📦
Histórico de auditoria
m3-expressive - 1 auditoria
Versão da auditoria 1 Mais recente
10 de out. de 2026, 19:38
Of 400 supplied alerts, 396 are false positives; four confirm conditional filesystem and network risks in the optional image refresh script. No evidence found of malicious intent, credential theft, or prompt injection in the reviewed context. The analyzer withheld 21 additional matches, which require manual review before automatic publication. Static review was capped at 400/421 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
26
Arquivos analisados
12,538
Linhas analisadas
8
Itens de revisão
0
Falsos positivos ignorados
Itens de revisão de capacidade (4)
Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.
Médio
Node.js fs operations
for (const s of new Set(found.map(f => f.rel.split('/')[0]))) fs.mkdirSync(path.join(outdir, s), { r
Image paths use remote route slugs with separators replaced, but allow ".." as a directory name. Malformed upstream data can cause writes outside outdir.
Médio
Node.js fs operations
fs.writeFileSync(dest, buf);
Image paths use remote route slugs with separators replaced, but allow ".." as a directory name. Malformed upstream data can cause writes outside outdir.
Médio
Synchronous file operations
fs.writeFileSync(dest, buf);
Image paths use remote route slugs with separators replaced, but allow ".." as a directory name. Malformed upstream data can cause writes outside outdir.
Médio
HTTP/HTTPS get
https.get(url, { headers: { 'User-Agent': 'Mozilla/5.0' } }, res => {
The image downloader accepts upstream image URLs and follows redirects without host or private-address restrictions. Manipulated upstream content could trigger requests to internal HTTPS services.
Fatores de risco
📁 Acesso ao sistema de arquivos (24)
README.md:21 README.md:24 references/components/bars.md:428 references/components/containment.md:700 references/components/fabs.md:355 references/components/feedback.md:777 references/components/navigation.md:437 references/layout.md:184 scripts/refresh-component-tokens.js:181 scripts/refresh-component-tokens.js:181 scripts/refresh-component-tokens.js:112 scripts/refresh-component-tokens.js:14 scripts/refresh-m3.js:155 scripts/refresh-m3.js:161 scripts/refresh-m3.js:173 scripts/refresh-m3.js:201 scripts/refresh-m3.js:212 scripts/refresh-m3.js:221 scripts/refresh-m3.js:207 scripts/refresh-m3.js:161 scripts/refresh-m3.js:212 scripts/refresh-m3.js:221 scripts/refresh-m3.js:29 scripts/refresh-m3.js:183
⚡ Contém scripts (7)
⚙️ Comandos externos (50)
scripts/refresh-component-tokens.js:22 scripts/refresh-component-tokens.js:23 scripts/refresh-component-tokens.js:91 scripts/refresh-component-tokens.js:130 scripts/refresh-component-tokens.js:131 scripts/refresh-component-tokens.js:141 scripts/refresh-component-tokens.js:146 scripts/refresh-component-tokens.js:159 scripts/refresh-component-tokens.js:168 scripts/refresh-component-tokens.js:182 scripts/refresh-m3.js:75 scripts/refresh-m3.js:82 scripts/refresh-m3.js:90 scripts/refresh-m3.js:94 scripts/refresh-m3.js:97 scripts/refresh-m3.js:127 scripts/refresh-m3.js:156-165 scripts/refresh-m3.js:165-196 scripts/refresh-m3.js:196-197 scripts/refresh-m3.js:197-222 SKILL.md:25 SKILL.md:26 SKILL.md:31 SKILL.md:48 SKILL.md:49 SKILL.md:52 SKILL.md:53 SKILL.md:60 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:81 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:91 SKILL.md:92 SKILL.md:93 SKILL.md:94 SKILL.md:95 SKILL.md:96 SKILL.md:97 SKILL.md:98 SKILL.md:101
Auditado por: codex