📦
Histórico de auditoria
taiwan-oil-price - 1 auditoria
Versão da auditoria 1 Mais recente
13 de out. de 2026, 03:46
Markdown formatting, public CPC URLs, Python HTML decoding, and readable multilingual text explain 18 false positives. Four temporary-file findings expose overwrite or data-tampering risks through predictable shared paths. No evidence found of prompt injection, credential access, or data exfiltration.
1
Arquivos analisados
73
Linhas analisadas
7
Itens de revisão
0
Falsos positivos ignorados
Itens de revisão de capacidade (4)
Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.
Médio
Temp directory access
curl -sm 30 'https://vipmbr.cpc.com.tw/opendata/sixtypeoillistprice' -o /tmp/oil.json
curl writes to the predictable shared path /tmp/oil.json without exclusive creation. A preexisting symlink can redirect writes to files writable by the caller.
Médio
Temp directory access
jq -r '.[] | select(.型別名稱=="汽柴油零售") | "\(.產品名稱) \(.參考牌價_金額) \(.牌價生效日期)"' /tmp/oil.json
jq trusts a predictable shared temporary file without ownership or integrity checks. Local replacement or concurrent downloads can corrupt reported prices.
Médio
Temp directory access
curl -sm 30 -A 'Mozilla/5.0' 'https://www.cpc.com.tw/historyprice.aspx?n=2890' -o /tmp/cpc.html
curl writes to the fixed shared path /tmp/cpc.html without exclusive creation. A preexisting symlink can cause unintended overwrite under the caller's permissions.
Médio
Temp directory access
t = open('/tmp/cpc.html', encoding='utf-8', errors='replace').read()
Python reads a predictable shared HTML file without verifying ownership or provenance. Local file substitution or concurrent runs can inject false historical price rows.
Fatores de risco
⚙️ Comandos externos (13)
🌐 Acesso à rede (3)
📁 Acesso ao sistema de arquivos (4)
Auditado por: codex