📦
Histórico de auditoria
zipcode-lookup - 1 auditoria
Versão da auditoria 1 Mais recente
13 de out. de 2026, 04:34
All 15 static findings are false positives involving Markdown formatting, legitimate downloads, fixed shell commands, and a documentation link. No evidence found of prompt injection, credential access, or data exfiltration. A separate low-severity concern is archive extraction that can overwrite local files without isolating the destination.
1
Arquivos analisados
81
Linhas analisadas
4
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (1)
Baixo
Archive Extraction Can Overwrite Local Files
The workflow uses unzip -o in the current directory without validating archive contents. A supplied archive can overwrite matching local files during extraction.
The overwrite option and user-supplied archive fallback are explicit. Impact depends on archive contents and existing files; no malicious archive is shown.
Fatores de risco
⚙️ Comandos externos (11)
🌐 Acesso à rede (2)
📁 Acesso ao sistema de arquivos (1)
Auditado por: codex