Histórico de auditoria

youbike-realtime - 1 auditoria

13 de out. de 2026, 04:29

Reviewed all 114 static findings: 109 are false positives from Markdown formatting, public-data URLs, read-only queries, and readable multilingual text. Five downloads use predictable shared temporary paths, allowing local symlink overwrite or cache tampering when another user controls those paths. No evidence found of prompt injection, credential access, or data exfiltration.

Arquivos analisados

239

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Itens de revisão de capacidade (5)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

SKILL.md:26

Temp directory access

curl -sm 60 https://apis.youbike.com.tw/json/station-yb2.json -o /tmp/youbike_all.json

Curl writes to predictable /tmp/youbike_all.json without creating a private directory. A local attacker can precreate a writable symlink target or tamper with shared cache data.

Médio

SKILL.md:105

Temp directory access

curl -sm 30 https://tcgbusfs.blob.core.windows.net/dotapp/youbike/v2/youbike_immediate.json -o /tmp/

Curl writes to predictable /tmp/youbike.json without establishing private ownership. A local attacker can redirect a writable download through a symlink or alter shared cache contents.

Médio

SKILL.md:132

Temp directory access

curl -sm 30 'https://data.ntpc.gov.tw/api/datasets/010E5B15-3823-4B20-B401-B1CF000550C5/json?page=0&

Curl downloads into predictable /tmp/youbike_ntpc.json without a private directory. Preexisting attacker-controlled symlinks can redirect writable output, and shared files permit cache tampering.

Médio

SKILL.md:160

Temp directory access

curl -sm 30 'https://newdatacenter.taichung.gov.tw/api/v1/no-auth/resource.download?rid=9468c0d0-e1e

Curl writes directly to predictable /tmp/youbike_tc.json. Without private ownership, another local user can precreate a writable symlink target or supply tampered cache data.

Médio

SKILL.md:168

Temp directory access

curl -sm 30 'https://opendata.tycg.gov.tw/api/v1/dataset.api_access?rid=08274d61-edbe-419d-8fcc-7a64

Curl writes directly to predictable /tmp/youbike_ty.json without isolating the cache. Local attackers can exploit preexisting writable symlinks or alter shared station data.

Fatores de risco

⚙️ Comandos externos (50)

🌐 Acesso à rede (6)

SKILL.md:26 SKILL.md:105 SKILL.md:132 SKILL.md:160 SKILL.md:168 SKILL.md:225

📁 Acesso ao sistema de arquivos (15)

SKILL.md:26 SKILL.md:67 SKILL.md:71 SKILL.md:76 SKILL.md:83 SKILL.md:92 SKILL.md:105 SKILL.md:126 SKILL.md:132 SKILL.md:152 SKILL.md:160 SKILL.md:168 SKILL.md:195 SKILL.md:199 SKILL.md:210

Auditado por: codex

← Voltar para a habilidade