📦
Audit History
carbon-data-asset-expert - 1 audit
Audit version 1 Latest
Sep 27, 2026, 03:02 AM
All 18 static findings are false positives caused by documentation paths, Markdown formatting, ordinary website links, or Chinese plain text. A separate medium-risk concern remains because the guidance promotes a named commercial carbon-token product without independent due diligence or conflict disclosure.
4
Files scanned
393
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
references/knowledge-base.md:97references/knowledge-base.md:120-124references/knowledge-base.md:182-185
Commercial Carbon-Token Steering
The knowledge base directs users toward WorldCarbon subscription, partner, issuance, and RWA materials. It lacks independent due diligence and a clear commercial conflict disclosure.
The named product is repeatedly presented as the preferred RWA implementation example, including purchase and partner materials. The text gives compliance caveats but no independent evaluation process.
Risk Factors
📁 Filesystem access (7)
⚙️ External commands (3)
🌐 Network access (2)
Audited by: codex