📦
Historique des audits
video-extend - 1 audit
Version de l’audit 1 Dernier
1 nov. 2026, 14:40
All 52 static findings concern Markdown formatting, documented service links, standard credential storage, or endpoint recommendations rather than demonstrated malicious behavior. One semantic issue concerns misleading shell-safety guidance: JSON serialization alone does not safely quote arbitrary prompts for the illustrated Bash commands. No evidence found of credential exfiltration or instructions attempting to override the audit.
1
Fichiers analysés
156
Lignes analysées
4
Éléments à examiner
0
Faux positifs ignorés
Préoccupations de sécurité confirmées (1)
Moyen
Incomplete Shell-Quoting Safety Guidance
The claim "No shell-injection surface" overlooks Bash parsing before the CLI receives JSON. Directly inserting prompts containing apostrophes into the illustrated single-quoted argument could terminate quoting and enable command injection.
The examples use single-quoted JSON without shell-escaping guidance, while the safety claim relies on CLI behavior after shell parsing. Exploitability depends on agent substitution behavior.
Facteurs de risque
⚙️ Commandes externes (29)
SKILL.md:7 SKILL.md:8 SKILL.md:23 SKILL.md:29-40 SKILL.md:40-42 SKILL.md:42-50 SKILL.md:50-55 SKILL.md:55-66 SKILL.md:66 SKILL.md:67-71 SKILL.md:71-78 SKILL.md:78-93 SKILL.md:93-97 SKILL.md:97-105 SKILL.md:105 SKILL.md:106-107 SKILL.md:107 SKILL.md:116 SKILL.md:135 SKILL.md:139 SKILL.md:140 SKILL.md:141 SKILL.md:142-145 SKILL.md:145 SKILL.md:147 SKILL.md:151-152 SKILL.md:152-153 SKILL.md:153-154 SKILL.md:154-155
🌐 Accès réseau (19)
📁 Accès au système de fichiers (2)
Audité par: codex