このレポートには指定された言語の翻訳がありません。代わりに正規の英語レポートを表示しています。
バージョン付きセキュリティ評価
レポートID: SA-73B58AAF
9/20/2026, 9:08:34 PM
agy-worker セキュリティ評価 v8
スキルセキュリティ認証レポート
スキャナーバージョン 3.0.0 監査モデル: codex 最新の公開済みレポート
- スキル名
- agy-worker
- バージョン
- v0.21.0
- メンテナー
- cagdasyurekli
- カバレッジ
- 92 スキャンされたファイル · 39,230 解析済み行数
- ポリシーバージョン
- skillstore-security-audit-policy-v1
確認済みの検出結果における最高重大度
高
7 件の確認済みセキュリティ検出結果に対応が必要です。
インストールのコンテキスト
現在のスキルページを確認
このページはレポートの証拠のみを要約しています。正規のインストール勧告は Skill ページで提供されます。
現在のスキルページを開くこのレポートは、マニフェストまたは ZIP をブロックも承認もしません。
Most static matches are benign implementation, validation, documentation, schema, or control-character checks. Confirmed risks include provider and verifier execution, environment inheritance, keychain handling, settings access, and non-sandboxed provider authority. Static review was capped at 400/991 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
レポートの位置
最新の公開済みレポート
「最新」はレポートの順序を指し、アーティファクトの最新性を指すものではありません。
監査アテステーション
有効な証明
この完全に一致するレポートには公開証明があります。
人による検証
未検証
このレポートには人による検証は記録されていません。
カバレッジ
92 スキャンされたファイル · 39,230 解析済み行数
レビュー対象の項目を 57 件表示
制限事項
このレポートはランタイムまたはサンドボックスでの実行を主張するものではなく、副作用がないことを証明するものでもありません。
証拠チェーン
ソースバインディングからインストール契約まで証拠をたどってください。利用可能な証拠は検証を支援しますが、安全性を保証するものではありません。
ソース
コミットとパスにバインド済み
アーティファクト
コンテンツとツリーのハッシュがバインド済み
監査
完了
確認された機能
「確認」とは、このレポートで裏付けとなる証拠が記録されていることを意味します。「記録なし」は、機能が存在しないことを証明するものではありません。
スクリプトを含む
Skillに含まれるコードを実行する場合があります。
22 件の証拠箇所で確認
ネットワークアクセス
外部サービスに接続する場合があります。
43 件の証拠箇所で確認
ファイルシステムへのアクセス
ローカルファイルの読み取りまたは書き込みを行う可能性があります。
50 件の証拠箇所で確認
環境変数
プロセス環境から値を読み取る可能性があります。
15 件の証拠箇所で確認
外部コマンド
Skillの外部にあるコマンドまたはプログラムを呼び出す場合があります。
86 件の証拠箇所で確認
機能レビュー項目 (50)
高
Hidden file in home directory
p = os.path.expanduser("~/.gemini/antigravity-cli/settings.json")
The account-phase helper expands and reads the user settings file under ~/.gemini. This accesses provider configuration that may contain sensitive permissions or account settings.
高
Process spawn
return spawn(job, "initial", resume=False, foreground=True)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Process spawn
return spawn(job, "initial", resume=False, foreground=False)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Process spawn
return spawn(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Process spawn
return spawn(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python os.exec variants
os.execvpe(command[0], command, dict(os.environ))
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.Popen
child = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.Popen
controller_process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.Popen
process = subprocess.Popen(argv, cwd=cwd, env=git_env(), stdin=subprocess.DEVNULL, stdout=subprocess
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
return subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
provider_checked = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
canonical_checked = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
result = subprocess.run(command, cwd=cwd, env=git_env(), stdin=subprocess.DEVNULL, stdout=subprocess
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
completed = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
completed = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
return subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
proc = subprocess.run(verify_cmd, check=False)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
高
Python subprocess.run
fin_proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
中
Hidden file access
p = os.path.expanduser("~/.gemini/antigravity-cli/settings.json")
The account-phase helper expands and reads the user settings file under ~/.gemini. This accesses provider configuration that may contain sensitive permissions or account settings.
中
Unix shell invocation
/bin/bash -c "${verify_specs[$i]}"
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
中
Unix shell invocation
/bin/bash -c "${verify_specs[$i]}"
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
中
Unix shell invocation
SCRIPT_SHELLS = frozenset({"/bin/bash", "/bin/sh"})
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
中
Unix shell invocation
"/bin/sh", "-c", supervisor, "bounded-git-supervisor",
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
中
Unix shell invocation
"/bin/bash",
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
低
Python environment access
environment = os.environ.copy()
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
if name in os.environ:
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
(os.fsencode(name), b"\0", os.fsencode(os.environ[name]), b"\0")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
os.execvpe(command[0], command, dict(os.environ))
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
environment = os.environ.copy()
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
environment = {name: os.environ[name] for name in allowed if name in os.environ}
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
configured = os.environ.get("XDG_STATE_HOME")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
home_text = os.environ.get("HOME")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
environment = dict(os.environ)
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
env = dict(os.environ)
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
os.environ.get("AGY_WORKER_LOG_DIR") or (state_path.parent / "logs")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
低
Python environment access
os.environ.get("AGY_WORKER_LOG_DIR") or (SCRIPTS.parent / "logs")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
リスク指摘
確認済みのセキュリティ上の懸念事項は、引き続きレビューが必要な項目と分けて表示されます。
確認済みのセキュリティ上の懸念 (7)
RISK-001 高
Certificate/key files
keychain_path=prepared.keychain.path if prepared.keychain is not None else None,
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-002 高
Certificate/key files
if prepared.keychain is None or prepared.keychain_preferences is None:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-003 高
Certificate/key files
if _bind_keychain(prepared.keychain.path) != prepared.keychain:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-004 高
Certificate/key files
prepared.keychain_preferences.path, modes={0o600}, limit=MAX_PROFILE_BYTES,
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-005 高
Certificate/key files
) != prepared.keychain_preferences:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-006 高
Certificate/key files
prepared.keychain is not None or prepared.keychain_preferences is not None
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-007 高
External Provider Transmission Without Host Isolation
The skill can transmit a whole disposable worktree to Google or Gemini, while default session mode retains normal user filesystem and network authority without host containment.
The documented workflow explicitly states both the external transmission boundary and the lack of sandbox or native containment in default session mode.
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
- FIX-001高Default session mode gives the provider normal user filesystem and network authority.Prefer native containment when supported, or require a prominent explicit warning and approval before session-mode launches.
- FIX-002高Whole-worktree dispatch can expose every approved worktree entry to the external provider.Prefer provider scopes, reject secrets and private files before staging, and make whole-worktree approval exceptional.
- FIX-003高Environment inheritance and user settings access can expose credentials or provider permissions.Use strict allowlists, keep credential-like variables excluded, and avoid account-phase settings reads unless explicitly requested.
- FIX-004高Shell-based verification can execute arbitrary command text.Use argv verification by default, require a separate shell acknowledgement, and keep the sanitized environment and working directory boundaries enforced.
- FIX-005中Static review cappedManually review the omitted 591 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-006中Provider and verifier processes execute with meaningful local authority.Bind executable identity, arguments, working directory, permissions, and network policy to approval, then revalidate them immediately before launch.
専門家による証拠
不変の対象ID、スキャナーメタデータ、除外された一致項目、およびソースレベルの証拠。
アーティファクト主体
- Marketplace コミット
- 73b58aaf0aa4d29844f1b4c2acf4f530fc1ae7b9
- コンテンツハッシュ
- d3ea0b0a3107d1db6755b07b33b1a691df367ad8e639838b6b22150745db642d
- ツリーハッシュ
- 613e25dca9696bd64b749aaa4bb4deeef8e7dbe2442b4099aab17f779e2334fb
- Skill パス
- skills/cagdasyurekli/agy-worker
- 監査ペイロードハッシュ
- 28435a23082dab2da18878aa039d86a9
分析メタデータ
監査モデル: codex
分析状態: 完了
対象範囲は、記録されたファイル、行、メソッド、および証拠に限定されます。ランタイムまたはサンドボックスでの実行は主張していません。
検証とエクスポート
マニフェストとロックファイルは、インストール成果物を暗号学的ハッシュに結び付けます。この完全性に関する主張は、セキュリティ評価とは別のものです。
監査アテステーション: active