Этот отчет не переведен на запрошенный язык. Вместо него показан канонический отчет на английском языке.
Версионная оценка безопасности
ID отчёта: SA-73B58AAF
9/20/2026, 9:08:34 PM
agy-worker оценка безопасности v8
Отчёт о сертификации безопасности навыка
Версия сканера 3.0.0 Модель аудита: codex Последний опубликованный отчёт
- Название навыка
- agy-worker
- Версия
- v0.21.0
- Сопровождающий
- cagdasyurekli
- Охват
- 92 Просканировано файлов · 39,230 Проанализировано строк
- Версия политики
- skillstore-security-audit-policy-v1
Наивысшая серьёзность подтверждённого результата
Высокий
Подтверждённые проблемы безопасности (7) требуют внимания.
Контекст установки
Проверьте текущую страницу навыка
Эта страница содержит только сводку доказательств отчёта. Страница Навыка содержит каноническое уведомление об установке.
Открыть текущую страницу НавыкаЭтот отчёт не блокирует и не разрешает манифест или ZIP.
Most static matches are benign implementation, validation, documentation, schema, or control-character checks. Confirmed risks include provider and verifier execution, environment inheritance, keychain handling, settings access, and non-sandboxed provider authority. Static review was capped at 400/991 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Позиция отчета
Последний опубликованный отчёт
«Последний» относится к последовательности отчётов, а не к актуальности артефакта.
Аттестация аудита
Активная аттестация
Для этого точного отчёта доступна публичная аттестация.
Проверка человеком
Не проверено
Для этого отчета не зафиксирована проверка человеком.
Охват
92 Просканировано файлов · 39,230 Проанализировано строк
57 элементов показано для проверки
Ограничения
Этот отчёт не заявляет о выполнении во время работы или в песочнице и не доказывает отсутствие побочных эффектов.
Цепочка доказательств
Проследите доказательства от привязки источника до контракта установки. Доступные доказательства подтверждают возможность проверки; они не являются гарантией безопасности.
Источник
Коммит и путь привязаны
Артефакт
Хэши содержимого и дерева привязаны
Аудит
Завершено
Обнаруженные возможности
«Обнаружено» означает, что в этом отчете зафиксированы подтверждающие доказательства. «Не зафиксировано» не доказывает отсутствие возможности.
Содержит скрипты
Может выполнять код, включённый в Skill.
Обнаружено в 22 местах расположения доказательств
Доступ к сети
Может подключаться к внешним службам.
Обнаружено в 43 местах расположения доказательств
Доступ к файловой системе
Может читать или записывать локальные файлы.
Обнаружено в 50 местах расположения доказательств
Переменные окружения
Может считывать значения из окружения процесса.
Обнаружено в 15 местах расположения доказательств
Внешние команды
Может вызывать команды или программы вне Навыка.
Обнаружено в 86 местах расположения доказательств
Пункты проверки возможностей (50)
Высокий
Hidden file in home directory
p = os.path.expanduser("~/.gemini/antigravity-cli/settings.json")
The account-phase helper expands and reads the user settings file under ~/.gemini. This accesses provider configuration that may contain sensitive permissions or account settings.
Высокий
Process spawn
return spawn(job, "initial", resume=False, foreground=True)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Process spawn
return spawn(job, "initial", resume=False, foreground=False)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Process spawn
return spawn(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Process spawn
return spawn(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python os.exec variants
os.execvpe(command[0], command, dict(os.environ))
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.Popen
child = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.Popen
controller_process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.Popen
process = subprocess.Popen(argv, cwd=cwd, env=git_env(), stdin=subprocess.DEVNULL, stdout=subprocess
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
return subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
provider_checked = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
canonical_checked = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
result = subprocess.run(command, cwd=cwd, env=git_env(), stdin=subprocess.DEVNULL, stdout=subprocess
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
completed = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
completed = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
return subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
proc = subprocess.run(verify_cmd, check=False)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Высокий
Python subprocess.run
fin_proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Средний
Hidden file access
p = os.path.expanduser("~/.gemini/antigravity-cli/settings.json")
The account-phase helper expands and reads the user settings file under ~/.gemini. This accesses provider configuration that may contain sensitive permissions or account settings.
Средний
Unix shell invocation
/bin/bash -c "${verify_specs[$i]}"
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Средний
Unix shell invocation
/bin/bash -c "${verify_specs[$i]}"
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Средний
Unix shell invocation
SCRIPT_SHELLS = frozenset({"/bin/bash", "/bin/sh"})
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Средний
Unix shell invocation
"/bin/sh", "-c", supervisor, "bounded-git-supervisor",
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Средний
Unix shell invocation
"/bin/bash",
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Низкий
Python environment access
environment = os.environ.copy()
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
if name in os.environ:
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
(os.fsencode(name), b"\0", os.fsencode(os.environ[name]), b"\0")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
os.execvpe(command[0], command, dict(os.environ))
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
environment = os.environ.copy()
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
environment = {name: os.environ[name] for name in allowed if name in os.environ}
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
configured = os.environ.get("XDG_STATE_HOME")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
home_text = os.environ.get("HOME")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
environment = dict(os.environ)
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
env = dict(os.environ)
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
os.environ.get("AGY_WORKER_LOG_DIR") or (state_path.parent / "logs")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Низкий
Python environment access
os.environ.get("AGY_WORKER_LOG_DIR") or (SCRIPTS.parent / "logs")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Результаты оценки рисков
Подтверждённые проблемы безопасности отделены от элементов, которые всё ещё требуют проверки.
Подтверждённые проблемы безопасности (7)
RISK-001 Высокий
Certificate/key files
keychain_path=prepared.keychain.path if prepared.keychain is not None else None,
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-002 Высокий
Certificate/key files
if prepared.keychain is None or prepared.keychain_preferences is None:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-003 Высокий
Certificate/key files
if _bind_keychain(prepared.keychain.path) != prepared.keychain:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-004 Высокий
Certificate/key files
prepared.keychain_preferences.path, modes={0o600}, limit=MAX_PROFILE_BYTES,
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-005 Высокий
Certificate/key files
) != prepared.keychain_preferences:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-006 Высокий
Certificate/key files
prepared.keychain is not None or prepared.keychain_preferences is not None
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
RISK-007 Высокий
External Provider Transmission Without Host Isolation
The skill can transmit a whole disposable worktree to Google or Gemini, while default session mode retains normal user filesystem and network authority without host containment.
The documented workflow explicitly states both the external transmission boundary and the lack of sandbox or native containment in default session mode.
Меры по устранению
В ходе этого аудита были зафиксированы рекомендуемые исправления. Их применение является ответственностью сопровождающего.
- FIX-001ВысокийDefault session mode gives the provider normal user filesystem and network authority.Prefer native containment when supported, or require a prominent explicit warning and approval before session-mode launches.
- FIX-002ВысокийWhole-worktree dispatch can expose every approved worktree entry to the external provider.Prefer provider scopes, reject secrets and private files before staging, and make whole-worktree approval exceptional.
- FIX-003ВысокийEnvironment inheritance and user settings access can expose credentials or provider permissions.Use strict allowlists, keep credential-like variables excluded, and avoid account-phase settings reads unless explicitly requested.
- FIX-004ВысокийShell-based verification can execute arbitrary command text.Use argv verification by default, require a separate shell acknowledgement, and keep the sanitized environment and working directory boundaries enforced.
- FIX-005СреднийStatic review cappedManually review the omitted 591 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-006СреднийProvider and verifier processes execute with meaningful local authority.Bind executable identity, arguments, working directory, permissions, and network policy to approval, then revalidate them immediately before launch.
Экспертные доказательства
Неизменяемая идентификация субъекта, метаданные сканера, отклонённые совпадения и доказательства на уровне источника.
Субъект артефакта
- Коммит Marketplace
- 73b58aaf0aa4d29844f1b4c2acf4f530fc1ae7b9
- Хеш содержимого
- d3ea0b0a3107d1db6755b07b33b1a691df367ad8e639838b6b22150745db642d
- Хеш дерева
- 613e25dca9696bd64b749aaa4bb4deeef8e7dbe2442b4099aab17f779e2334fb
- Путь Skill
- skills/cagdasyurekli/agy-worker
- Хеш данных аудита
- 28435a23082dab2da18878aa039d86a9
Метаданные анализа
Модель аудита: codex
Состояние анализа: Завершено
Область действия ограничена зафиксированными файлами, строками, методами и доказательствами. Выполнение во время работы или в песочнице не заявляется.
Проверить и экспортировать
Отчёт JSON Подписанное подтверждение аудита CITATION.cff SARIF 2.1.0 Подписанный манифест установки Источник
Манифест и lockfile привязывают артефакты установки к криптографическим хешам. Это заявление о целостности не связано с оценкой безопасности.
Аттестация аудита: active