Compétences video-extend Historique des audits
📦

Historique des audits

video-extend - 1 audit

1 nov. 2026, 14:40

All 52 static findings concern Markdown formatting, documented service links, standard credential storage, or endpoint recommendations rather than demonstrated malicious behavior. One semantic issue concerns misleading shell-safety guidance: JSON serialization alone does not safely quote arbitrary prompts for the illustrated Bash commands. No evidence found of credential exfiltration or instructions attempting to override the audit.

1
Fichiers analysés
156
Lignes analysées
4
Éléments à examiner
0
Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Moyen
Incomplete Shell-Quoting Safety Guidance
The claim "No shell-injection surface" overlooks Bash parsing before the CLI receives JSON. Directly inserting prompts containing apostrophes into the illustrated single-quoted argument could terminate quoting and enable command injection.
The examples use single-quoted JSON without shell-escaping guidance, while the safety claim relies on CLI behavior after shell parsing. Exploitability depends on agent substitution behavior.
Audité par: codex