📦
감사 이력
teardown - 1 감사
감사 버전 1 최신
2026년 10월 31일 오후 02:11
No evidence found of keylogging, credential theft, or prompt injection in the reviewed context; most alerts match benign syntax and metadata. Confirmed risks include URL-controlled caption injection and unrestricted recursive deletion through the contact-sheet name. The 394 omitted static matches remain unreviewed and require manual review before automatic publication. Static review was capped at 400/794 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
58
스캔된 파일
9,645
분석된 줄 수
8
검토 항목
0
오탐 무시됨
기능 검토 항목 (3)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
높음
innerHTML assignment (XSS risk)
storyEl.innerHTML = `<div class="cap ${cur.kind || 'hero'}">
runtime.js merges URL-supplied story configuration into captions. Unescaped tag, text, and kind values reach innerHTML, allowing scripts through injected HTML event handlers.
높음
Node.js fs operations
fs.rmSync(dir, {recursive: true, force: true});
The unchecked --name value reaches recursive, forced deletion through path.join(base, name). Parent segments can delete directories outside the sheet output folder.
중간
Node.js fs operations
fs.mkdirSync(dir, {recursive: true});
The unchecked --name also controls this directory and subsequent frame writes. Parent segments permit output creation outside the intended sheet folder.
위험 요인
🌐 네트워크 접근 (36)
package-lock.json:21 package-lock.json:37 package-lock.json:53 package-lock.json:69 package-lock.json:85 package-lock.json:101 package-lock.json:117 package-lock.json:133 package-lock.json:149 package-lock.json:165 package-lock.json:181 package-lock.json:197 package-lock.json:213 package-lock.json:229 package-lock.json:245 package-lock.json:261 package-lock.json:277 package-lock.json:293 package-lock.json:309 package-lock.json:325 package-lock.json:341 package-lock.json:357 package-lock.json:373 package-lock.json:389 package-lock.json:405 package-lock.json:421 package-lock.json:437 package-lock.json:441 package-lock.json:446 package-lock.json:450 package-lock.json:455 package-lock.json:496 package-lock.json:510 package-lock.json:528 package-lock.json:540 SKILL.md:144
⚙️ 외부 명령어 (50)
paths.mjs:14 paths.mjs:16 sfx/dsp.py:208 sfx/dsp.py:424 sfx/synth.py:28 sfx/synth.py:4 sfx/synth.py:6 sheet.mjs:12 sheet.mjs:43 sheet.mjs:88 sheet.mjs:19 sheet.mjs:71 sheet.mjs:92 sheet.mjs:93 sheet.mjs:95-97 sheet.mjs:101 sheet.mjs:114 sheet.mjs:119 sheet.mjs:126 sheet.mjs:127 sims/beats.py:35 sims/build.mjs:30 sims/build.mjs:33 sims/build.mjs:37 sims/build.mjs:46 sims/build.mjs:57 sims/build.mjs:79 sims/build.mjs:112-131 sims/build.mjs:132 sims/build.mjs:134 sims/build.mjs:140 sims/capture.mjs:20 sims/capture.mjs:57 sims/capture.mjs:159 sims/capture.mjs:181 sims/capture.mjs:201 sims/capture.mjs:59 sims/capture.mjs:32 sims/capture.mjs:40 sims/capture.mjs:43 sims/capture.mjs:55 sims/capture.mjs:66 sims/capture.mjs:99 sims/capture.mjs:108 sims/capture.mjs:149 sims/capture.mjs:150 sims/capture.mjs:160 sims/capture.mjs:163 sims/capture.mjs:171 sims/capture.mjs:192
🔑 환경 변수 (20)
paths.mjs:10 paths.mjs:11 paths.mjs:12 paths.mjs:15 paths.mjs:17 paths.mjs:26 paths.mjs:10 paths.mjs:11 paths.mjs:12 paths.mjs:15 paths.mjs:17 paths.mjs:26 sfx/__main__.py:49 sfx/score_kit.py:33 sims/beats.py:24 sims/build.mjs:103 sims/build.mjs:103 sims/cessna-shared/score.py:16 sims/strandbeest-shared/score.py:17 sims/v8-shared/score.py:16
📁 파일 시스템 접근 (50)
sfx/mix.py:104 sfx/mix.py:102 sheet.mjs:51 sheet.mjs:85 sheet.mjs:86 sheet.mjs:37 sheet.mjs:51 sims/beats.py:204 sims/beats.py:203 sims/build.mjs:25 sims/build.mjs:32 sims/build.mjs:35 sims/build.mjs:38 sims/build.mjs:63 sims/build.mjs:111 sims/build.mjs:133 sims/build.mjs:137 sims/build.mjs:138 sims/build.mjs:139 sims/build.mjs:44 sims/build.mjs:55 sims/build.mjs:56 sims/build.mjs:63 sims/build.mjs:111 sims/build.mjs:139 sims/build.mjs:32 sims/build.mjs:35 sims/build.mjs:38 sims/build.mjs:63 sims/build.mjs:111 sims/build.mjs:133 sims/build.mjs:138 sims/build.mjs:20 sims/capture.mjs:47 sims/capture.mjs:56 sims/capture.mjs:61 sims/capture.mjs:67 sims/capture.mjs:112 sims/capture.mjs:138 sims/capture.mjs:209 sims/capture.mjs:42 sims/capture.mjs:58 sims/capture.mjs:47 sims/capture.mjs:61 sims/capture.mjs:112 sims/capture.mjs:24 sims/capture.mjs:69 sims/cessna-film/main.js:1 sims/cessna-film/main.js:2 sims/cessna-live/main.js:1
⚡ 스크립트 포함 (42)
sims/capture.mjs:57 sims/cessna-shared/console.js:29 sims/cessna-shared/console.js:149 sims/cessna-shared/console.js:218 sims/cessna-shared/console.js:235 sims/cessna-shared/console.js:258 sims/cessna-shared/console.js:282 sims/cessna-shared/console.js:283 sims/cessna-shared/live.js:334 sims/kit/director.js:237 sims/kit/director.js:123 sims/kit/hud.js:130 sims/kit/hud.js:150 sims/kit/hud.js:160 sims/kit/hud.js:181 sims/kit/hud.js:13 sims/strandbeest-shared/console.js:48 sims/strandbeest-shared/console.js:272 sims/strandbeest-shared/console.js:286 sims/strandbeest-shared/console.js:302 sims/strandbeest-shared/console.js:321 sims/strandbeest-shared/console.js:332 sims/strandbeest-shared/console.js:363 sims/strandbeest-shared/console.js:364 sims/strandbeest-shared/console.js:370 sims/strandbeest-shared/live.js:404 sims/v8-shared/console.js:26 sims/v8-shared/console.js:184 sims/v8-shared/console.js:189 sims/v8-shared/console.js:199 sims/v8-shared/console.js:229 sims/v8-shared/console.js:234 sims/v8-shared/console.js:235 sims/v8-shared/console.js:238 sims/v8-shared/console.js:268 sims/v8-shared/console.js:269 sims/v8-shared/console.js:273 sims/v8-shared/console.js:285 sims/v8-shared/console.js:300 sims/v8-shared/console.js:333 sims/v8-shared/console.js:334 sims/v8-shared/live.js:358
감사자: codex