📦

監査履歴

personwise-customer-education - 1 監査

2026年8月5日 18:37

Most static findings are false positives caused by secure installer checks and Markdown formatting. Shell substitutions use quoted validation inputs, while descriptor entropy comes from Base64 metadata and a Minisign signature. Native installation, service-provided update commands, and document uploads still create meaningful third-party trust and execution risks.

スキャンされたファイル

649

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (3)

中

SKILL.md:73-79

Native CLI installation expands the trust boundary

When the CLI is missing, the workflow installs a downloaded native PersonWise executable. Fixed hashes reduce tampering risk, but third-party native code still executes locally.

The workflow explicitly directs the agent to run bundled bootstrap scripts that install the required native executable.

中

SKILL.md:108-116

Service-provided update commands can be executed

The workflow runs an update command returned by PersonWise after user approval. It does not require parsing the response against a fixed executable and argument allowlist.

The text explicitly says to quote and run the returned action command. User approval mitigates risk, but command validation is not specified.

中

SKILL.md:198-206

Selected customer materials are uploaded to PersonWise

The workflow treats user-selected documents as authorized and uploads them to PersonWise. Sensitive content can cross a third-party boundary without destination-specific confirmation.

The source add command and surrounding instructions directly describe uploading selected local documents to the service.

リスク要因

🌐 ネットワークアクセス (2)

assets/bootstrap.ps1:43 assets/bootstrap.sh:132

⚙️ 外部コマンド (50)

📁 ファイルシステムへのアクセス (7)

assets/bootstrap.sh:81 assets/bootstrap.sh:83 assets/bootstrap.sh:128 assets/bootstrap.sh:16 assets/bootstrap.sh:18 assets/bootstrap.sh:128 assets/bootstrap.sh:180

監査者: codex

← スキルに戻る