Histórico de auditoria

gravitas - 1 auditoria

15 de out. de 2026, 13:01

Most static alerts match Markdown formatting, local documentation links, source searches, or normal verification tooling. Four execution findings retain package download risks; semantic review identifies an unconditional refusal prohibition and verification helpers that can report success without sufficient checks. No evidence found of credential exfiltration or deliberate malware.

Arquivos analisados

4,775

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Alto

resources/persona-protocol.md:146-156

Prompt Injection Attempt Detected

The persona protocol says "execute immediately, no more warnings" after confirmation and prohibits "Refuse after user has confirmed". This unconditional compliance instruction can suppress safety refusals or permission checks beyond the skill's legitimate authority.

The prohibition is explicit and unconditional within a protocol for risky requests. User confirmation cannot replace host policy or required permission checks.

Médio

scripts/run-checks.sh:174-180 scripts/verify.sh:138-187 scripts/verify.sh:297-300

Verification Helpers Can Report Success Without Required Checks

The quick checker initializes failure state to zero and reports success when no supported checks execute. The shell verifier also permits skipped Python checks before issuing PASS, enabling unsupported completion claims.

Both helpers determine success from failure counters without requiring executed checks. Missing Python tools produce warnings without increasing the failure count.

Itens de revisão de capacidade (4)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

scripts/verify.py:60

Python subprocess.run

result = subprocess.run(parts, capture_output=True, text=True, timeout=300)

The TypeScript fallback can execute unpinned npx tsc when the local compiler is unavailable. Argument-list execution avoids shell injection but not registry package execution.

Médio

scripts/verify.sh:100

Shell command substitution

if output=$(npx eslint . --max-warnings 0 2>&1); then

Unpinned npx eslint can resolve and execute a registry package when no local binary exists. The script provides no local-only guard or package review step.

Médio

scripts/verify.sh:113

Shell command substitution

if output=$(npx vitest run --reporter=verbose 2>&1); then

The test step invokes unpinned npx vitest, which can fetch and execute a missing registry package. Verification can therefore execute unreviewed external code.

Médio

scripts/verify.sh:123

Shell command substitution

if output=$(npx jest --verbose 2>&1); then

Unpinned npx jest can execute a registry-resolved package when the local tool is absent. This lacks a local-only requirement or explicit installation approval.

Fatores de risco

📁 Acesso ao sistema de arquivos (23)

⚙️ Comandos externos (50)

🔑 Variáveis de ambiente (3)

agents/explore.md:65 agents/explore.md:65 resources/verification-engine.md:190

🌐 Acesso à rede (1)

resources/memory-protocol.md:126

Auditado por: codex

← Voltar para a habilidade