📦
Historial de auditorías
revdoku - 1 auditoría
Versión de auditoría 1 Más reciente
8 sept 2026, 08:19
The skill is a static-site publishing CLI with legitimate network, filesystem, and credential operations; most pattern matches are benign documentation, exclusions, or quoted shell usage. Publication is not recommended without remediation because the documented installer executes unverified remote code, and the CLI has credential and repository-binding trust-boundary weaknesses. Static review was capped at 400/670 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
3
Archivos escaneados
3,321
Líneas analizadas
9
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (5)
Crítico
Pipe to shell pattern
curl -fsSL https://revdoku.com/install.sh | bash
The documentation instructs users to download an installer over HTTPS and execute it directly with bash. The downloaded script is not pinned or verified before execution.
Crítico
Unverified remote bootstrap execution
The installer downloads the Revdoku executable and marks it executable without verifying a signature or checksum. The documentation also directs users to execute a remotely fetched installer through bash.
The script download and executable permission change are direct, and no integrity verification is present in the cited bootstrap path.
Alto
Bearer token can be sent to a caller-selected origin
The CLI accepts a configurable service URL and sends the saved API key as a Bearer token in requests. An untrusted URL setting can therefore redirect credentials to another origin.
The cited configuration and authenticated request code establish the credential flow. Exploitation depends on an attacker influencing the URL setting or command environment.
Alto
Repository binding can retarget destructive publishing
A project-local .revdoku file supplies a bucket identifier, and publication requests delete missing files. Publishing an untrusted checkout can therefore modify or remove content in a bucket accessible to the user.
The local binding is read without an interactive target confirmation, and the cited publish payload requests deletion of absent files. Exploitation requires valid credentials and a user-initiated publish.
Medio
Existing credentials file permissions are not repaired
Saving an API key sets a restrictive umask but does not explicitly chmod an existing credentials file. A previously permissive file can retain its permissions after being overwritten with a new key.
The cited save routine establishes umask but lacks a permission repair step. The exposure requires an existing file with insecure mode on a shared system.
Factores de riesgo
⚙️ Comandos externos (50)
bin/revdoku:11 bin/revdoku:78 bin/revdoku:186 bin/revdoku:344 bin/revdoku:407 bin/revdoku:432 bin/revdoku:433 bin/revdoku:459 bin/revdoku:460 bin/revdoku:461 bin/revdoku:489 bin/revdoku:935 bin/revdoku:1015 bin/revdoku:1016 bin/revdoku:1017 bin/revdoku:1018 bin/revdoku:1020 bin/revdoku:1021 bin/revdoku:1022 bin/revdoku:1028 bin/revdoku:1172 bin/revdoku:1189 bin/revdoku:1667 bin/revdoku:2686 bin/revdoku:7 bin/revdoku:12 bin/revdoku:19 bin/revdoku:55 bin/revdoku:339 bin/revdoku:389 bin/revdoku:430 bin/revdoku:443 bin/revdoku:451 bin/revdoku:456 bin/revdoku:466 bin/revdoku:470 bin/revdoku:471 bin/revdoku:472 bin/revdoku:501 bin/revdoku:558 bin/revdoku:559 bin/revdoku:560 bin/revdoku:561 bin/revdoku:734 bin/revdoku:741 bin/revdoku:749 bin/revdoku:754 bin/revdoku:755 bin/revdoku:772 bin/revdoku:773
🌐 Acceso a red (15)
📁 Acceso al sistema de archivos (50)
bin/revdoku:1665 bin/revdoku:5 bin/revdoku:14 bin/revdoku:464 bin/revdoku:466 bin/revdoku:1665 bin/revdoku:19 bin/revdoku:97 bin/revdoku:442 bin/revdoku:470 bin/revdoku:471 bin/revdoku:472 bin/revdoku:493 bin/revdoku:710 bin/revdoku:770 bin/revdoku:791 bin/revdoku:792 bin/revdoku:793 bin/revdoku:794 bin/revdoku:795 bin/revdoku:882 bin/revdoku:883 bin/revdoku:887 bin/revdoku:898 bin/revdoku:923 bin/revdoku:924 bin/revdoku:926 bin/revdoku:927 bin/revdoku:929 bin/revdoku:930 bin/revdoku:965 bin/revdoku:977 bin/revdoku:1125 bin/revdoku:1263 bin/revdoku:1266 bin/revdoku:1279 bin/revdoku:1343 bin/revdoku:1344 bin/revdoku:1345 bin/revdoku:1372 bin/revdoku:1373 bin/revdoku:1605 bin/revdoku:1606 bin/revdoku:1610 bin/revdoku:1627 bin/revdoku:1630 bin/revdoku:1631 bin/revdoku:1632 bin/revdoku:1670 bin/revdoku:1673
🔑 Variables de entorno (28)
bin/revdoku:26 bin/revdoku:169 bin/revdoku:196 bin/revdoku:449 bin/revdoku:450 bin/revdoku:451 bin/revdoku:452 bin/revdoku:455 bin/revdoku:704 bin/revdoku:743 bin/revdoku:908 bin/revdoku:917 bin/revdoku:1088 bin/revdoku:1090 bin/revdoku:1142 bin/revdoku:1145 bin/revdoku:1163 bin/revdoku:1167 bin/revdoku:1191 bin/revdoku:1200 bin/revdoku:1211 bin/revdoku:1258 bin/revdoku:1266 bin/revdoku:1475 bin/revdoku:1477 bin/revdoku:1669 bin/revdoku:1685 bin/revdoku:2696
Patrones detectados
Pipe to shell pattern
Auditado por: claude