📦
История аудитов
best-practices - 1 аудит
Версия аудита 1 Последняя
22 окт. 2026 г., 13:23
All 95 static findings are false positives involving documentation examples, explicitly discouraged patterns, or legitimate audit references. No evidence found of prompt injection, credential theft, or malicious execution. Two semantic findings identify security guidance errors concerning Permissions-Policy delivery and structuredClone behavior.
2
Просканировано файлов
677
Проанализировано строк
7
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (2)
Средний
Permissions Policy Examples Do Not Enforce Restrictions
The skill recommends meta http-equiv="Permissions-Policy" to restrict geolocation, camera, and microphone. Browsers require the HTTP response header, so copied examples leave these policy restrictions unenforced.
Both examples use an unsupported meta delivery mechanism. This creates false assurance about feature restrictions, although browser permission prompts still apply.
Средний
Cloning Is Incorrectly Presented as Dangerous-Key Sanitization
The reference states that structuredClone drops __proto__ and functions, then labels its result deepSafe. Cloning preserves __proto__ data keys, so later unsafe merges can still expose prototype-pollution risks.
A local runtime check confirmed that structuredClone preserves an own __proto__ key and throws DataCloneError for functions. Cloning alone does not sanitize merge inputs.
Факторы риска
⚡ Содержит скрипты (7)
⚙️ Внешние команды (50)
references/SECURITY.md:100-116 SKILL.md:18 SKILL.md:41-49 SKILL.md:49-53 SKILL.md:53-67 SKILL.md:67-71 SKILL.md:71-83 SKILL.md:83-87 SKILL.md:87-112 SKILL.md:112-116 SKILL.md:116 SKILL.md:118-120 SKILL.md:120-129 SKILL.md:129-131 SKILL.md:131 SKILL.md:139-162 SKILL.md:162-166 SKILL.md:166-177 SKILL.md:177-185 SKILL.md:185-199 SKILL.md:199-203 SKILL.md:203-227 SKILL.md:227-231 SKILL.md:231-241 SKILL.md:241-249 SKILL.md:249-265 SKILL.md:265-267 SKILL.md:267 SKILL.md:269 SKILL.md:277-290 SKILL.md:290-294 SKILL.md:294-306 SKILL.md:306-310 SKILL.md:310-328 SKILL.md:328-336 SKILL.md:336-356 SKILL.md:356-360 SKILL.md:360-384 SKILL.md:384-388 SKILL.md:388-399 SKILL.md:399-407 SKILL.md:407-418 SKILL.md:418-422 SKILL.md:422-430 SKILL.md:430-438 SKILL.md:438-439 SKILL.md:439 SKILL.md:440-441 SKILL.md:441 SKILL.md:443-469
🌐 Доступ к сети (18)
references/SECURITY.md:8 references/SECURITY.md:9 references/SECURITY.md:12 references/SECURITY.md:13 references/SECURITY.md:29 references/SECURITY.md:32 references/SECURITY.md:41 references/SECURITY.md:44 references/SECURITY.md:90 SKILL.md:153 SKILL.md:149 SKILL.md:131 SKILL.md:429 SKILL.md:470 SKILL.md:471 SKILL.md:474 SKILL.md:478 SKILL.md:479
📁 Доступ к файловой системе (1)
🔑 Переменные окружения (2)
Аудитор:: codex