📦
Histórico de auditoria
anatomy - 1 auditoria
Versão da auditoria 1 Mais recente
11 de out. de 2026, 14:34
Most presented matches are benign geometry, documentation, local screenshots, and loopback browser control; no evidence found of prompt injection or intentional exfiltration. CLI-selected imports execute host code, and browser checks relax local-file isolation. Three oversized files and 2,518 omitted matches remain review gaps; this audit does not establish complete repository safety. Static review was capped at 400/2918 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
91
Arquivos analisados
57,606
Linhas analisadas
11
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (4)
Médio
Browser Checks Enable Cross-File Access
Browser checks enable --allow-file-access-from-files for user-selected pages. A malicious local page can access other readable local files; temporary profiles do not isolate filesystem access.
All three browser launchers enable cross-file access and accept local pages. SECURITY.md acknowledges this trust requirement; no malicious use was observed.
Baixo
Unscanned file (too_large) — manual review required
[unscanned: too_large]
The analyzer skipped this oversized executable HTML file. Its full contents remain unreviewed, so this coverage gap is retained without alleging malware.
Baixo
Unscanned file (too_large) — manual review required
[unscanned: too_large]
The analyzer skipped this oversized executable HTML file. Its full contents remain unreviewed, so this coverage gap is retained without alleging malware.
Baixo
Unscanned file (too_large) — manual review required
[unscanned: too_large]
The analyzer skipped this oversized executable HTML file. Its full contents remain unreviewed, so this coverage gap is retained without alleging malware.
Itens de revisão de capacidade (2)
Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.
Médio
Dynamic import() expression
const mod = await import(pathToFileURL(resolve(argv[0])).href);
The CLI-selected build module executes with Node filesystem and network privileges. An untrusted build target can run arbitrary host code.
Médio
Dynamic import() expression
const { T, P } = await import(pathToFileURL(resolve(target)).href);
The CLI-selected build module executes with Node filesystem and network privileges. An untrusted build target can run arbitrary host code.
Fatores de risco
⚙️ Comandos externos (50)
.github/ISSUE_TEMPLATE/bug_report.yml:9 .github/ISSUE_TEMPLATE/bug_report.yml:84 .github/workflows/ci.yml:64 evals/evals.json:7 evals/evals.json:25 evals/evals.json:31 examples/arcade-cabinet/arcade-cabinet-light.html:188 examples/arcade-cabinet/arcade-cabinet-light.html:521 examples/arcade-cabinet/arcade-cabinet-light.html:532 examples/arcade-cabinet/arcade-cabinet-light.html:534 examples/arcade-cabinet/arcade-cabinet-light.html:570 examples/arcade-cabinet/arcade-cabinet-light.html:575 examples/arcade-cabinet/arcade-cabinet-light.html:576 examples/arcade-cabinet/arcade-cabinet-light.html:580 examples/arcade-cabinet/arcade-cabinet-light.html:582 examples/arcade-cabinet/arcade-cabinet-light.html:585 examples/arcade-cabinet/arcade-cabinet-light.html:587 examples/arcade-cabinet/arcade-cabinet-light.html:590 examples/arcade-cabinet/arcade-cabinet-light.html:591 examples/arcade-cabinet/arcade-cabinet-light.html:596-597 examples/arcade-cabinet/arcade-cabinet-light.html:597-604 examples/arcade-cabinet/arcade-cabinet-light.html:608 examples/arcade-cabinet/arcade-cabinet-light.html:610 examples/arcade-cabinet/arcade-cabinet-light.html:621 examples/arcade-cabinet/arcade-cabinet-light.html:654 examples/arcade-cabinet/arcade-cabinet-light.html:659 examples/arcade-cabinet/arcade-cabinet-light.html:663 examples/arcade-cabinet/arcade-cabinet-light.html:665 examples/arcade-cabinet/arcade-cabinet-light.html:666 examples/arcade-cabinet/arcade-cabinet-light.html:675 examples/arcade-cabinet/arcade-cabinet-light.html:679 examples/arcade-cabinet/arcade-cabinet-light.html:680 examples/arcade-cabinet/arcade-cabinet-light.html:683 examples/arcade-cabinet/arcade-cabinet-light.html:686 examples/arcade-cabinet/arcade-cabinet-light.html:689 examples/arcade-cabinet/arcade-cabinet-light.html:690-692 examples/arcade-cabinet/arcade-cabinet-light.html:692 examples/arcade-cabinet/arcade-cabinet-light.html:694-697 examples/arcade-cabinet/arcade-cabinet-light.html:702 examples/arcade-cabinet/arcade-cabinet-light.html:703 examples/arcade-cabinet/arcade-cabinet-light.html:705 examples/arcade-cabinet/arcade-cabinet-light.html:708 examples/arcade-cabinet/arcade-cabinet-light.html:710 examples/arcade-cabinet/arcade-cabinet-light.html:712 examples/arcade-cabinet/arcade-cabinet-light.html:715 examples/arcade-cabinet/arcade-cabinet-light.html:717-723 examples/arcade-cabinet/arcade-cabinet-light.html:724-831 examples/arcade-cabinet/arcade-cabinet-light.html:1720 examples/arcade-cabinet/arcade-cabinet-light.html:2071 examples/arcade-cabinet/arcade-cabinet-light.html:2161
🌐 Acesso à rede (16)
.github/ISSUE_TEMPLATE/config.yml:4 CONTRIBUTING.md:16 README.md:136 references/verify.md:16 scripts/capture.mjs:133 scripts/capture.mjs:134 scripts/capture.mjs:133 scripts/capture.mjs:133 scripts/drive.mjs:133 scripts/drive.mjs:134 scripts/drive.mjs:133 scripts/drive.mjs:133 scripts/turn-check.mjs:51 scripts/turn-check.mjs:52 scripts/turn-check.mjs:51 scripts/turn-check.mjs:51
📁 Acesso ao sistema de arquivos (50)
CONTRIBUTING.md:23 CONTRIBUTING.md:23 CONTRIBUTING.md:23 examples/arcade-cabinet/build.mjs:1 examples/arcade-cabinet/build.mjs:683 examples/arcade-cabinet/build.mjs:684 examples/arcade-cabinet/build.mjs:688 examples/arcade-cabinet/build.mjs:689 examples/arcade-cabinet/build.mjs:690 examples/arcade-cabinet/build.mjs:711 examples/arcade-cabinet/build.mjs:4 examples/arcade-cabinet/build.mjs:5 examples/arcade-cabinet/build.mjs:6 examples/arcade-cabinet/build.mjs:7 examples/arcade-cabinet/build.mjs:8 examples/desk-computer/build.mjs:1 examples/desk-computer/build.mjs:434 examples/desk-computer/build.mjs:4 examples/desk-computer/build.mjs:5 examples/dial-indicator/build.mjs:1 examples/dial-indicator/build.mjs:274 examples/dial-indicator/build.mjs:4 examples/dial-indicator/build.mjs:5 examples/raptor-engine/build.mjs:1 examples/raptor-engine/build.mjs:931 examples/raptor-engine/build.mjs:932 examples/raptor-engine/build.mjs:935 examples/raptor-engine/build.mjs:4 examples/raptor-engine/build.mjs:5 examples/raptor-engine/build.mjs:6 examples/raptor-engine/build.mjs:7 examples/raptor-engine/build.mjs:8 examples/raptor-engine/build.mjs:9 examples/ripple-tank/build.mjs:1 examples/ripple-tank/build.mjs:552 examples/ripple-tank/build.mjs:553 examples/ripple-tank/build.mjs:554 examples/ripple-tank/build.mjs:557 examples/ripple-tank/build.mjs:4 examples/ripple-tank/build.mjs:5 examples/ripple-tank/build.mjs:6 examples/ripple-tank/build.mjs:7 examples/ripple-tank/build.mjs:8 examples/ripple-tank/live.js:176 examples/ripple-tank/live.js:177 examples/ripple-tank/live.js:233 examples/ripple-tank/live.js:234 examples/ripple-tank/ripple-tank-light.html:914 examples/ripple-tank/ripple-tank-light.html:915 examples/ripple-tank/ripple-tank-light.html:1381
⚡ Contém scripts (24)
examples/arcade-cabinet/arcade-cabinet-light.html:2403 examples/arcade-cabinet/arcade-cabinet-light.html:2411 examples/arcade-cabinet/arcade-cabinet-light.html:2432 examples/arcade-cabinet/arcade-cabinet-light.html:2609 examples/arcade-cabinet/arcade-cabinet-light.html:2610 examples/arcade-cabinet/arcade-cabinet-light.html:2392 examples/arcade-cabinet/arcade-cabinet-light.html:2393 examples/arcade-cabinet/arcade-cabinet.html:2403 examples/arcade-cabinet/arcade-cabinet.html:2411 examples/arcade-cabinet/arcade-cabinet.html:2432 examples/arcade-cabinet/arcade-cabinet.html:2609 examples/arcade-cabinet/arcade-cabinet.html:2610 examples/arcade-cabinet/arcade-cabinet.html:2392 examples/arcade-cabinet/arcade-cabinet.html:2393 examples/arcade-cabinet/live.js:183 examples/arcade-cabinet/live.js:191 examples/arcade-cabinet/live.js:212 examples/arcade-cabinet/live.js:389 examples/arcade-cabinet/live.js:390 examples/arcade-cabinet/live.js:172 examples/arcade-cabinet/live.js:173 scripts/turn-bench.mjs:20 scripts/turn-check.mjs:485 scripts/turn-check.mjs:486
Auditado por: codex