📦
Audit-Verlauf
oil-ui - 2 Audits
Versionsvergleich
Änderungen an Fähigkeiten und Befunden über geprüfte Versionen hinweg, neueste zuerst.
Audit-Version 2 Neueste
5. Okt. 2026, 04:08
Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.
24
Gescannte Dateien
3,794
Analysierte Zeilen
9
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (2)
Hoch
Stored Manifest Commands Can Trigger Agent Execution
The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.
The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.
Mittel
scripts/build_explorer.py:22-26scripts/build_explorer.py:144-147assets/style-explorer.html:206-208references/style-explorer.md:44
Interactive Preview Navigation Bypasses Claimed Network Isolation
Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.
The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.
Elemente der Fähigkeitsprüfung (2)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Hoch
Python subprocess.run
result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,
Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.
Mittel
Synchronous file operations
res.end(readFileSync(local));
The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.
Risikofaktoren
⚡ Enthält Skripte (5)
⚙️ Externe Befehle (50)
assets/style-explorer.html:144 assets/style-explorer.html:145 assets/style-explorer.html:147 assets/style-explorer.html:154 assets/style-explorer.html:189 assets/style-explorer.html:195-218 assets/style-explorer.html:218 assets/style-explorer.html:230-232 assets/style-explorer.html:232-233 assets/style-explorer.html:233-254 assets/style-explorer.html:254-270 assets/style-explorer.html:270 assets/style-explorer.html:272-286 assets/style-explorer.html:286-298 assets/style-explorer.html:298-308 assets/style-explorer.html:308-314 assets/style-explorer.html:314-324 assets/style-explorer.html:324-329 assets/style-explorer.html:329 assets/style-explorer.html:143 assets/style-explorer.html:174 assets/style-explorer.html:192 assets/style-explorer.html:193 assets/style-explorer.html:196 assets/style-explorer.html:197 assets/style-explorer.html:220 assets/style-explorer.html:237 assets/style-explorer.html:240 assets/style-explorer.html:248 assets/style-explorer.html:249 assets/style-explorer.html:252 assets/style-explorer.html:256 assets/style-explorer.html:257 assets/style-explorer.html:258 assets/style-explorer.html:260 assets/style-explorer.html:264 assets/style-explorer.html:275 assets/style-explorer.html:280 assets/style-explorer.html:282 assets/style-explorer.html:283 assets/style-explorer.html:285 assets/style-explorer.html:286 assets/style-explorer.html:287 assets/style-explorer.html:298 assets/style-explorer.html:308 assets/style-explorer.html:314 assets/style-explorer.html:315 assets/style-explorer.html:316 assets/style-explorer.html:321 assets/style-explorer.html:322
🌐 Netzwerkzugriff (50)
assets/style-explorer.html:172 assets/style-explorer.html:112 assets/vendor/alpine.min.js:1 assets/vendor/alpine.min.js:6 README.en.md:40 README.en.md:31 README.md:31 scripts/build_explorer.py:277 scripts/build_explorer.py:266 scripts/check_update.py:109 scripts/check_update.py:275 scripts/check_update.py:23 scripts/check_update.py:110 scripts/check_update.py:111 scripts/check_update.py:28 scripts/check_update.py:236 scripts/check_update.py:244 scripts/recommend_once.py:13 scripts/shoot.mjs:169 scripts/shoot.mjs:86 scripts/shoot.mjs:100 scripts/shoot.mjs:99 scripts/shoot.mjs:100 SKILL.md:70 SKILL.md:96 tests/test_build_explorer.py:73 tests/test_build_explorer.py:121 tests/test_build_explorer.py:175 tests/test_build_explorer.py:180 tests/test_build_explorer.py:186 tests/test_build_explorer.py:196 tests/test_build_explorer.py:197 tests/test_build_explorer.py:198 tests/test_build_explorer.py:232 tests/test_build_explorer.py:240 tests/test_build_explorer.py:252 tests/test_build_explorer.py:268 tests/test_build_explorer.py:269 tests/test_build_explorer.py:280 tests/test_build_explorer.py:296 tests/test_build_explorer.py:197 tests/test_build_explorer.py:269 tests/test_build_explorer.py:280 tests/test_build_explorer.py:232 tests/test_check_update.py:89 tests/test_check_update.py:108 tests/test_check_update.py:217 tests/test_check_update.py:319 tests/test_check_update.py:388 tests/test_check_update.py:58
📁 Dateisystemzugriff (44)
assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:94 scripts/shoot.mjs:245 scripts/shoot.mjs:293 scripts/shoot.mjs:298 scripts/shoot.mjs:313 scripts/shoot.mjs:330 scripts/shoot.mjs:336 scripts/shoot.mjs:386 scripts/shoot.mjs:59 scripts/shoot.mjs:79 scripts/shoot.mjs:6 scripts/shoot.mjs:128 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:66 tests/test_check_update.py:69 tests/test_check_update.py:70 tests/test_check_update.py:84 tests/test_check_update.py:206 tests/test_check_update.py:285 tests/test_shoot.py:171 tests/test_shoot.py:192 tests/test_shoot.py:9 tests/test_shoot.py:99 tests/test_shoot.py:166
🔑 Umgebungsvariablen (34)
scripts/check_update.py:28 scripts/check_update.py:56 scripts/check_update.py:58 scripts/check_update.py:74 scripts/check_update.py:76 scripts/check_update.py:81 scripts/check_update.py:131 scripts/check_update.py:148 scripts/check_update.py:150 scripts/check_update.py:173 scripts/check_update.py:206 scripts/check_update.py:254 scripts/recommend_once.py:20 scripts/recommend_once.py:22 scripts/shoot.mjs:114 scripts/shoot.mjs:115 scripts/shoot.mjs:116 scripts/shoot.mjs:105 scripts/shoot.mjs:105 scripts/shoot.mjs:114 scripts/shoot.mjs:115 scripts/shoot.mjs:116 tests/test_check_update.py:22 tests/test_check_update.py:103 tests/test_check_update.py:106 tests/test_check_update.py:23 tests/test_check_update.py:156 tests/test_check_update.py:161 tests/test_check_update.py:23 tests/test_check_update.py:156 tests/test_check_update.py:161 tests/test_shoot.py:19 tests/test_shoot.py:28 tests/test_shoot.py:120
Geprüft von: codex
4. Okt. 2026, 14:41
Most alerts are benign JavaScript syntax, image data, Chinese documentation, and negative test fixtures. Confirmed risks include unpinned automatic updates, inherited secrets, and unsafe preview input handling. Release-note trust and selector interpolation add injection risks; no evidence of intentional malware was found.
24
Gescannte Dateien
3,676
Analysierte Zeilen
13
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (2)
Hoch
Untrusted Release Notes Enter Agent Instructions
Remote release notes are copied into updater notices after minimal trimming. SKILL.md tells agents to relay these notices, creating a prompt-injection channel.
The remote notes flow directly into output the agent consumes. No embedded attack was found, but the source-to-instruction trust boundary is explicit.
Mittel
Selector Interpolation Allows Browser Code Injection
The type action inserts its selector directly into a quoted JavaScript error message. Crafted quotes can execute unintended code in the inspected page.
The querySelector argument is serialized, but the same selector is interpolated without escaping in the error string. An isolated expression check confirmed injection.
Elemente der Fähigkeitsprüfung (6)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Hoch
Python subprocess.run
result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,
The updater runs npx -y against an unpinned GitHub CLI and replaces the installed skill without fresh consent. Compromised upstream code could execute locally.
Hoch
Python environment access
env = {**os.environ, "CI": "1"}
The updater copies every environment variable into the unpinned downloaded CLI process. This exposes unrelated credentials to code outside the audited package.
Hoch
Synchronous file operations
res.end(readFileSync(local));
The server reads files after a string-prefix containment check, which accepts sibling directories and follows escaping symlinks. Local requests can disclose files outside the preview root.
Hoch
Ruby/shell backtick execution
版本检查:!`sh "${CLAUDE_SKILL_DIR}/scripts/check_update.sh" 2>/dev/null || true`
This is a real host command hook, not ordinary Markdown formatting. Loading the skill can trigger unpinned remote CLI execution through check_update.sh.
Mittel
Synchronous file operations
writeFileSync(file, Buffer.from(data, "base64"));
Screenshot paths incorporate unchecked --states values at lines 358-359 and 366. Parent-directory segments can escape the output directory and overwrite writable PNG files.
Mittel
Synchronous file operations
writeFileSync(tmp, html);
The generated sheet includes unescaped state labels from line 284, then opens the HTML at line 292. Crafted labels can execute scripts or load external resources.
Risikofaktoren
⚡ Enthält Skripte (5)
⚙️ Externe Befehle (50)
assets/style-explorer.html:144 assets/style-explorer.html:145 assets/style-explorer.html:147 assets/style-explorer.html:154 assets/style-explorer.html:189 assets/style-explorer.html:195-218 assets/style-explorer.html:218 assets/style-explorer.html:230-232 assets/style-explorer.html:232-233 assets/style-explorer.html:233-254 assets/style-explorer.html:254-270 assets/style-explorer.html:270 assets/style-explorer.html:272-286 assets/style-explorer.html:286-298 assets/style-explorer.html:298-308 assets/style-explorer.html:308-314 assets/style-explorer.html:314-324 assets/style-explorer.html:324-329 assets/style-explorer.html:329 assets/style-explorer.html:143 assets/style-explorer.html:174 assets/style-explorer.html:192 assets/style-explorer.html:193 assets/style-explorer.html:196 assets/style-explorer.html:197 assets/style-explorer.html:220 assets/style-explorer.html:237 assets/style-explorer.html:240 assets/style-explorer.html:248 assets/style-explorer.html:249 assets/style-explorer.html:252 assets/style-explorer.html:256 assets/style-explorer.html:257 assets/style-explorer.html:258 assets/style-explorer.html:260 assets/style-explorer.html:264 assets/style-explorer.html:275 assets/style-explorer.html:280 assets/style-explorer.html:282 assets/style-explorer.html:283 assets/style-explorer.html:285 assets/style-explorer.html:286 assets/style-explorer.html:287 assets/style-explorer.html:298 assets/style-explorer.html:308 assets/style-explorer.html:314 assets/style-explorer.html:315 assets/style-explorer.html:316 assets/style-explorer.html:321 assets/style-explorer.html:322
🌐 Netzwerkzugriff (50)
assets/style-explorer.html:172 assets/style-explorer.html:112 assets/vendor/alpine.min.js:1 assets/vendor/alpine.min.js:6 README.en.md:40 README.en.md:31 README.md:31 scripts/build_explorer.py:277 scripts/build_explorer.py:266 scripts/check_update.py:101 scripts/check_update.py:268 scripts/check_update.py:21 scripts/check_update.py:102 scripts/check_update.py:103 scripts/check_update.py:26 scripts/check_update.py:235 scripts/check_update.py:243 scripts/recommend_once.py:13 scripts/shoot.mjs:161 scripts/shoot.mjs:82 scripts/shoot.mjs:92 scripts/shoot.mjs:91 scripts/shoot.mjs:92 SKILL.md:70 SKILL.md:96 tests/test_build_explorer.py:73 tests/test_build_explorer.py:121 tests/test_build_explorer.py:175 tests/test_build_explorer.py:180 tests/test_build_explorer.py:186 tests/test_build_explorer.py:196 tests/test_build_explorer.py:197 tests/test_build_explorer.py:198 tests/test_build_explorer.py:232 tests/test_build_explorer.py:240 tests/test_build_explorer.py:252 tests/test_build_explorer.py:268 tests/test_build_explorer.py:269 tests/test_build_explorer.py:280 tests/test_build_explorer.py:296 tests/test_build_explorer.py:197 tests/test_build_explorer.py:269 tests/test_build_explorer.py:280 tests/test_build_explorer.py:232 tests/test_check_update.py:83 tests/test_check_update.py:97 tests/test_check_update.py:169 tests/test_check_update.py:271 tests/test_check_update.py:339 tests/test_check_update.py:52
📁 Dateisystemzugriff (40)
assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:89 scripts/shoot.mjs:237 scripts/shoot.mjs:284 scripts/shoot.mjs:289 scripts/shoot.mjs:304 scripts/shoot.mjs:321 scripts/shoot.mjs:327 scripts/shoot.mjs:377 scripts/shoot.mjs:76 scripts/shoot.mjs:6 scripts/shoot.mjs:120 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:60 tests/test_check_update.py:63 tests/test_check_update.py:64 tests/test_check_update.py:78 tests/test_check_update.py:159 tests/test_check_update.py:237 tests/test_shoot.py:9 tests/test_shoot.py:99
🔑 Umgebungsvariablen (29)
scripts/check_update.py:26 scripts/check_update.py:48 scripts/check_update.py:50 scripts/check_update.py:66 scripts/check_update.py:68 scripts/check_update.py:73 scripts/check_update.py:145 scripts/check_update.py:147 scripts/check_update.py:170 scripts/check_update.py:177 scripts/check_update.py:203 scripts/check_update.py:250 scripts/recommend_once.py:20 scripts/recommend_once.py:22 scripts/shoot.mjs:106 scripts/shoot.mjs:107 scripts/shoot.mjs:108 scripts/shoot.mjs:97 scripts/shoot.mjs:97 scripts/shoot.mjs:106 scripts/shoot.mjs:107 scripts/shoot.mjs:108 tests/test_check_update.py:92 tests/test_check_update.py:95 tests/test_check_update.py:287 tests/test_check_update.py:288 tests/test_shoot.py:19 tests/test_shoot.py:28 tests/test_shoot.py:120
Geprüft von: codex