Historial de auditorías

agent-desktop - 1 auditoría

31 oct 2026, 14:11

All 67 static findings are benign documentation matches, including Markdown backticks, keystroke delivery, local session storage, and loopback CDP endpoints. One semantic finding concerns pointer dispatch after inconclusive hit tests, which can misdirect input despite visibility checks. No evidence found of credential theft, covert keylogging, external exfiltration, or audit-directed prompt injection in the five reviewed files.

Archivos escaneados

846

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Medio

references/commands-interaction.md:71-74

Pointer Delivery Proceeds After Inconclusive Hit Tests

The documentation states that receives_events fails open when a hit test is inconclusive. Pointer input can reach an obscuring control or window, causing unintended actions or disclosure of typed data.

The reference explicitly states that unknown hit-test results still dispatch input. The implementation was not supplied, so this finding concerns documented behavior.

Factores de riesgo

⚙️ Comandos externos (33)

🌐 Acceso a red (3)

references/commands-system.md:33 references/commands-system.md:33 references/commands-system.md:34

📁 Acceso al sistema de archivos (8)

references/commands-system.md:110 references/commands-system.md:168 references/commands-system.md:110 references/commands-system.md:168 references/commands-system.md:10 references/commands-system.md:102 references/commands-system.md:104 references/commands-system.md:105

Auditado por: codex

← Volver a la habilidad