Habilidades astrale-cli Histórico de auditoria
📦

Histórico de auditoria

astrale-cli - 1 auditoria

10 de out. de 2026, 14:10

All 269 static findings are documentation false positives, including Markdown delimiters, example URLs, and descriptions of owner-private credential caches. Token examples introduce one semantic risk by passing bearer credentials through command-line arguments. No evidence found of prompt injection, malicious exfiltration, or unauthorized execution; external CLI implementation was not included.

1
Arquivos analisados
631
Linhas analisadas
4
Itens de revisão
0
Falsos positivos ignorados

Preocupações de segurança confirmadas (1)

Médio
Bearer Credentials Exposed Through Command Arguments
The examples pass minted bearer credentials using --creds "$TOKEN" and --creds "$(astrale token --raw)". Shell expansion places credentials in process arguments, potentially exposing them to process inspection or execution logging while tokens remain valid.
The examples directly expand bearer credentials into argv. Exposure depends on local process visibility and logging; short token lifetimes reduce the exploitation window.
Auditado por: codex