📦
監査履歴
install-anti-slop - 2 監査
バージョン比較
監査済みバージョン間の機能と検出結果の変化（新しい順）。
監査バージョン 2 最新
2026年8月15日 08:23
All 49 static findings are false positives caused by TypeScript imports, template literals, AST property names, or Markdown formatting. Semantic review found two medium risks: unchecked installer destinations and installation of unpinned current dependency versions.
21
スキャンされたファイル
2,354
解析済み行数
4
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (2)
中
Installer Allows Destinations Outside the Repository
The installer resolves an unchecked destination argument against the current directory. Absolute paths or parent traversal can target files outside the repository, and --force permits overwrites.
The argument reaches path.resolve without a containment check before mkdirSync and cpSync. The code directly confirms the out-of-repository write behavior.
中
Installation Uses Unpinned Current Dependency Versions
The procedure tells agents to discover and install current package versions. Results can change between runs and expose users immediately to a compromised upstream release.
The instructions explicitly query current versions and install them. The named packages are legitimate, but the workflow lacks a reviewed version pin or integrity check.
リスク要因
⚙️ 外部コマンド (36)
assets/anti-slop/rules/no-known-value-widening.ts:143 assets/anti-slop/rules/no-known-value-widening.ts:181 assets/anti-slop/rules/no-known-value-widening.ts:189 assets/anti-slop/rules/no-known-value-widening.ts:197 assets/anti-slop/rules/no-known-value-widening.ts:209 assets/anti-slop/rules/no-known-value-widening.ts:218 assets/anti-slop/rules/no-known-value-widening.ts:226 assets/anti-slop/rules/no-object-parameters.ts:46 assets/anti-slop/rules/no-reflect-apply.ts:15 assets/anti-slop/rules/no-reflect-get.ts:15 assets/anti-slop/rules/no-runtime-typeof.ts:36 assets/anti-slop/rules/no-unknown-parameters.ts:48 assets/anti-slop/rules/no-unknown-parameters.ts:52 assets/anti-slop/rules/no-unknown-returns.ts:36 assets/anti-slop/rules/no-unknown-type-aliases.ts:25 assets/anti-slop/rules/require-safety-comment-for-type-assertion.ts:48 scripts/install.mjs:14 scripts/install.mjs:20 scripts/install.mjs:21 SKILL.md:14 SKILL.md:15 SKILL.md:16 SKILL.md:21-23 SKILL.md:23-25 SKILL.md:25 SKILL.md:28 SKILL.md:30 SKILL.md:33 SKILL.md:35-53 SKILL.md:53-57 SKILL.md:57 SKILL.md:59-61 SKILL.md:61-79 SKILL.md:79-81 SKILL.md:81-91 SKILL.md:91
📁 ファイルシステムへのアクセス (6)
監査者: codex
2026年8月15日 08:23
All 49 static findings are false positives caused by TypeScript imports, template literals, AST property names, or Markdown formatting. Semantic review found two medium risks: unchecked installer destinations and installation of unpinned current dependency versions.
21
スキャンされたファイル
2,354
解析済み行数
4
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (2)
中
Installer Allows Destinations Outside the Repository
The installer resolves an unchecked destination argument against the current directory. Absolute paths or parent traversal can target files outside the repository, and --force permits overwrites.
The argument reaches path.resolve without a containment check before mkdirSync and cpSync. The code directly confirms the out-of-repository write behavior.
中
Installation Uses Unpinned Current Dependency Versions
The procedure tells agents to discover and install current package versions. Results can change between runs and expose users immediately to a compromised upstream release.
The instructions explicitly query current versions and install them. The named packages are legitimate, but the workflow lacks a reviewed version pin or integrity check.
リスク要因
⚙️ 外部コマンド (36)
assets/anti-slop/rules/no-known-value-widening.ts:143 assets/anti-slop/rules/no-known-value-widening.ts:181 assets/anti-slop/rules/no-known-value-widening.ts:189 assets/anti-slop/rules/no-known-value-widening.ts:197 assets/anti-slop/rules/no-known-value-widening.ts:209 assets/anti-slop/rules/no-known-value-widening.ts:218 assets/anti-slop/rules/no-known-value-widening.ts:226 assets/anti-slop/rules/no-object-parameters.ts:46 assets/anti-slop/rules/no-reflect-apply.ts:15 assets/anti-slop/rules/no-reflect-get.ts:15 assets/anti-slop/rules/no-runtime-typeof.ts:36 assets/anti-slop/rules/no-unknown-parameters.ts:48 assets/anti-slop/rules/no-unknown-parameters.ts:52 assets/anti-slop/rules/no-unknown-returns.ts:36 assets/anti-slop/rules/no-unknown-type-aliases.ts:25 assets/anti-slop/rules/require-safety-comment-for-type-assertion.ts:48 scripts/install.mjs:14 scripts/install.mjs:20 scripts/install.mjs:21 SKILL.md:14 SKILL.md:15 SKILL.md:16 SKILL.md:21-23 SKILL.md:23-25 SKILL.md:25 SKILL.md:28 SKILL.md:30 SKILL.md:33 SKILL.md:35-53 SKILL.md:53-57 SKILL.md:57 SKILL.md:59-61 SKILL.md:61-79 SKILL.md:79-81 SKILL.md:81-91 SKILL.md:91
📁 ファイルシステムへのアクセス (6)
監査者: codex