📦
Historial de auditorías
codex-pet - 1 auditoría
Versión de auditoría 1 Más reciente
1 nov 2026, 14:40
All 83 static alerts are false positives involving Markdown, ordinary commands, documentation links, configuration paths, or authentication terminology. One semantic risk remains: customizable names lack path validation before artifact creation and installation. No evidence found of malicious prompt injection or credential theft; the documented workflow sends the source image to RunComfy.
1
Archivos escaneados
348
Líneas analizadas
5
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (1)
Medio
Configurable Names Can Escape Artifact Directories
PET_NAME is appended to working and installation paths without rejecting separators or parent segments. A crafted name can redirect artifact writes outside intended roots and overwrite matching filenames.
Both paths directly interpolate the configurable name without validation or containment checks. The default name is safe; exploitation requires a crafted replacement.
Factores de riesgo
⚙️ Comandos externos (50)
SKILL.md:7 SKILL.md:13 SKILL.md:15 SKILL.md:28 SKILL.md:30-32 SKILL.md:32-36 SKILL.md:36-40 SKILL.md:40 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47 SKILL.md:49 SKILL.md:51-55 SKILL.md:55-93 SKILL.md:93-94 SKILL.md:94 SKILL.md:95 SKILL.md:100-105 SKILL.md:105 SKILL.md:111-129 SKILL.md:129-135 SKILL.md:135-145 SKILL.md:145-153 SKILL.md:153-202 SKILL.md:202-210 SKILL.md:210-224 SKILL.md:224-228 SKILL.md:228-237 SKILL.md:237-241 SKILL.md:241-246 SKILL.md:246-256 SKILL.md:256-273 SKILL.md:273 SKILL.md:274 SKILL.md:275 SKILL.md:276 SKILL.md:282 SKILL.md:284 SKILL.md:292 SKILL.md:298-303 SKILL.md:303 SKILL.md:309-315 SKILL.md:315 SKILL.md:320-326 SKILL.md:326-330 SKILL.md:330 SKILL.md:334 SKILL.md:338 SKILL.md:342 SKILL.md:343-345
🌐 Acceso a red (6)
📁 Acceso al sistema de archivos (14)
🔑 Variables de entorno (2)
Auditado por: codex