📦
監査履歴
wecom-unified - 2 監査
バージョン比較
監査済みバージョン間の機能と検出結果の変化（新しい順）。
監査バージョン 2 最新
2026年8月18日 08:30
Most static findings are false positives caused by multilingual documentation, Markdown code formatting, example URLs, and defensive file-handling code. The audit identified one material workflow risk: the skill can automatically install an unpinned global npm package without user confirmation. No prompt-injection language, credential exfiltration, or concealed executable payload was found in the reviewed evidence.
96
スキャンされたファイル
21,712
解析済み行数
5
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (1)
高
Unpinned Global Package Installation Without Confirmation
The skill directs the agent to run `npm install -g @wecom/cli` whenever the CLI is missing or outdated, without requiring user confirmation or pinning a version. This can introduce a supply-chain change with global system impact before the requested business action begins.
The installation instruction is explicit and unconditional after a missing or old CLI check. A global, unpinned package install is externally sourced and changes the local environment.
リスク要因
⚙️ 外部コマンド (50)
references/wecomcli-calendar-cancel.md:52-53 references/wecomcli-calendar-cancel.md:53-61 references/wecomcli-calendar-freebusy.md:146-150 references/wecomcli-calendar-update.md:104-110 references/wecomcli-calendar-update.md:110-134 references/wecomcli-meeting-list.md:222-225 references/wecomcli-meeting-search.md:169-173 references/wecomcli-meeting-update.md:70-71 references/wecomcli-meeting-update.md:71-118 references/wecomcli-smartsheet-read.md:120 references/wecomcli-smartsheet-read.md:245 references/wecomcli-smartsheet-read.md:253 references/wecomcli-smartsheet-read.md:261 scripts/build_docx.py:9 scripts/build_docx.py:11 scripts/build_docx.py:12 scripts/build_docx.py:13 scripts/build_docx.py:14 scripts/build_docx.py:15 scripts/build_docx.py:75 scripts/build_docx.py:80 scripts/build_docx.py:154 scripts/build_docx.py:166 scripts/build_docx.py:257 scripts/build_docx.py:258 scripts/build_docx.py:434 scripts/build_docx.py:469 scripts/build_docx.py:470 scripts/build_docx.py:511 scripts/build_docx.py:512 scripts/build_docx.py:514 scripts/build_docx.py:530 scripts/build_docx.py:551 scripts/build_docx.py:568 scripts/build_docx.py:569 scripts/build_docx.py:570 scripts/build_docx.py:614 scripts/build_docx.py:615 scripts/build_docx.py:628 scripts/build_docx.py:637 scripts/build_docx.py:638 scripts/build_docx.py:641 scripts/build_docx.py:653 scripts/build_docx.py:685 scripts/build_docx.py:700-702 scripts/build_docx.py:702 scripts/build_docx.py:703 scripts/build_docx.py:713 scripts/build_docx.py:729 scripts/build_docx.py:739
📁 ファイルシステムへのアクセス (8)
🌐 ネットワークアクセス (10)
references/wecomcli-smartpage-edit.md:128 references/wecomcli-smartpage-mdx-syntax.md:113 references/wecomcli-smartpage-mdx-syntax.md:660 references/wecomcli-smartsheet-record-values.md:105 references/wecomcli-smartsheet-record-values.md:116 references/wecomcli-smartsheet-webhook-examples.md:128 references/wecomcli-smartsheet-webhook-examples.md:146 SKILL.md:77 SKILL.md:89 SKILL.md:125
🔑 環境変数 (1)
監査者: claude
2026年8月18日 08:30
Most static findings are false positives caused by multilingual documentation, Markdown code formatting, example URLs, and defensive file-handling code. The audit identified one material workflow risk: the skill can automatically install an unpinned global npm package without user confirmation. No prompt-injection language, credential exfiltration, or concealed executable payload was found in the reviewed evidence.
96
スキャンされたファイル
21,712
解析済み行数
5
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (1)
高
Unpinned Global Package Installation Without Confirmation
The skill directs the agent to run `npm install -g @wecom/cli` whenever the CLI is missing or outdated, without requiring user confirmation or pinning a version. This can introduce a supply-chain change with global system impact before the requested business action begins.
The installation instruction is explicit and unconditional after a missing or old CLI check. A global, unpinned package install is externally sourced and changes the local environment.
リスク要因
⚙️ 外部コマンド (50)
references/wecomcli-calendar-cancel.md:52-53 references/wecomcli-calendar-cancel.md:53-61 references/wecomcli-calendar-freebusy.md:146-150 references/wecomcli-calendar-update.md:104-110 references/wecomcli-calendar-update.md:110-134 references/wecomcli-meeting-list.md:222-225 references/wecomcli-meeting-search.md:169-173 references/wecomcli-meeting-update.md:70-71 references/wecomcli-meeting-update.md:71-118 references/wecomcli-smartsheet-read.md:120 references/wecomcli-smartsheet-read.md:245 references/wecomcli-smartsheet-read.md:253 references/wecomcli-smartsheet-read.md:261 scripts/build_docx.py:9 scripts/build_docx.py:11 scripts/build_docx.py:12 scripts/build_docx.py:13 scripts/build_docx.py:14 scripts/build_docx.py:15 scripts/build_docx.py:75 scripts/build_docx.py:80 scripts/build_docx.py:154 scripts/build_docx.py:166 scripts/build_docx.py:257 scripts/build_docx.py:258 scripts/build_docx.py:434 scripts/build_docx.py:469 scripts/build_docx.py:470 scripts/build_docx.py:511 scripts/build_docx.py:512 scripts/build_docx.py:514 scripts/build_docx.py:530 scripts/build_docx.py:551 scripts/build_docx.py:568 scripts/build_docx.py:569 scripts/build_docx.py:570 scripts/build_docx.py:614 scripts/build_docx.py:615 scripts/build_docx.py:628 scripts/build_docx.py:637 scripts/build_docx.py:638 scripts/build_docx.py:641 scripts/build_docx.py:653 scripts/build_docx.py:685 scripts/build_docx.py:700-702 scripts/build_docx.py:702 scripts/build_docx.py:703 scripts/build_docx.py:713 scripts/build_docx.py:729 scripts/build_docx.py:739
📁 ファイルシステムへのアクセス (8)
🌐 ネットワークアクセス (10)
references/wecomcli-smartpage-edit.md:128 references/wecomcli-smartpage-mdx-syntax.md:113 references/wecomcli-smartpage-mdx-syntax.md:660 references/wecomcli-smartsheet-record-values.md:105 references/wecomcli-smartsheet-record-values.md:116 references/wecomcli-smartsheet-webhook-examples.md:128 references/wecomcli-smartsheet-webhook-examples.md:146 SKILL.md:77 SKILL.md:89 SKILL.md:125
🔑 環境変数 (1)
監査者: claude