Habilidades brag-doc-from-git Historial de auditorías
📦

Historial de auditorías

brag-doc-from-git - 2 auditorías

Comparación de versiones

Cambios de capacidades y hallazgos entre versiones auditadas, primero las más recientes.

VersiónFechaResultadoElementos de revisiónCambio vs anterior
v2 Más reciente22 oct 2026, 19:12 1 confirmado0Sin cambios de capacidad
v1 17 oct 2026, 19:42 1 confirmado0Base

22 oct 2026, 19:12

All six static findings are false positives from Markdown delimiters, inline examples, or legitimate review-writing instructions. The authenticated GitHub search lacks repository filters and can retrieve private repository metadata outside the user-approved scope. No evidence found of malicious intent, credential theft, destructive commands, or audit-directed prompt injection.

1
Archivos escaneados
50
Líneas analizadas
2
Elementos de revisión
0
Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Medio
Authenticated Search Exceeds Approved Repository Scope
The GitHub CLI search filters by author and merge date but not repository. It can retrieve private PR metadata from unnamed repositories, contradicting the explicit access restriction.
Line 19 has no repository filter despite the access restriction on line 24. Actual exposure depends on authenticated account permissions and matching PRs.

Factores de riesgo

Auditado por: codex

17 oct 2026, 19:42

All six static findings are false positives involving Markdown formatting, read-only history queries, or ordinary prose. The GitHub search lacks repository filters and can return private repository metadata outside the named scope, despite an explicit prohibition. No evidence found of malicious exfiltration, destructive commands, or prompt injection.

1
Archivos escaneados
50
Líneas analizadas
2
Elementos de revisión
0
Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Medio
GitHub Search Exceeds Named Repository Scope
The command uses --author @me without repository filters, so it can retrieve titles, URLs, and repository names from unnamed private repositories. This conflicts with the instruction to avoid unnamed private repositories and risks including unauthorized metadata in the draft.
The documented command contains no repository filter, while line 24 explicitly restricts private repository access. Actual exposure depends on authenticated access and matching history.

Factores de riesgo

Auditado por: codex