrf.md:57 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:277 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:352 vulnerabilities/ssrf.md:393 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:353 vulnerabilities/ssrf.md:355 vulnerabilities/ssrf.md:38 vulnerabilities/ssrf.md:39 vulnerabilities/ssrf.md:40 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:59 vulnerabilities/ssrf.md:60 vulnerabilities/ssrf.md:61 vulnerabilities/ssrf.md:286 vulnerabilities/ssrf.md:287 vulnerabilities/ssrf.md:288 vulnerabilities/ssrf.md:289 vulnerabilities/ssrf.md:290 vulnerabilities/ssrf.md:295 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:297 vulnerabilities/ssrf.md:302 vulnerabilities/ssrf.md:303 vulnerabilities/ssrf.md:39 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:164 vulnerabilities/ssrf.md:165 vulnerabilities/ssrf.md:173 vulnerabilities/ssrf.md:174 vulnerabilities/ssrf.md:175 vulnerabilities/ssrf.md:176 vulnerabilities/ssrf.md:177 vulnerabilities/ssrf.md:286 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:297 vulnerabilities/ssrf.md:332 vulnerabilities/ssrf.md:333 vulnerabilities/ssrf.md:334 vulnerabilities/ssrf.md:335 vulnerabilities/ssrf.md:336 vulnerabilities/ssrf.md:337 vulnerabilities/ssrf.md:338 vulnerabilities/ssrf.md:339 vulnerabilities/ssrf.md:352 vulnerabilities/ssrf.md:354 vulnerabilities/ssrf.md:355 vulnerabilities/ssrf.md:75 vulnerabilities/ssrf.md:324 vulnerabilities/ssrf.md:322 vulnerabilities/xss.md:75 vulnerabilities/xxe.md:299 vulnerabilities/xxe.md:300 vulnerabilities/xxe.md:50 vulnerabilities/xxe.md:59 vulnerabilities/xxe.md:65 vulnerabilities/xxe.md:165 vulnerabilities/xxe.md:166 vulnerabilities/xxe.md:167 vulnerabilities/xxe.md:168 vulnerabilities/xxe.md:299 vulnerabilities/xxe.md:300 vulnerabilities/xxe.md:315 vulnerabilities/xxe.md:316 vulnerabilities/xxe.md:317 vulnerabilities/xxe.md:299
📁 ファイルシステムへのアクセス (30)
input-validation/file-upload-security.md:32 input-validation/file-upload-security.md:143 input-validation/sanitization.md:74 input-validation/sanitization.md:75 vulnerabilities/command-injection.md:183 vulnerabilities/command-injection.md:344 vulnerabilities/command-injection.md:99 vulnerabilities/command-injection.md:100 vulnerabilities/path-traversal.md:333 vulnerabilities/path-traversal.md:14 vulnerabilities/path-traversal.md:15 vulnerabilities/path-traversal.md:24 vulnerabilities/path-traversal.md:25 vulnerabilities/path-traversal.md:36 vulnerabilities/path-traversal.md:42 vulnerabilities/path-traversal.md:48 vulnerabilities/path-traversal.md:49 vulnerabilities/path-traversal.md:179 vulnerabilities/path-traversal.md:253 vulnerabilities/path-traversal.md:294 vulnerabilities/path-traversal.md:301 vulnerabilities/path-traversal.md:307 vulnerabilities/path-traversal.md:313 vulnerabilities/path-traversal.md:268 vulnerabilities/path-traversal.md:269 vulnerabilities/path-traversal.md:266 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:285 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:284
🔑 環境変数 (1)
⚙️ 外部コマンド (47)
SKILL.md:54 SKILL.md:61 SKILL.md:70 SKILL.md:77 SKILL.md:84 SKILL.md:91 SKILL.md:98 SKILL.md:105 SKILL.md:111 SKILL.md:188 SKILL.md:189 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:138 vulnerabilities/command-injection.md:325 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:206 vulnerabilities/command-injection.md:326 vulnerabilities/command-injection.md:359 vulnerabilities/command-injection.md:210 vulnerabilities/command-injection.md:335 vulnerabilities/command-injection.md:33 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:29-34 vulnerabilities/command-injection.md:78-79 vulnerabilities/command-injection.md:79-81 vulnerabilities/command-injection.md:221-223 vulnerabilities/command-injection.md:297-299 vulnerabilities/command-injection.md:322-327 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:87 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:32 vulnerabilities/command-injection.md:261 vulnerabilities/command-injection.md:74 vulnerabilities/command-injection.md:75 vulnerabilities/sql-injection.md:34-37 vulnerabilities/sql-injection.md:43-44 vulnerabilities/sql-injection.md:105-110
⚡ スクリプトを含む (32)
vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:39 vulnerabilities/command-injection.md:85 vulnerabilities/command-injection.md:88 vulnerabilities/command-injection.md:92 vulnerabilities/command-injection.md:229 vulnerabilities/command-injection.md:232 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:40 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:233 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:87 vulnerabilities/xss.md:53 vulnerabilities/xss.md:328 vulnerabilities/xss.md:56 vulnerabilities/xss.md:330 vulnerabilities/xss.md:52 vulnerabilities/xss.md:43 vulnerabilities/xss.md:50 vulnerabilities/xss.md:412 vulnerabilities/xss.md:51
監査者: codex
5. Juli 2026, 04:09
The static findings are false positives caused by Markdown security documentation, exploit payload examples, and defensive checklists. I found no executable package code, no credential exfiltration flow, and no prompt injection attempt in the reviewed files.
26
スキャンされたファイル
7,813
解析済み行数
5
レビュー項目
147
誤検知を無視
静的解析の誤検知を無視 (147)
これらの静的マッチはセマンティックレビューで却下されたか、スキーマのみのトークンに一致したため、透明性のために表示されていますが、品質スコアには影響しません。
重大
AWS/Azure metadata endpoint
- [ ] Cloud metadata IPs bloqués (169.254.169.254) ?
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
SSH private key file
id_rsa
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
PHP shell_exec
- shell_exec("command " + input)
Force-confirmed external_commands/critical static finding; AI dismissal overridden.
重大
PHP shell_exec
- [ ] Utilisation de exec(), system(), shell_exec() ?
Force-confirmed external_commands/critical static finding; AI dismissal overridden.
重大
System password file access
Input: && cat /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
Command: command && cat /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access · 2 件
Input: ../../etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
Command: cat /var/app/files/../../etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
→ Lecture de /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- Lecture de fichiers sensibles (/etc/passwd, /etc/shadow)
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Recursive delete on root/home
Input: __import__('os').system('rm -rf /')
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
SSH directory access
- Private keys (.ssh/id_rsa)
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
SSH directory access · 2 件
/root/.ssh/id_rsa
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
SSH private key file
- Private keys (.ssh/id_rsa)
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
SSH private key file · 2 件
/root/.ssh/id_rsa
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
SSH private key file · 2 件
C:\Users\Administrator\.ssh\id_rsa
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
Windows SAM/registry hive access
..\..\..\..\windows\system32\config\sam
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
Windows SAM/registry hive access
C:\Windows\System32\config\sam
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
System password file access
Path: /var/www/files/../../etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
Résultat: /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
../../../etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access · 3 件
/etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access · 2 件
../../etc/passwd%00.jpg
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
....//....//....//etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
..././..././..././etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- /etc/passwd, /etc/shadow
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- [ ] Tester ../../../etc/passwd ?
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access · 2 件
/etc/shadow
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
....//....//etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
..;/..;/etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
..\/..\/..\/etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint · 2 件
http://169.254.169.254/latest/meta-data/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
http://169.254.169.254/latest/user-data/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
http://169.254.169.254/latest/meta-data/iam/security-credentials/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
http://169.254.169.254/metadata/instance?api-version=2021-02-01
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
- [ ] Tester http://169.254.169.254 (metadata) ?
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
http://169.254.169.254.nip.io (wildcard DNS)
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
169.254.169.254 AWS, Azure, GCP
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS/Azure metadata endpoint
- Accès à 169.254.169.254
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
GCP metadata endpoint
http://metadata.google.internal/computeMetadata/v1/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
GCP metadata endpoint
metadata.google.internal
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
Alibaba Cloud metadata endpoint
100.100.100.200 Alibaba Cloud
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
System password file access
file:///etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
### Keylogging
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
GCP metadata endpoint
http://metadata.google.internal/
Force-confirmed network/critical static finding; AI dismissal overridden.
重大
AWS credentials directory
~/.aws/credentials
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
重大
System password file access · 2 件
<!ENTITY xxe SYSTEM "file:///etc/passwd">
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
<!ENTITY % file SYSTEM "file:///etc/passwd">
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- /etc/passwd
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- /etc/shadow
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
System password file access
- [ ] Tester avec file:///etc/passwd ?
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
This combination is common in credential stealers and RATs
Force-confirmed obfuscation/critical static finding; AI dismissal overridden.
重大
[HEURISTIC] DANGEROUS COMBINATION: Network + Credentials + Evasion techniques
This combination suggests data exfiltration with anti-detection
Force-confirmed obfuscation/critical static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Cross-Origin Resource Sharing : mécanisme permettant à des ressources web d'être accédées depuis un
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Indépendant des clients
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Stocker JTI des tokens révoqués
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Rotation des refresh tokens ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Alerter utilisateur des risques
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
# Sécurité des Mots de Passe
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
## Stockage des Mots de Passe
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Expiration des tokens ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Usage unique des tokens ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Accès direct à des objets via identifiant sans vérification d'autorisation.
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
**Séparation des Devoirs**
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Pas d'algorithmes faibles (MD5, SHA1, DES, RC4) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
## Gestion des Secrets
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
## Gestion des Erreurs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Pas d'algorithmes faibles (MD5, SHA1, DES) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Séparation des environnements (dev/staging/prod) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Pas d'algorithmes faibles (DES, RC4) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
# Gestion des PII (Personally Identifiable Information)
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Overly permissive chmod
✅ Pas de chmod 777
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
# Sanitization des Entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Nettoyage et normalisation des données utilisateur avant traitement ou stockage.
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
## Ordre des Opérations
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Enregistrement des événements de sécurité pour détection, investigation, forensics, et compliance.
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Validation et sanitization des entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Sécurité des APIs (REST, GraphQL)
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Protection des données (PII, GDPR)
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Analyser le code pour détecter des failles
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Vérifier la gestion des secrets
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Proposer des patterns sécurisés
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Vérifier le chiffrement des données
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Contrôler la validation des entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Proposer des correctifs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 1. Analyse des Vulnérabilités
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Sécurité des mots de passe
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Gestion des sessions/tokens (JWT)
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Gestion des clés
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 4. Gestion des Secrets
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Rotation des clés/tokens
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 5. Validation des Entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 7. Protection des Données
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Gestion des PII
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Chiffrement des données
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
6. **Constructif** : Proposer des solutions, pas juste critiquer
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Malware type keywords
- Installation de backdoors
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Utiliser des APIs natives plutôt que shell commands
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 3. Paramétrage des Commandes
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
**Utiliser des Arguments**
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Limitation des fonctionnalités disponibles
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
vulnerabilities/command-injection.md:268vulnerabilities/csrf.md:276vulnerabilities/nosql-injection.md:268vulnerabilities/path-traversal.md:244vulnerabilities/sql-injection.md:208vulnerabilities/ssrf.md:265vulnerabilities/xss.md:353vulnerabilities/xxe.md:263
Weak cryptographic algorithm · 8 件
### Validation des Correctifs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Sanitization des inputs (dernier recours) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Attaque forçant un utilisateur authentifié à exécuter des actions non désirées sur une application w
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] GET requests modifient des données ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Validation des tokens côté serveur ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Injection de code malveillant dans les requêtes NoSQL (MongoDB, CouchDB, Redis, etc.), permettant de
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 2. Sanitization des Inputs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Validation de type des paramètres ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Sanitization des operators ($) ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
// Whitelist des champs autorisés
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Accès non autorisé à des fichiers et répertoires en dehors du dossier prévu, via manipulation de che
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Séparation des répertoires
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Validation insuffisante des entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Séparation de la structure SQL et des données
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
### 3. Validation des Entrées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Échappement des caractères spéciaux SQL
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Séparation des comptes par fonction
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Whitelist stricte des valeurs autorisées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- [ ] Validation stricte des entrées ?
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Exploitation permettant à l'attaquant de forcer le serveur à effectuer des requêtes HTTP vers des de
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
1. Application fait des requêtes HTTP basées sur input utilisateur
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
4. Contournement des firewalls et ACLs
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
Injection de scripts malveillants (JavaScript) dans des pages web, exécutés dans le navigateur de la
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Capture des frappes clavier
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Whitelist des sources autorisées
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
**Protection des Cookies**
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Suppression des event handlers
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
// Utiliser des parsers récents avec config sécurisée par défaut
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
Weak cryptographic algorithm
- Whitelist des structures autorisées
Force-confirmed blocker/high static finding; AI dismissal overridden.
リスク要因
🌐 ネットワークアクセス (97)
api-security/cors-configuration.md:29 api-security/cors-configuration.md:91 api-security/cors-configuration.md:97 api-security/cors-configuration.md:124 api-security/cors-configuration.md:125 api-security/cors-configuration.md:171 api-security/cors-configuration.md:173 api-security/cors-configuration.md:232 authentication/oauth-security.md:93 checklists/owasp-top-10.md:101 logging-monitoring/security-logging.md:101 secrets-management/secrets-detection.md:18 vulnerabilities/command-injection.md:60 vulnerabilities/csrf.md:57 vulnerabilities/csrf.md:230 vulnerabilities/csrf.md:40 vulnerabilities/csrf.md:41 vulnerabilities/csrf.md:42 vulnerabilities/csrf.md:48 vulnerabilities/csrf.md:57 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:277 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:352 vulnerabilities/ssrf.md:393 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:353 vulnerabilities/ssrf.md:355 vulnerabilities/ssrf.md:38 vulnerabilities/ssrf.md:39 vulnerabilities/ssrf.md:40 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:54 vulnerabilities/ssrf.md:59 vulnerabilities/ssrf.md:60 vulnerabilities/ssrf.md:61 vulnerabilities/ssrf.md:286 vulnerabilities/ssrf.md:287 vulnerabilities/ssrf.md:288 vulnerabilities/ssrf.md:289 vulnerabilities/ssrf.md:290 vulnerabilities/ssrf.md:295 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:297 vulnerabilities/ssrf.md:302 vulnerabilities/ssrf.md:303 vulnerabilities/ssrf.md:39 vulnerabilities/ssrf.md:46 vulnerabilities/ssrf.md:47 vulnerabilities/ssrf.md:48 vulnerabilities/ssrf.md:51 vulnerabilities/ssrf.md:164 vulnerabilities/ssrf.md:165 vulnerabilities/ssrf.md:173 vulnerabilities/ssrf.md:174 vulnerabilities/ssrf.md:175 vulnerabilities/ssrf.md:176 vulnerabilities/ssrf.md:177 vulnerabilities/ssrf.md:286 vulnerabilities/ssrf.md:296 vulnerabilities/ssrf.md:297 vulnerabilities/ssrf.md:332 vulnerabilities/ssrf.md:333 vulnerabilities/ssrf.md:334 vulnerabilities/ssrf.md:335 vulnerabilities/ssrf.md:336 vulnerabilities/ssrf.md:337 vulnerabilities/ssrf.md:338 vulnerabilities/ssrf.md:339 vulnerabilities/ssrf.md:352 vulnerabilities/ssrf.md:354 vulnerabilities/ssrf.md:355 vulnerabilities/ssrf.md:75 vulnerabilities/ssrf.md:324 vulnerabilities/ssrf.md:322 vulnerabilities/xss.md:75 vulnerabilities/xxe.md:299 vulnerabilities/xxe.md:300 vulnerabilities/xxe.md:50 vulnerabilities/xxe.md:59 vulnerabilities/xxe.md:65 vulnerabilities/xxe.md:165 vulnerabilities/xxe.md:166 vulnerabilities/xxe.md:167 vulnerabilities/xxe.md:168 vulnerabilities/xxe.md:299 vulnerabilities/xxe.md:300 vulnerabilities/xxe.md:315 vulnerabilities/xxe.md:316 vulnerabilities/xxe.md:317 vulnerabilities/xxe.md:299
📁 ファイルシステムへのアクセス (30)
input-validation/file-upload-security.md:32 input-validation/file-upload-security.md:143 input-validation/sanitization.md:74 input-validation/sanitization.md:75 vulnerabilities/command-injection.md:183 vulnerabilities/command-injection.md:344 vulnerabilities/command-injection.md:99 vulnerabilities/command-injection.md:100 vulnerabilities/path-traversal.md:333 vulnerabilities/path-traversal.md:14 vulnerabilities/path-traversal.md:15 vulnerabilities/path-traversal.md:24 vulnerabilities/path-traversal.md:25 vulnerabilities/path-traversal.md:36 vulnerabilities/path-traversal.md:42 vulnerabilities/path-traversal.md:48 vulnerabilities/path-traversal.md:49 vulnerabilities/path-traversal.md:179 vulnerabilities/path-traversal.md:253 vulnerabilities/path-traversal.md:294 vulnerabilities/path-traversal.md:301 vulnerabilities/path-traversal.md:307 vulnerabilities/path-traversal.md:313 vulnerabilities/path-traversal.md:268 vulnerabilities/path-traversal.md:269 vulnerabilities/path-traversal.md:266 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:285 vulnerabilities/xxe.md:286 vulnerabilities/xxe.md:284
🔑 環境変数 (1)
⚙️ 外部コマンド (47)
SKILL.md:54 SKILL.md:61 SKILL.md:70 SKILL.md:77 SKILL.md:84 SKILL.md:91 SKILL.md:98 SKILL.md:105 SKILL.md:111 SKILL.md:188 SKILL.md:189 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:138 vulnerabilities/command-injection.md:325 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:206 vulnerabilities/command-injection.md:326 vulnerabilities/command-injection.md:359 vulnerabilities/command-injection.md:210 vulnerabilities/command-injection.md:335 vulnerabilities/command-injection.md:33 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:29-34 vulnerabilities/command-injection.md:78-79 vulnerabilities/command-injection.md:79-81 vulnerabilities/command-injection.md:221-223 vulnerabilities/command-injection.md:297-299 vulnerabilities/command-injection.md:322-327 vulnerabilities/command-injection.md:30 vulnerabilities/command-injection.md:87 vulnerabilities/command-injection.md:332 vulnerabilities/command-injection.md:32 vulnerabilities/command-injection.md:261 vulnerabilities/command-injection.md:74 vulnerabilities/command-injection.md:75 vulnerabilities/sql-injection.md:34-37 vulnerabilities/sql-injection.md:43-44 vulnerabilities/sql-injection.md:105-110
⚡ スクリプトを含む (32)
vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:39 vulnerabilities/command-injection.md:85 vulnerabilities/command-injection.md:88 vulnerabilities/command-injection.md:92 vulnerabilities/command-injection.md:229 vulnerabilities/command-injection.md:232 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:17 vulnerabilities/command-injection.md:40 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:233 vulnerabilities/command-injection.md:264 vulnerabilities/command-injection.md:43 vulnerabilities/command-injection.md:28 vulnerabilities/command-injection.md:29 vulnerabilities/command-injection.md:31 vulnerabilities/command-injection.md:41 vulnerabilities/command-injection.md:91 vulnerabilities/command-injection.md:180 vulnerabilities/command-injection.md:322 vulnerabilities/command-injection.md:341 vulnerabilities/command-injection.md:87 vulnerabilities/xss.md:53 vulnerabilities/xss.md:328 vulnerabilities/xss.md:56 vulnerabilities/xss.md:330 vulnerabilities/xss.md:52 vulnerabilities/xss.md:43 vulnerabilities/xss.md:50 vulnerabilities/xss.md:412 vulnerabilities/xss.md:51
監査者: codex
28. Juni 2026, 15:16
Static analysis detected many dangerous command, network, filesystem, script, and secret patterns. Manual review found these are primarily security-training examples and audit checklists, not executable code or hidden exfiltration. The skill is publishable with a medium dual-use warning because it documents exploit payloads and sensitive target examples.
26
スキャンされたファイル
7,813
解析済み行数
7
レビュー項目
3
誤検知を無視
確認済みのセキュリティ上の懸念 (1)
中
vulnerabilities/command-injection.md:28-33vulnerabilities/path-traversal.md:14-16vulnerabilities/ssrf.md:46-54vulnerabilities/xxe.md:16vulnerabilities/xss.md:52-56
Dual-use exploit reference content
The skill includes concrete examples of command injection, path traversal, SSRF metadata access, XXE file disclosure, and XSS sink patterns. These are presented as vulnerability examples and audit targets, but they can also help users construct tests or payloads.
The cited files contain explicit exploit patterns, sensitive file targets, and metadata endpoint examples. Context strongly indicates defensive education, so the risk is dual-use rather than malicious.
レビューが必要な検出事項 (1)
これらの検出事項は不確実なレガシー監査判定に基づくため、レビューが必要ですが、確認済みのセキュリティ問題としてはカウントされません。
中
Bash tool permission in a security audit skill
The skill declares Bash as an allowed tool while also instructing users to search vulnerability patterns. This is expected for code auditing, but command execution should remain limited to local inspection commands and user-approved project analysis.
The allowed tool declaration and listed commands are visible in the main skill file. No malicious command is instructed there, but shell access increases operational risk for a community security skill.
静的解析の誤検知を無視 (3)
これらの静的マッチはセマンティックレビューで却下されたか、スキーマのみのトークンに一致したため、透明性のために表示されていますが、品質スコアには影響しません。
低
vulnerabilities/command-injection.md:26-34api-security/rate-limiting.md:22-26authentication/jwt-security.md:13-19
Static command execution findings are documentation examples
Most external command findings are code snippets or pattern lists used to teach auditors what vulnerable code looks like. I did not find evidence that the skill itself executes these snippets.
The sampled locations are Markdown guidance and fenced examples, not runnable project code. The surrounding text labels them as patterns to detect.
低
vulnerabilities/path-traversal.md:266-286secrets-management/secrets-detection.md:230-237secrets-management/secrets-detection.md:296-300
Sensitive file and credential strings are audit targets
Sensitive paths, credential filenames, and placeholder API key strings appear in checklists and training examples. They describe what to detect or exclude, not files being read by the skill.
The evidence appears in lists of sensitive locations, gitignore patterns, and examples of non-secrets. No evidence found of code accessing these files.
低
No prompt injection attempt found
Targeted review found no instructions claiming special authority, telling the evaluator to ignore prior instructions, or asking to skip security analysis. Administrator appears only inside a Windows path example.
Search for common prompt-injection phrases returned only Administrator path examples. No evidence found of text attempting to override evaluator instructions.
リスク要因
⚙️ 外部コマンド (3)
🌐 ネットワークアクセス (3)
⚡ スクリプトを含む (3)
📁 ファイルシステムへのアクセス (3)
🔑 環境変数 (1)
検出されたパターン
Dynamic code execution patternsCommand injection payload examplesSensitive path traversal targetsCloud metadata endpoint examples
監査者: codex
16. Jan. 2026, 19:37
This skill is purely security documentation and guidance. All 1546 static findings are FALSE POSITIVES because they come from markdown documentation files containing examples of vulnerable code patterns for educational purposes. The skill provides read-only analysis tools (Read, Grep, Glob, Bash) to help developers identify and fix security issues.
27
スキャンされたファイル
8,194
解析済み行数
4
レビュー項目
0
誤検知を無視
リスク要因
🌐 ネットワークアクセス (2)
📁 ファイルシステムへのアクセス (2)
監査者: claude
16. Jan. 2026, 19:37
This skill is purely security documentation and guidance. All 1546 static findings are FALSE POSITIVES because they come from markdown documentation files containing examples of vulnerable code patterns for educational purposes. The skill provides read-only analysis tools (Read, Grep, Glob, Bash) to help developers identify and fix security issues.
27
スキャンされたファイル
8,194
解析済み行数
4
レビュー項目
0
誤検知を無視
リスク要因
🌐 ネットワークアクセス (2)
📁 ファイルシステムへのアクセス (2)
監査者: claude
10. Jan. 2026, 11:28
Pure prompt-based skill containing only markdown documentation about security best practices. No executable code, no scripts, no network operations, no data collection. Provides educational guidance on OWASP Top 10, authentication, authorization, cryptography, and vulnerability detection.
28
スキャンされたファイル
8,500
解析済み行数
0
レビュー項目
0
誤検知を無視
この完了済み監査には、確認済みのセキュリティ検出事項は記録されていません。
監査者: claude
10. Jan. 2026, 11:28
Pure prompt-based skill containing only markdown documentation about security best practices. No executable code, no scripts, no network operations, no data collection. Provides educational guidance on OWASP Top 10, authentication, authorization, cryptography, and vulnerability detection.
28
スキャンされたファイル
8,500
解析済み行数
0
レビュー項目
0
誤検知を無視
この完了済み監査には、確認済みのセキュリティ検出事項は記録されていません。
監査者: claude
10. Jan. 2026, 11:28
Pure prompt-based skill containing only markdown documentation about security best practices. No executable code, no scripts, no network operations, no data collection. Provides educational guidance on OWASP Top 10, authentication, authorization, cryptography, and vulnerability detection.
28
スキャンされたファイル
8,500
解析済み行数
0
レビュー項目
0
誤検知を無視
この完了済み監査には、確認済みのセキュリティ検出事項は記録されていません。
監査者: claude