Histórico de auditoria

calil-books - 1 auditoria

13 de out. de 2026, 03:22

All 42 static findings are benign Markdown formatting, expected Calil URLs, readable Japanese prose, library identifiers, or a fixed documentation link. No evidence found of prompt injection, malicious execution, or unauthorized data transmission in SKILL.md. One low-severity semantic finding concerns API keys exposed through expanded curl command arguments.

Arquivos analisados

120

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (1)

Baixo

SKILL.md:24 SKILL.md:65 SKILL.md:73 SKILL.md:84

API Key Exposure Through Command Arguments

The curl examples expand CALIL_APPKEY into URL arguments. The key can appear in process listings or captured command logs despite the guidance to keep credentials private.

Shell expansion places the key directly in curl's URL argument. Actual disclosure depends on process visibility and logging; no evidence found of deliberate exfiltration.

Fatores de risco

⚙️ Comandos externos (28)

🌐 Acesso à rede (9)

SKILL.md:18 SKILL.md:24 SKILL.md:65 SKILL.md:73 SKILL.md:84 SKILL.md:102 SKILL.md:112 SKILL.md:114 SKILL.md:119

📁 Acesso ao sistema de arquivos (1)

SKILL.md:108

Auditado por: codex

← Voltar para a habilidade