このレポートには指定された言語の翻訳がありません。代わりに正規の英語レポートを表示しています。
バージョン付きセキュリティ評価
レポートID: SA-962DD985
7/6/2026, 12:38:52 PM
ai-runtime-toolkit セキュリティ評価 v7
スキルセキュリティ認証レポート
監査モデル: codex 過去のレポート
- スキル名
- ai-runtime-toolkit
- バージョン
- v7
- メンテナー
- Dwsy
- カバレッジ
- 58 スキャンされたファイル · 6,557 解析済み行数
- ポリシーバージョン
- 利用不可
確認済みの検出結果における最高重大度
重大
10 件の確認済みセキュリティ検出結果に対応が必要です。
インストールのコンテキスト
履歴上の証拠
このレポートは、現在インストール可能な成果物を説明していない可能性があります。インストールに関するガイダンスについては、現在の Skill ページを開いてください。
現在のスキルページを開くこのレポートは、マニフェストまたは ZIP をブロックも承認もしません。
The skill intentionally exposes local tool execution, network checks, and filesystem inspection. Most obfuscation, prompt-injection, path-traversal, and key-file alerts are false positives from documentation or localized text. Real risks remain in remote pipe-to-shell install guidance, privileged install commands, direct .env sourcing, and metadata-driven tool execution.
レポートの位置
過去のレポート
このレポートを使用してインストールする前に、監査履歴を開いてください。
監査アテステーション
証明不可
必要な不変のバインディングは不完全です。
人による検証
未検証
このレポートには人による検証は記録されていません。
カバレッジ
58 スキャンされたファイル · 6,557 解析済み行数
レビュー対象の項目を 114 件表示
制限事項
このレポートはランタイムまたはサンドボックスでの実行を主張するものではなく、副作用がないことを証明するものでもありません。
証拠チェーン
ソースバインディングからインストール契約まで証拠をたどってください。利用可能な証拠は検証を支援しますが、安全性を保証するものではありません。
ソース
バインディングは利用できません
アーティファクト
IDが不完全
監査
完了
確認された機能
「確認」とは、このレポートで裏付けとなる証拠が記録されていることを意味します。「記録なし」は、機能が存在しないことを証明するものではありません。
スクリプトを含む
Skillに含まれるコードを実行する場合があります。
この監査では記録されていません
ネットワークアクセス
外部サービスに接続する場合があります。
38 件の証拠箇所で確認
ファイルシステムへのアクセス
ローカルファイルの読み取りまたは書き込みを行う可能性があります。
72 件の証拠箇所で確認
環境変数
プロセス環境から値を読み取る可能性があります。
1 件の証拠箇所で確認
外部コマンド
Skillの外部にあるコマンドまたはプログラムを呼び出す場合があります。
104 件の証拠箇所で確認
機能レビュー項目 (104)
高
Python subprocess.run
result = subprocess.run(cmd, capture_output=False)
The CLI executes a discovered bundled tool with user-supplied arguments. It avoids shell=True, but still launches local code from a community skill.
高
sudo privilege escalation
sudo apt-get install fzf ripgrep jq
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get install -y gpg wget
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
wget -qO- https://raw.githubusercontent.com/eza-community/eza/main/deb.asc | sudo gpg --dearmor -o /
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
echo "deb http://deb.gierens.de stable main" | sudo tee /etc/apt/sources.list.d/gierens.list
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get update
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get install -y eza
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get install fd-find
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get install bat
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
Hidden file in home directory
ln -s $(which fdfind) ~/.local/bin/fd
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
高
Symlink creation
ln -s $(which fdfind) ~/.local/bin/fd
The example creates a symlink under ~/.local/bin. This changes command resolution in the user PATH and should be performed only with clear consent.
高
sudo privilege escalation
sudo apt-get install bat
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
Hidden file in home directory
## 配置 (添加到 ~/.bashrc)
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
高
sudo privilege escalation
sudo apt-get install -y gpg wget
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
wget -qO- https://raw.githubusercontent.com/eza-community/eza/main/deb.asc | sudo gpg --dearmor -o /
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
echo "deb http://deb.gierens.de stable main" | sudo tee /etc/apt/sources.list.d/gierens.list
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get update
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get install -y eza
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
Hidden file in home directory
## 配置 (添加到 ~/.bashrc)
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
高
sudo privilege escalation
sudo apt-get install fzf
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
Hidden file in home directory
## 进阶配置 (添加到 ~/.bashrc)
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
高
sudo privilege escalation
sudo apt-get install jq
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get install ripgrep
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
Hidden file in home directory
# 添加到 ~/.bashrc
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
高
sudo privilege escalation
sudo apt-get install zoxide
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
Hidden file in home directory
添加到 `~/.bashrc`:
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
高
sudo privilege escalation
sudo apt-get install fzf ripgrep jq bat
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get install fzf ripgrep jq bat
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
高
sudo privilege escalation
sudo apt-get install fzf ripgrep jq bat
The documentation instructs privileged package manager or keyring operations. These commands are legitimate install steps but unsafe for automatic agent execution.
中
Shell command substitution
echo "大小: $(du -h "$LOG_FILE" | cut -f1)"
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
echo "行数: $(wc -l < "$LOG_FILE")"
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
ERROR_COUNT=$(grep -c "ERROR" "$LOG_FILE" 2>/dev/null || echo "0")
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
WARN_COUNT=$(grep -c "WARN" "$LOG_FILE" 2>/dev/null || echo "0")
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
INFO_COUNT=$(grep -c "INFO" "$LOG_FILE" 2>/dev/null || echo "0")
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
DEBUG_COUNT=$(grep -c "DEBUG" "$LOG_FILE" 2>/dev/null || echo "0")
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
MATCH_COUNT=$(grep -c "$PATTERN" "$LOG_FILE" 2>/dev/null || echo "0")
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
START_DATE=$(echo "$DATE_RANGE" | cut -d'~' -f1)
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
END_DATE=$(echo "$DATE_RANGE" | cut -d'~' -f2)
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
TIMEOUT_COUNT=$(grep -c "timeout\|Timeout\|TIMEOUT" "$LOG_FILE" 2>/dev/null || echo "0")
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
CONN_ERROR_COUNT=$(grep -c "connection refused\|Connection refused\|ECONNREFUSED" "$LOG_FILE" 2>/dev
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
MEMORY_ERROR_COUNT=$(grep -c "OutOfMemory\|memory\|Memory" "$LOG_FILE" 2>/dev/null || echo "0")
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
echo "总错误数: $((ERROR_COUNT + WARN_COUNT))"
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Unix shell invocation
#!/bin/bash
This is an executable Bash helper that runs local system commands. Shell execution is intended but remains a real risk for a community skill.
中
Shell command substitution
DISK_INFO=$(df -h "$DISK_PATH" | tail -1)
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
DISK_DEVICE=$(echo "$DISK_INFO" | awk '{print $1}')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
DISK_SIZE=$(echo "$DISK_INFO" | awk '{print $2}')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
DISK_USED=$(echo "$DISK_INFO" | awk '{print $3}')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
DISK_AVAIL=$(echo "$DISK_INFO" | awk '{print $4}')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
DISK_USAGE_PERCENT=$(echo "$DISK_INFO" | awk '{print $5}' | sed 's/%//')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
INODE_INFO=$(df -i "$DISK_PATH" | tail -1)
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
INODE_USED_PERCENT=$(echo "$INODE_INFO" | awk '{print $5}' | sed 's/%//')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
INODE_TOTAL=$(echo "$INODE_INFO" | awk '{print $2}')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
INODE_USED=$(echo "$INODE_INFO" | awk '{print $3}')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
INODE_AVAIL=$(echo "$INODE_INFO" | awk '{print $4}')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
FS_TYPE=$(df -T "$DISK_PATH" | tail -1 | awk '{print $2}')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
MOUNT_POINT=$(df "$DISK_PATH" | tail -1 | awk '{print $NF}')
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Shell command substitution
count=$(find "$dir" -maxdepth 1 -type f 2>/dev/null | wc -l)
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Unix shell invocation
#!/bin/bash
This is an executable Bash helper that runs local system commands. Shell execution is intended but remains a real risk for a community skill.
中
Shell command substitution
STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time "$TIMEOUT" "$URL" 2>/dev/null || echo "00
The Bash helper runs shell utilities through command substitution against local paths or services. This is intended, but it is a real local execution surface.
中
Unix shell invocation
#!/bin/bash
This is an executable Bash helper that runs local system commands. Shell execution is intended but remains a real risk for a community skill.
中
Shell command substitution
FILE=$(fd .py | fzf --preview 'bat --color=always --line-range :50 {}')
The guide shows command substitution around local file-selection tools. This is normal CLI usage, but it can read or process unintended local files if copied blindly.
中
Shell command substitution
DIR=$(fd --type d | fzf)
The guide shows command substitution around local file-selection tools. This is normal CLI usage, but it can read or process unintended local files if copied blindly.
中
Shell command substitution
FILES=$(fd .py)
The guide shows command substitution around local file-selection tools. This is normal CLI usage, but it can read or process unintended local files if copied blindly.
中
Shell command substitution
FILE=$(echo "$FILES" | fzf \
The guide shows command substitution around local file-selection tools. This is normal CLI usage, but it can read or process unintended local files if copied blindly.
中
Shell command substitution
echo "✅ $tool 已安装 ($(which $tool))"
The guide shows command substitution around local file-selection tools. This is normal CLI usage, but it can read or process unintended local files if copied blindly.
中
Temp directory access
bat --paging=never /tmp/analysis-result.json
The guide writes or reads analysis artifacts under /tmp. This is common, but it can expose project data through shared temporary locations.
中
Temp directory access
> /tmp/errors.txt
The guide writes or reads analysis artifacts under /tmp. This is common, but it can expose project data through shared temporary locations.
中
Temp directory access
bat --theme=OneHalfDark /tmp/errors.txt
The guide writes or reads analysis artifacts under /tmp. This is common, but it can expose project data through shared temporary locations.
中
Shell command substitution
ln -s $(which fdfind) ~/.local/bin/fd
The example uses command substitution while creating a home-directory symlink. It changes command resolution behavior and should require user approval.
中
Hidden file access
ln -s $(which fdfind) ~/.local/bin/fd
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
中
Hidden file access
## 配置 (添加到 ~/.bashrc)
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
中
Hidden file access
## 配置 (添加到 ~/.bashrc)
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
中
xargs command (can execute arbitrary commands)
ps aux | fzf | awk '{print $2}' | xargs kill
The example pipes selected process IDs into xargs kill. If followed, it can terminate arbitrary local processes selected from ps output.
中
Hidden file access
## 进阶配置 (添加到 ~/.bashrc)
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
中
xargs command (can execute arbitrary commands)
rg "TODO" --files-with-matches | fzf | xargs bat
The example uses xargs to execute another command over selected results. It is intended CLI usage, but it can run commands over unintended files or arguments.
中
Hidden file access
# 添加到 ~/.bashrc
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
中
Shell command substitution
eval "$(zoxide init bash)"
The documentation recommends eval with command substitution for shell initialization. This can alter shell startup behavior and should be manually reviewed.
中
Hidden file access
添加到 `~/.bashrc`:
The documentation instructs changes to hidden home-directory configuration or PATH locations. These persistent shell changes should require explicit user approval.
中
xargs command (can execute arbitrary commands)
find . -name "*.md" | fzf | xargs bat
The example uses xargs to execute another command over selected results. It is intended CLI usage, but it can run commands over unintended files or arguments.
中
xargs command (can execute arbitrary commands)
find src/ -name "*.py" | fzf | xargs bat
The example uses xargs to execute another command over selected results. It is intended CLI usage, but it can run commands over unintended files or arguments.
中
Node.js fs operations
fs.writeFileSync(filename, JSON.stringify(report, null, 2));
The API tester writes a report file to disk. This is intended output behavior, but it is still filesystem modification from a bundled tool.
中
Synchronous file operations
fs.writeFileSync(filename, JSON.stringify(report, null, 2));
The API tester writes a report file to disk. This is intended output behavior, but it is still filesystem modification from a bundled tool.
中
Python file write/append
with open(args.output, 'w', encoding='utf-8') as f:
The code statistics tool writes reports to a user-provided output path. This is useful, but can overwrite files if the path is misused.
中
xargs command (can execute arbitrary commands)
find . -name "*.meta.yml" | xargs grep <tool-name>
The example uses xargs to execute another command over selected results. It is intended CLI usage, but it can run commands over unintended files or arguments.
低
Hardcoded URL
install_guide: "curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
install_guide: "curl -sS https://starship.rs/install.sh | sh"
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
echo " 💡 安装: curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
wget -qO- https://raw.githubusercontent.com/eza-community/eza/main/deb.asc | sudo gpg --dearmor -o /
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
echo "deb http://deb.gierens.de stable main" | sudo tee /etc/apt/sources.list.d/gierens.list
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
wget -qO- https://raw.githubusercontent.com/eza-community/eza/main/deb.asc | sudo gpg --dearmor -o /
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
echo "deb http://deb.gierens.de stable main" | sudo tee /etc/apt/sources.list.d/gierens.list
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
安装: "curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh"
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Hardcoded URL
安装: "curl -sS https://starship.rs/install.sh | sh"
The line references a hardcoded external URL in install guidance. This network dependency should be pinned, verified, and manually approved before use.
低
Fetch API call
const response = await fetch(url, {
The API tester performs HTTP requests to a configured base URL. This is intended behavior, but it is real network capability that needs user awareness.
低
HTTP client library
const fetch = require('node-fetch');
The API tester performs HTTP requests to a configured base URL. This is intended behavior, but it is real network capability that needs user awareness.
低
HTTP client library
async request(method, endpoint, options = {}) {
The API tester performs HTTP requests to a configured base URL. This is intended behavior, but it is real network capability that needs user awareness.
低
HTTP client library
return this.request('GET', endpoint, options);
The API tester performs HTTP requests to a configured base URL. This is intended behavior, but it is real network capability that needs user awareness.
低
HTTP client library
return this.request('POST', endpoint, { body, ...options });
The API tester performs HTTP requests to a configured base URL. This is intended behavior, but it is real network capability that needs user awareness.
低
HTTP client library
return this.request('PUT', endpoint, { body, ...options });
The API tester performs HTTP requests to a configured base URL. This is intended behavior, but it is real network capability that needs user awareness.
低
HTTP client library
return this.request('DELETE', endpoint, options);
The API tester performs HTTP requests to a configured base URL. This is intended behavior, but it is real network capability that needs user awareness.
低
Hardcoded URL
constructor(baseURL = 'http://localhost:3000') {
The API tester performs HTTP requests to a configured base URL. This is intended behavior, but it is real network capability that needs user awareness.
低
Hardcoded URL
const baseURL = args[0] || process.env.API_BASE_URL || 'http://localhost:3000';
The API tester performs HTTP requests to a configured base URL. This is intended behavior, but it is real network capability that needs user awareness.
リスク指摘
確認済みのセキュリティ上の懸念事項は、引き続きレビューが必要な項目と分けて表示されます。
確認済みのセキュリティ上の懸念 (10)
RISK-001 重大
Pipe to shell pattern
install_guide: "curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh
The install guidance pipes a remote script directly into sh. If followed by an agent or user, remote code executes without pinning or verification.
RISK-002 重大
Pipe to shell pattern
install_guide: "curl -sS https://starship.rs/install.sh | sh"
The install guidance pipes a remote script directly into sh. If followed by an agent or user, remote code executes without pinning or verification.
RISK-003 重大
Pipe to shell pattern
echo " 💡 安装: curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh
The install guidance pipes a remote script directly into sh. If followed by an agent or user, remote code executes without pinning or verification.
RISK-004 重大
Pipe to shell pattern
curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh
The install guidance pipes a remote script directly into sh. If followed by an agent or user, remote code executes without pinning or verification.
RISK-005 重大
Pipe to shell pattern
curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh
The install guidance pipes a remote script directly into sh. If followed by an agent or user, remote code executes without pinning or verification.
RISK-006 重大
Pipe to shell pattern
安装: "curl -sSfL https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | sh"
The install guidance pipes a remote script directly into sh. If followed by an agent or user, remote code executes without pinning or verification.
RISK-007 重大
Pipe to shell pattern
安装: "curl -sS https://starship.rs/install.sh | sh"
The install guidance pipes a remote script directly into sh. If followed by an agent or user, remote code executes without pinning or verification.
RISK-008 高
Environment file access
if [ -f ".env" ]; then
The script checks for .env and then sources it directly. This can expose secrets and execute shell content from the project environment file.
RISK-009 高
Environment file access
source .env
The script checks for .env and then sources it directly. This can expose secrets and execute shell content from the project environment file.
RISK-010 高
Metadata-Driven Tool Execution Without Strong Allowlist
The CLI discovers internal tools from metadata and then runs the discovered tool file with user-supplied arguments. In a community skill, this generic runner should enforce path containment, a fixed allowlist, and explicit user confirmation before execution.
The detector builds tool_file values from metadata discovery, and the CLI executes that discovered path. The code uses subprocess list arguments, but the broader marketplace risk is metadata-mediated execution of bundled tools.
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
- FIX-001重大Remote install commands are piped directly into sh.Replace pipe-to-shell instructions with package-manager steps, pinned release downloads, and checksum verification.
- FIX-002高Documentation includes sudo package and keyring modification commands.Require explicit user confirmation and link to official installation docs instead of encouraging automatic privileged execution.
- FIX-003高The service checker sources .env directly.Parse only required keys safely or require explicit environment variables without executing project-controlled shell content.
- FIX-004高The CLI runs discovered tool files through a generic runner.Add a fixed allowlist, path containment checks, executable ownership checks, and a confirmation prompt before running tools.
- FIX-005中Filesystem helpers can scan broad local paths and temporary directories.Default to scoped project paths, warn before root or system-log scans, and avoid shared temporary files for sensitive output.
専門家による証拠
不変の対象ID、スキャナーメタデータ、除外された一致項目、およびソースレベルの証拠。
アーティファクト主体
- Marketplace コミット
- 利用不可
- コンテンツハッシュ
- 利用不可
- ツリーハッシュ
- 利用不可
- Skill パス
- 利用不可
- 監査ペイロードハッシュ
- 利用不可
分析メタデータ
監査モデル: codex
分析状態: 完了
対象範囲は、記録されたファイル、行、メソッド、および証拠に限定されます。ランタイムまたはサンドボックスでの実行は主張していません。
静的解析の誤検知を無視 (2)
高
LLM role tokens injection
- DB_USER: "数据库用户"
Force-confirmed blocker/high static finding; AI dismissal overridden.
高
LLM role tokens injection
DB_USER="${DB_USER:-postgres}"
Force-confirmed blocker/high static finding; AI dismissal overridden.
検証とエクスポート
マニフェストとロックファイルは、インストール成果物を暗号学的ハッシュに結び付けます。この完全性に関する主張は、セキュリティ評価とは別のものです。
監査アテステーション: not_attestable