📦
Historique des audits
oil-ui - 2 audits
Comparaison des versions
Évolution des capacités et des constats entre les versions auditées, les plus récentes en premier.
Version de l’audit 2 Dernier
5 oct. 2026, 04:08
Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.
24
Fichiers analysés
3,794
Lignes analysées
9
Éléments à examiner
0
Faux positifs ignorés
Préoccupations de sécurité confirmées (2)
Élevé
Stored Manifest Commands Can Trigger Agent Execution
The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.
The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.
Moyen
scripts/build_explorer.py:22-26scripts/build_explorer.py:144-147assets/style-explorer.html:206-208references/style-explorer.md:44
Interactive Preview Navigation Bypasses Claimed Network Isolation
Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.
The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.
Éléments d’évaluation des capacités (2)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
Élevé
Python subprocess.run
result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,
Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.
Moyen
Synchronous file operations
res.end(readFileSync(local));
The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.
Facteurs de risque
⚡ Contient des scripts (5)
⚙️ Commandes externes (50)
assets/style-explorer.html:144 assets/style-explorer.html:145 assets/style-explorer.html:147 assets/style-explorer.html:154 assets/style-explorer.html:189 assets/style-explorer.html:195-218 assets/style-explorer.html:218 assets/style-explorer.html:230-232 assets/style-explorer.html:232-233 assets/style-explorer.html:233-254 assets/style-explorer.html:254-270 assets/style-explorer.html:270 assets/style-explorer.html:272-286 assets/style-explorer.html:286-298 assets/style-explorer.html:298-308 assets/style-explorer.html:308-314 assets/style-explorer.html:314-324 assets/style-explorer.html:324-329 assets/style-explorer.html:329 assets/style-explorer.html:143 assets/style-explorer.html:174 assets/style-explorer.html:192 assets/style-explorer.html:193 assets/style-explorer.html:196 assets/style-explorer.html:197 assets/style-explorer.html:220 assets/style-explorer.html:237 assets/style-explorer.html:240 assets/style-explorer.html:248 assets/style-explorer.html:249 assets/style-explorer.html:252 assets/style-explorer.html:256 assets/style-explorer.html:257 assets/style-explorer.html:258 assets/style-explorer.html:260 assets/style-explorer.html:264 assets/style-explorer.html:275 assets/style-explorer.html:280 assets/style-explorer.html:282 assets/style-explorer.html:283 assets/style-explorer.html:285 assets/style-explorer.html:286 assets/style-explorer.html:287 assets/style-explorer.html:298 assets/style-explorer.html:308 assets/style-explorer.html:314 assets/style-explorer.html:315 assets/style-explorer.html:316 assets/style-explorer.html:321 assets/style-explorer.html:322
🌐 Accès réseau (50)
assets/style-explorer.html:172 assets/style-explorer.html:112 assets/vendor/alpine.min.js:1 assets/vendor/alpine.min.js:6 README.en.md:40 README.en.md:31 README.md:31 scripts/build_explorer.py:277 scripts/build_explorer.py:266 scripts/check_update.py:109 scripts/check_update.py:275 scripts/check_update.py:23 scripts/check_update.py:110 scripts/check_update.py:111 scripts/check_update.py:28 scripts/check_update.py:236 scripts/check_update.py:244 scripts/recommend_once.py:13 scripts/shoot.mjs:169 scripts/shoot.mjs:86 scripts/shoot.mjs:100 scripts/shoot.mjs:99 scripts/shoot.mjs:100 SKILL.md:70 SKILL.md:96 tests/test_build_explorer.py:73 tests/test_build_explorer.py:121 tests/test_build_explorer.py:175 tests/test_build_explorer.py:180 tests/test_build_explorer.py:186 tests/test_build_explorer.py:196 tests/test_build_explorer.py:197 tests/test_build_explorer.py:198 tests/test_build_explorer.py:232 tests/test_build_explorer.py:240 tests/test_build_explorer.py:252 tests/test_build_explorer.py:268 tests/test_build_explorer.py:269 tests/test_build_explorer.py:280 tests/test_build_explorer.py:296 tests/test_build_explorer.py:197 tests/test_build_explorer.py:269 tests/test_build_explorer.py:280 tests/test_build_explorer.py:232 tests/test_check_update.py:89 tests/test_check_update.py:108 tests/test_check_update.py:217 tests/test_check_update.py:319 tests/test_check_update.py:388 tests/test_check_update.py:58
📁 Accès au système de fichiers (44)
assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:94 scripts/shoot.mjs:245 scripts/shoot.mjs:293 scripts/shoot.mjs:298 scripts/shoot.mjs:313 scripts/shoot.mjs:330 scripts/shoot.mjs:336 scripts/shoot.mjs:386 scripts/shoot.mjs:59 scripts/shoot.mjs:79 scripts/shoot.mjs:6 scripts/shoot.mjs:128 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:66 tests/test_check_update.py:69 tests/test_check_update.py:70 tests/test_check_update.py:84 tests/test_check_update.py:206 tests/test_check_update.py:285 tests/test_shoot.py:171 tests/test_shoot.py:192 tests/test_shoot.py:9 tests/test_shoot.py:99 tests/test_shoot.py:166
🔑 Variables d’environnement (34)
scripts/check_update.py:28 scripts/check_update.py:56 scripts/check_update.py:58 scripts/check_update.py:74 scripts/check_update.py:76 scripts/check_update.py:81 scripts/check_update.py:131 scripts/check_update.py:148 scripts/check_update.py:150 scripts/check_update.py:173 scripts/check_update.py:206 scripts/check_update.py:254 scripts/recommend_once.py:20 scripts/recommend_once.py:22 scripts/shoot.mjs:114 scripts/shoot.mjs:115 scripts/shoot.mjs:116 scripts/shoot.mjs:105 scripts/shoot.mjs:105 scripts/shoot.mjs:114 scripts/shoot.mjs:115 scripts/shoot.mjs:116 tests/test_check_update.py:22 tests/test_check_update.py:103 tests/test_check_update.py:106 tests/test_check_update.py:23 tests/test_check_update.py:156 tests/test_check_update.py:161 tests/test_check_update.py:23 tests/test_check_update.py:156 tests/test_check_update.py:161 tests/test_shoot.py:19 tests/test_shoot.py:28 tests/test_shoot.py:120
Audité par: codex
4 oct. 2026, 14:41
Most alerts are benign JavaScript syntax, image data, Chinese documentation, and negative test fixtures. Confirmed risks include unpinned automatic updates, inherited secrets, and unsafe preview input handling. Release-note trust and selector interpolation add injection risks; no evidence of intentional malware was found.
24
Fichiers analysés
3,676
Lignes analysées
13
Éléments à examiner
0
Faux positifs ignorés
Préoccupations de sécurité confirmées (2)
Élevé
Untrusted Release Notes Enter Agent Instructions
Remote release notes are copied into updater notices after minimal trimming. SKILL.md tells agents to relay these notices, creating a prompt-injection channel.
The remote notes flow directly into output the agent consumes. No embedded attack was found, but the source-to-instruction trust boundary is explicit.
Moyen
Selector Interpolation Allows Browser Code Injection
The type action inserts its selector directly into a quoted JavaScript error message. Crafted quotes can execute unintended code in the inspected page.
The querySelector argument is serialized, but the same selector is interpolated without escaping in the error string. An isolated expression check confirmed injection.
Éléments d’évaluation des capacités (6)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
Élevé
Python subprocess.run
result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,
The updater runs npx -y against an unpinned GitHub CLI and replaces the installed skill without fresh consent. Compromised upstream code could execute locally.
Élevé
Python environment access
env = {**os.environ, "CI": "1"}
The updater copies every environment variable into the unpinned downloaded CLI process. This exposes unrelated credentials to code outside the audited package.
Élevé
Synchronous file operations
res.end(readFileSync(local));
The server reads files after a string-prefix containment check, which accepts sibling directories and follows escaping symlinks. Local requests can disclose files outside the preview root.
Élevé
Ruby/shell backtick execution
版本检查:!`sh "${CLAUDE_SKILL_DIR}/scripts/check_update.sh" 2>/dev/null || true`
This is a real host command hook, not ordinary Markdown formatting. Loading the skill can trigger unpinned remote CLI execution through check_update.sh.
Moyen
Synchronous file operations
writeFileSync(file, Buffer.from(data, "base64"));
Screenshot paths incorporate unchecked --states values at lines 358-359 and 366. Parent-directory segments can escape the output directory and overwrite writable PNG files.
Moyen
Synchronous file operations
writeFileSync(tmp, html);
The generated sheet includes unescaped state labels from line 284, then opens the HTML at line 292. Crafted labels can execute scripts or load external resources.
Facteurs de risque
⚡ Contient des scripts (5)
⚙️ Commandes externes (50)
assets/style-explorer.html:144 assets/style-explorer.html:145 assets/style-explorer.html:147 assets/style-explorer.html:154 assets/style-explorer.html:189 assets/style-explorer.html:195-218 assets/style-explorer.html:218 assets/style-explorer.html:230-232 assets/style-explorer.html:232-233 assets/style-explorer.html:233-254 assets/style-explorer.html:254-270 assets/style-explorer.html:270 assets/style-explorer.html:272-286 assets/style-explorer.html:286-298 assets/style-explorer.html:298-308 assets/style-explorer.html:308-314 assets/style-explorer.html:314-324 assets/style-explorer.html:324-329 assets/style-explorer.html:329 assets/style-explorer.html:143 assets/style-explorer.html:174 assets/style-explorer.html:192 assets/style-explorer.html:193 assets/style-explorer.html:196 assets/style-explorer.html:197 assets/style-explorer.html:220 assets/style-explorer.html:237 assets/style-explorer.html:240 assets/style-explorer.html:248 assets/style-explorer.html:249 assets/style-explorer.html:252 assets/style-explorer.html:256 assets/style-explorer.html:257 assets/style-explorer.html:258 assets/style-explorer.html:260 assets/style-explorer.html:264 assets/style-explorer.html:275 assets/style-explorer.html:280 assets/style-explorer.html:282 assets/style-explorer.html:283 assets/style-explorer.html:285 assets/style-explorer.html:286 assets/style-explorer.html:287 assets/style-explorer.html:298 assets/style-explorer.html:308 assets/style-explorer.html:314 assets/style-explorer.html:315 assets/style-explorer.html:316 assets/style-explorer.html:321 assets/style-explorer.html:322
🌐 Accès réseau (50)
assets/style-explorer.html:172 assets/style-explorer.html:112 assets/vendor/alpine.min.js:1 assets/vendor/alpine.min.js:6 README.en.md:40 README.en.md:31 README.md:31 scripts/build_explorer.py:277 scripts/build_explorer.py:266 scripts/check_update.py:101 scripts/check_update.py:268 scripts/check_update.py:21 scripts/check_update.py:102 scripts/check_update.py:103 scripts/check_update.py:26 scripts/check_update.py:235 scripts/check_update.py:243 scripts/recommend_once.py:13 scripts/shoot.mjs:161 scripts/shoot.mjs:82 scripts/shoot.mjs:92 scripts/shoot.mjs:91 scripts/shoot.mjs:92 SKILL.md:70 SKILL.md:96 tests/test_build_explorer.py:73 tests/test_build_explorer.py:121 tests/test_build_explorer.py:175 tests/test_build_explorer.py:180 tests/test_build_explorer.py:186 tests/test_build_explorer.py:196 tests/test_build_explorer.py:197 tests/test_build_explorer.py:198 tests/test_build_explorer.py:232 tests/test_build_explorer.py:240 tests/test_build_explorer.py:252 tests/test_build_explorer.py:268 tests/test_build_explorer.py:269 tests/test_build_explorer.py:280 tests/test_build_explorer.py:296 tests/test_build_explorer.py:197 tests/test_build_explorer.py:269 tests/test_build_explorer.py:280 tests/test_build_explorer.py:232 tests/test_check_update.py:83 tests/test_check_update.py:97 tests/test_check_update.py:169 tests/test_check_update.py:271 tests/test_check_update.py:339 tests/test_check_update.py:52
📁 Accès au système de fichiers (40)
assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:89 scripts/shoot.mjs:237 scripts/shoot.mjs:284 scripts/shoot.mjs:289 scripts/shoot.mjs:304 scripts/shoot.mjs:321 scripts/shoot.mjs:327 scripts/shoot.mjs:377 scripts/shoot.mjs:76 scripts/shoot.mjs:6 scripts/shoot.mjs:120 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:60 tests/test_check_update.py:63 tests/test_check_update.py:64 tests/test_check_update.py:78 tests/test_check_update.py:159 tests/test_check_update.py:237 tests/test_shoot.py:9 tests/test_shoot.py:99
🔑 Variables d’environnement (29)
scripts/check_update.py:26 scripts/check_update.py:48 scripts/check_update.py:50 scripts/check_update.py:66 scripts/check_update.py:68 scripts/check_update.py:73 scripts/check_update.py:145 scripts/check_update.py:147 scripts/check_update.py:170 scripts/check_update.py:177 scripts/check_update.py:203 scripts/check_update.py:250 scripts/recommend_once.py:20 scripts/recommend_once.py:22 scripts/shoot.mjs:106 scripts/shoot.mjs:107 scripts/shoot.mjs:108 scripts/shoot.mjs:97 scripts/shoot.mjs:97 scripts/shoot.mjs:106 scripts/shoot.mjs:107 scripts/shoot.mjs:108 tests/test_check_update.py:92 tests/test_check_update.py:95 tests/test_check_update.py:287 tests/test_check_update.py:288 tests/test_shoot.py:19 tests/test_shoot.py:28 tests/test_shoot.py:120
Audité par: codex