Habilidades wan-2-7 Historial de auditorías
📦

Historial de auditorías

wan-2-7 - 1 auditoría

1 nov 2026, 14:40

All 48 static findings are false positives involving Markdown, legitimate service links, placeholder syntax, credential storage documentation, or model routing. A separate concern is unsafe prompt substitution into shell examples despite a blanket claim that prompt content cannot cause shell injection. No evidence found of malicious intent; CLI privacy and security claims cannot be verified from this documentation-only package.

1
Archivos escaneados
186
Líneas analizadas
4
Elementos de revisión
0
Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Medio
Unsafe Prompt Substitution in Shell Examples
Examples place prompt placeholders inside single-quoted shell arguments, while line 182 states: "No shell injection surface from prompt content." Direct substitution of untrusted prompt text containing a single quote can escape the argument and execute shell syntax before the CLI receives JSON.
The shell templates and blanket assurance are directly visible. Exploitation depends on unsafe substitution by the calling agent; no CLI implementation is included.
Auditado por: codex