📦

Audit History

nestjs-code-audit - 1 audit

Oct 4, 2026, 08:33 PM

Most static findings match Markdown, JavaScript strings, or ordinary repository inspection rather than threats. Optional checks execute repository-controlled tooling and pass inherited environment variables, creating execution and credential exposure risks. No evidence found of intentional exfiltration or prompt injection in the reviewed files.

Files scanned

839

Lines analyzed

Review items

False positives ignored

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/collect-quality-evidence.mjs:234

Synchronous spawn

const result = spawnSync(command, args, {

With --run, this executes repository-local binaries and ESLint configuration or plugins without isolation. Non-fixing flags do not prevent malicious tooling from writing files or making network requests.

Medium

scripts/collect-quality-evidence.mjs:237

Environment variable object

env: { ...process.env, CI: '1', FORCE_COLOR: '0', NO_COLOR: '1' },

The runner copies every parent environment variable into repository-controlled tools and ESLint plugins. Any inherited credentials become available to that executable code.

Risk Factors

📁 Filesystem access (4)

references/check-policy.md:7 scripts/collect-quality-evidence.mjs:7 scripts/collect-quality-evidence.mjs:134 scripts/collect-quality-evidence.mjs:192

⚙️ External commands (50)

🔑 Env variables (2)

references/report-template.md:47 scripts/collect-quality-evidence.mjs:237

Audited by: codex

← Back to Skill