Dieser Bericht ist nicht in der angeforderten Sprache verfügbar. Stattdessen wird der maßgebliche englische Bericht angezeigt.
Versionierte Sicherheitsbewertung
Berichts-ID: SA-73B58AAF
9/20/2026, 9:08:34 PM
agy-worker Sicherheitsbewertung v8
Zertifizierungsbericht zur Skill-Sicherheit
Scanner-Version 3.0.0 Auditmodell: codex Zuletzt veröffentlichter Bericht
- Skillname
- agy-worker
- Version
- v0.21.0
- Betreuer
- cagdasyurekli
- Abdeckung
- 92 Gescannte Dateien · 39,230 Analysierte Zeilen
- Richtlinienversion
- skillstore-security-audit-policy-v1
Höchster bestätigter Schweregrad eines Befunds
Hoch
7 bestätigte Sicherheitsbefunde erfordern Aufmerksamkeit.
Installationskontext
Überprüfen Sie die aktuelle Skill-Seite
Diese Seite fasst nur die Berichtsnachweise zusammen. Die Skill-Seite enthält den maßgeblichen Installationshinweis.
Aktuelle Skill-Seite öffnenDieser Bericht blockiert oder autorisiert weder das Manifest noch die ZIP-Datei.
Most static matches are benign implementation, validation, documentation, schema, or control-character checks. Confirmed risks include provider and verifier execution, environment inheritance, keychain handling, settings access, and non-sandboxed provider authority. Static review was capped at 400/991 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Position melden
Zuletzt veröffentlichter Bericht
„Zuletzt“ bezieht sich auf die Berichtsreihenfolge, nicht auf die Aktualität des Artefakts.
Audit-Nachweis
Aktive Attestierung
Für genau diesen Bericht ist eine öffentliche Attestierung verfügbar.
Menschliche Überprüfung
Nicht überprüft
Für diesen Bericht ist keine menschliche Überprüfung verzeichnet.
Abdeckung
92 Gescannte Dateien · 39,230 Analysierte Zeilen
57 Elemente zur Überprüfung angezeigt
Einschränkungen
Dieser Bericht beansprucht keine Laufzeit- oder Sandbox-Ausführung und beweist nicht das Fehlen von Nebenwirkungen.
Beweiskette
Folgen Sie den Nachweisen von der Quellenbindung bis zum Installationsvertrag. Verfügbare Nachweise unterstützen die Überprüfung; sie sind keine Sicherheitsgarantie.
Quelle
An Commit und Pfad gebunden
Artefakt
An Inhalts- und Baum-Hashes gebunden
Prüfung
Vollständig
Beobachtete Funktionen
„Beobachtet“ bedeutet, dass dieser Bericht unterstützende Nachweise erfasst hat. Nicht erfasst bedeutet nicht, dass eine Fähigkeit nicht vorhanden ist.
Enthält Skripte
Kann mit dem Skill enthaltenen Code ausführen.
An 22 Nachweisstellen beobachtet
Netzwerkzugriff
Kann eine Verbindung zu externen Diensten herstellen.
An 43 Nachweisstellen beobachtet
Dateisystemzugriff
Kann lokale Dateien lesen oder schreiben.
An 50 Nachweisstellen beobachtet
Umgebungsvariablen
Kann Werte aus der Prozessumgebung lesen.
An 15 Nachweisstellen beobachtet
Externe Befehle
Kann Befehle oder Programme außerhalb des Skills aufrufen.
An 86 Nachweisstellen beobachtet
Elemente der Fähigkeitsprüfung (50)
Hoch
Hidden file in home directory
p = os.path.expanduser("~/.gemini/antigravity-cli/settings.json")
The account-phase helper expands and reads the user settings file under ~/.gemini. This accesses provider configuration that may contain sensitive permissions or account settings.
Hoch
Process spawn
return spawn(job, "initial", resume=False, foreground=True)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Process spawn
return spawn(job, "initial", resume=False, foreground=False)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Process spawn
return spawn(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Process spawn
return spawn(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python os.exec variants
os.execvpe(command[0], command, dict(os.environ))
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.Popen
child = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.Popen
controller_process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.Popen
process = subprocess.Popen(argv, cwd=cwd, env=git_env(), stdin=subprocess.DEVNULL, stdout=subprocess
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
return subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
provider_checked = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
canonical_checked = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
result = subprocess.run(command, cwd=cwd, env=git_env(), stdin=subprocess.DEVNULL, stdout=subprocess
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
completed = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
completed = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
return subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
proc = subprocess.run(verify_cmd, check=False)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Hoch
Python subprocess.run
fin_proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Mittel
Hidden file access
p = os.path.expanduser("~/.gemini/antigravity-cli/settings.json")
The account-phase helper expands and reads the user settings file under ~/.gemini. This accesses provider configuration that may contain sensitive permissions or account settings.
Mittel
Unix shell invocation
/bin/bash -c "${verify_specs[$i]}"
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Mittel
Unix shell invocation
/bin/bash -c "${verify_specs[$i]}"
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Mittel
Unix shell invocation
SCRIPT_SHELLS = frozenset({"/bin/bash", "/bin/sh"})
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Mittel
Unix shell invocation
"/bin/sh", "-c", supervisor, "bounded-git-supervisor",
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Mittel
Unix shell invocation
"/bin/bash",
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Niedrig
Python environment access
environment = os.environ.copy()
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
if name in os.environ:
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
(os.fsencode(name), b"\0", os.fsencode(os.environ[name]), b"\0")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
os.execvpe(command[0], command, dict(os.environ))
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
environment = os.environ.copy()
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
environment = {name: os.environ[name] for name in allowed if name in os.environ}
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
configured = os.environ.get("XDG_STATE_HOME")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
home_text = os.environ.get("HOME")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
environment = dict(os.environ)
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
env = dict(os.environ)
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
os.environ.get("AGY_WORKER_LOG_DIR") or (state_path.parent / "logs")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Niedrig
Python environment access
os.environ.get("AGY_WORKER_LOG_DIR") or (SCRIPTS.parent / "logs")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Risikofunde
Bestätigte Sicherheitsbedenken werden von Punkten getrennt, die noch überprüft werden müssen.
Bestätigte Sicherheitsbedenken (7)
RISK-001 Hoch
Certificate/key files
keychain_path=prepared.keychain.path if prepared.keychain is not None else None,
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-002 Hoch
Certificate/key files
if prepared.keychain is None or prepared.keychain_preferences is None:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-003 Hoch
Certificate/key files
if _bind_keychain(prepared.keychain.path) != prepared.keychain:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-004 Hoch
Certificate/key files
prepared.keychain_preferences.path, modes={0o600}, limit=MAX_PROFILE_BYTES,
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-005 Hoch
Certificate/key files
) != prepared.keychain_preferences:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-006 Hoch
Certificate/key files
prepared.keychain is not None or prepared.keychain_preferences is not None
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-007 Hoch
External Provider Transmission Without Host Isolation
The skill can transmit a whole disposable worktree to Google or Gemini, while default session mode retains normal user filesystem and network authority without host containment.
The documented workflow explicitly states both the external transmission boundary and the lack of sandbox or native containment in default session mode.
Abhilfemaßnahmen
Von diesem Audit vorgeschlagene Korrekturen wurden erfasst. Ihre Umsetzung liegt in der Verantwortung des Maintainers.
- FIX-001HochDefault session mode gives the provider normal user filesystem and network authority.Prefer native containment when supported, or require a prominent explicit warning and approval before session-mode launches.
- FIX-002HochWhole-worktree dispatch can expose every approved worktree entry to the external provider.Prefer provider scopes, reject secrets and private files before staging, and make whole-worktree approval exceptional.
- FIX-003HochEnvironment inheritance and user settings access can expose credentials or provider permissions.Use strict allowlists, keep credential-like variables excluded, and avoid account-phase settings reads unless explicitly requested.
- FIX-004HochShell-based verification can execute arbitrary command text.Use argv verification by default, require a separate shell acknowledgement, and keep the sanitized environment and working directory boundaries enforced.
- FIX-005MittelStatic review cappedManually review the omitted 591 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-006MittelProvider and verifier processes execute with meaningful local authority.Bind executable identity, arguments, working directory, permissions, and network policy to approval, then revalidate them immediately before launch.
Expertennachweise
Unveränderliche Subjektidentität, Scanner-Metadaten, verworfene Treffer und Nachweise auf Quellcodeebene.
Artefakt-Subjekt
- Marketplace-Commit
- 73b58aaf0aa4d29844f1b4c2acf4f530fc1ae7b9
- Inhalts-Hash
- d3ea0b0a3107d1db6755b07b33b1a691df367ad8e639838b6b22150745db642d
- Tree-Hash
- 613e25dca9696bd64b749aaa4bb4deeef8e7dbe2442b4099aab17f779e2334fb
- Skill-Pfad
- skills/cagdasyurekli/agy-worker
- Hash der Audit-Nutzlast
- 28435a23082dab2da18878aa039d86a9
Analysemetadaten
Auditmodell: codex
Analysestatus: Vollständig
Der Umfang ist auf die aufgezeichneten Dateien, Zeilen, Methoden und Nachweise beschränkt. Es wird keine Ausführung in einer Laufzeitumgebung oder Sandbox beansprucht.
Verifizieren und exportieren
JSON-Bericht Signierte Audit-Bescheinigung CITATION.cff SARIF 2.1.0 Signiertes Installationsmanifest Quelle
Das Manifest und die Lockdatei binden Installationsartefakte an kryptografische Hashes. Diese Integritätsaussage ist von der Sicherheitsbewertung getrennt.
Audit-Nachweis: active