📦

Audit-Verlauf

routeros-qemu-chr - 2 Audits

Audit-Version 2

Neueste Niedriges Risiko

Apr 16, 2026, 09:11 PM

Documentation and reference skill for running RouterOS CHR in QEMU. Static analysis flagged 343 patterns, but evaluation reveals these are false positives: shell backtick notation in markdown code examples (not execution), sudo in GitHub Actions CI (expected), MD5 references in kernel history docs (not actual usage), and legitimate acceleration detection commands. All network access targets MikroTik infrastructure for downloading CHR images. Risk level set to LOW due to external command patterns in documentation examples, but no actual malicious code present.

5
Gescannte Dateien
794
Analysierte Zeilen
12
befunde
claude
Auditiert von

Probleme mit hohem Risiko (4)

Documentation Shell Examples Misidentified as Execution
Static scanner flagged 264 instances of Ruby/shell backtick notation. These are markdown code blocks showing shell command syntax, not actual command execution. Files are documentation with command examples.
sudo Commands in GitHub Actions CI (Expected Behavior)
GitHub Actions workflow uses sudo for package installation (apt-get install). This is standard CI/CD practice, not privilege escalation risk.
nohup for Background QEMU Process (Legitimate Use)
nohup is used to run QEMU in background during CI testing. This is standard practice for running VMs in CI environments.
Base64 HTTP Basic Auth (Standard Practice)
Static scanner flagged btoa('admin:') as weak crypto. This is standard HTTP Basic Auth encoding, not cryptographic weakness.
Probleme mit mittlerem Risiko (3)
Network Access to External URLs
Skill downloads CHR images from MikroTik infrastructure. URLs point to download.mikrotik.com and cdn.mikrotik.com for official RouterOS images.
Device File Access for Virtualization
/dev/kvm access for KVM acceleration detection. This is standard practice for virtualization tooling.
Temp Directory Access
/tmp used for QEMU vars files, serial sockets, and log files. Standard temp file usage for VM management.
Probleme mit niedrigem Risiko (2)
Hardcoded IP Addresses (Localhost)
127.0.0.1 used for RouterOS REST API and port forwarding. Standard localhost addressing.
System Information Commands (Acceleration Detection)
uname, sysctl, and stat commands used for platform detection. Standard virtualization tooling practice.

Audit-Version 1

Sicher

Mar 30, 2026, 02:11 AM

Static analysis detected 303 potential security issues in code examples and documentation. All findings are false positives: external commands are legitimate QEMU invocations for virtualization, network operations access official MikroTik servers, and filesystem operations are standard QEMU configuration patterns. No malicious intent detected.

4
Gescannte Dateien
668
Analysierte Zeilen
3
befunde
claude
Auditiert von
Keine Sicherheitsprobleme gefunden