📦
Historial de auditorías
teardown - 1 auditoría
Versión de auditoría 1 Más reciente
31 oct 2026, 14:11
No evidence found of keylogging, credential theft, or prompt injection in the reviewed context; most alerts match benign syntax and metadata. Confirmed risks include URL-controlled caption injection and unrestricted recursive deletion through the contact-sheet name. The 394 omitted static matches remain unreviewed and require manual review before automatic publication. Static review was capped at 400/794 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
58
Archivos escaneados
9,645
Líneas analizadas
8
Elementos de revisión
0
Falsos positivos ignorados
Elementos de revisión de capacidades (3)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
innerHTML assignment (XSS risk)
storyEl.innerHTML = `<div class="cap ${cur.kind || 'hero'}">
runtime.js merges URL-supplied story configuration into captions. Unescaped tag, text, and kind values reach innerHTML, allowing scripts through injected HTML event handlers.
Alto
Node.js fs operations
fs.rmSync(dir, {recursive: true, force: true});
The unchecked --name value reaches recursive, forced deletion through path.join(base, name). Parent segments can delete directories outside the sheet output folder.
Medio
Node.js fs operations
fs.mkdirSync(dir, {recursive: true});
The unchecked --name also controls this directory and subsequent frame writes. Parent segments permit output creation outside the intended sheet folder.
Factores de riesgo
🌐 Acceso a red (36)
package-lock.json:21 package-lock.json:37 package-lock.json:53 package-lock.json:69 package-lock.json:85 package-lock.json:101 package-lock.json:117 package-lock.json:133 package-lock.json:149 package-lock.json:165 package-lock.json:181 package-lock.json:197 package-lock.json:213 package-lock.json:229 package-lock.json:245 package-lock.json:261 package-lock.json:277 package-lock.json:293 package-lock.json:309 package-lock.json:325 package-lock.json:341 package-lock.json:357 package-lock.json:373 package-lock.json:389 package-lock.json:405 package-lock.json:421 package-lock.json:437 package-lock.json:441 package-lock.json:446 package-lock.json:450 package-lock.json:455 package-lock.json:496 package-lock.json:510 package-lock.json:528 package-lock.json:540 SKILL.md:144
⚙️ Comandos externos (50)
paths.mjs:14 paths.mjs:16 sfx/dsp.py:208 sfx/dsp.py:424 sfx/synth.py:28 sfx/synth.py:4 sfx/synth.py:6 sheet.mjs:12 sheet.mjs:43 sheet.mjs:88 sheet.mjs:19 sheet.mjs:71 sheet.mjs:92 sheet.mjs:93 sheet.mjs:95-97 sheet.mjs:101 sheet.mjs:114 sheet.mjs:119 sheet.mjs:126 sheet.mjs:127 sims/beats.py:35 sims/build.mjs:30 sims/build.mjs:33 sims/build.mjs:37 sims/build.mjs:46 sims/build.mjs:57 sims/build.mjs:79 sims/build.mjs:112-131 sims/build.mjs:132 sims/build.mjs:134 sims/build.mjs:140 sims/capture.mjs:20 sims/capture.mjs:57 sims/capture.mjs:159 sims/capture.mjs:181 sims/capture.mjs:201 sims/capture.mjs:59 sims/capture.mjs:32 sims/capture.mjs:40 sims/capture.mjs:43 sims/capture.mjs:55 sims/capture.mjs:66 sims/capture.mjs:99 sims/capture.mjs:108 sims/capture.mjs:149 sims/capture.mjs:150 sims/capture.mjs:160 sims/capture.mjs:163 sims/capture.mjs:171 sims/capture.mjs:192
🔑 Variables de entorno (20)
paths.mjs:10 paths.mjs:11 paths.mjs:12 paths.mjs:15 paths.mjs:17 paths.mjs:26 paths.mjs:10 paths.mjs:11 paths.mjs:12 paths.mjs:15 paths.mjs:17 paths.mjs:26 sfx/__main__.py:49 sfx/score_kit.py:33 sims/beats.py:24 sims/build.mjs:103 sims/build.mjs:103 sims/cessna-shared/score.py:16 sims/strandbeest-shared/score.py:17 sims/v8-shared/score.py:16
📁 Acceso al sistema de archivos (50)
sfx/mix.py:104 sfx/mix.py:102 sheet.mjs:51 sheet.mjs:85 sheet.mjs:86 sheet.mjs:37 sheet.mjs:51 sims/beats.py:204 sims/beats.py:203 sims/build.mjs:25 sims/build.mjs:32 sims/build.mjs:35 sims/build.mjs:38 sims/build.mjs:63 sims/build.mjs:111 sims/build.mjs:133 sims/build.mjs:137 sims/build.mjs:138 sims/build.mjs:139 sims/build.mjs:44 sims/build.mjs:55 sims/build.mjs:56 sims/build.mjs:63 sims/build.mjs:111 sims/build.mjs:139 sims/build.mjs:32 sims/build.mjs:35 sims/build.mjs:38 sims/build.mjs:63 sims/build.mjs:111 sims/build.mjs:133 sims/build.mjs:138 sims/build.mjs:20 sims/capture.mjs:47 sims/capture.mjs:56 sims/capture.mjs:61 sims/capture.mjs:67 sims/capture.mjs:112 sims/capture.mjs:138 sims/capture.mjs:209 sims/capture.mjs:42 sims/capture.mjs:58 sims/capture.mjs:47 sims/capture.mjs:61 sims/capture.mjs:112 sims/capture.mjs:24 sims/capture.mjs:69 sims/cessna-film/main.js:1 sims/cessna-film/main.js:2 sims/cessna-live/main.js:1
⚡ Contiene scripts (42)
sims/capture.mjs:57 sims/cessna-shared/console.js:29 sims/cessna-shared/console.js:149 sims/cessna-shared/console.js:218 sims/cessna-shared/console.js:235 sims/cessna-shared/console.js:258 sims/cessna-shared/console.js:282 sims/cessna-shared/console.js:283 sims/cessna-shared/live.js:334 sims/kit/director.js:237 sims/kit/director.js:123 sims/kit/hud.js:130 sims/kit/hud.js:150 sims/kit/hud.js:160 sims/kit/hud.js:181 sims/kit/hud.js:13 sims/strandbeest-shared/console.js:48 sims/strandbeest-shared/console.js:272 sims/strandbeest-shared/console.js:286 sims/strandbeest-shared/console.js:302 sims/strandbeest-shared/console.js:321 sims/strandbeest-shared/console.js:332 sims/strandbeest-shared/console.js:363 sims/strandbeest-shared/console.js:364 sims/strandbeest-shared/console.js:370 sims/strandbeest-shared/live.js:404 sims/v8-shared/console.js:26 sims/v8-shared/console.js:184 sims/v8-shared/console.js:189 sims/v8-shared/console.js:199 sims/v8-shared/console.js:229 sims/v8-shared/console.js:234 sims/v8-shared/console.js:235 sims/v8-shared/console.js:238 sims/v8-shared/console.js:268 sims/v8-shared/console.js:269 sims/v8-shared/console.js:273 sims/v8-shared/console.js:285 sims/v8-shared/console.js:300 sims/v8-shared/console.js:333 sims/v8-shared/console.js:334 sims/v8-shared/live.js:358
Auditado por: codex