Versioned security assessment
Report ID: SA-F93E9BB0
7/7/2026, 4:36:10 AM
shareone security assessment v4
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- shareone
- Version
- v4
- Maintainer
- sudoprivacy
- Coverage
- 20 Files scanned · 1,935 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
8 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most external command, system reconnaissance, and obfuscation alerts are false positives from JavaScript template literals, Markdown examples, and multilingual prose. Real security concerns remain around external ShareOne network egress, local file reads for upload, plaintext credential storage, full API key output, and a user-controlled API base URL that can receive authenticated requests.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
20 Files scanned · 1,935 Lines analyzed
82 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 8 evidence locations
Filesystem access
May read or write local files.
Observed in 9 evidence locations
Env variables
May read values from the process environment.
Observed in 57 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 86 evidence locations
Capability review items (74)
High
Generic API/secret keys
let apiKey = process.env.SHAREONE_API_KEY || readLocalApiKey();
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
if (result.api_key) {
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
await saveSudoworkApiKey(result.api_key);
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
console.log(`ERROR:SUDOWORK_AUTH_PROXY_SAVE_FAILED:${result.api_key}`);
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
saveLocalApiKey(result.api_key);
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
console.log(`GUEST_KEY_CREATED:${result.api_key}`);
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
return data && data.api_key ? data.api_key : null;
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
return explicitApiKey || process.env.SHAREONE_API_KEY || readLocalApiKey();
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify({ api_key: apiKey }));
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
- `KEY_FOUND:<api_key>`:当前是普通 AI Agent 环境,且已找到 API Key。
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
- 普通 AI Agent:可以使用 `--api-key`、环境变量 `SHAREONE_API_KEY` 或本地凭证文件。
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
- 如果 `create_guest_key.js` 输出 `GUEST_KEY_CREATED:<api_key>`,必须立即向用户发送临时 API Key、绑定账号链接和保存提醒。即使 key 已
The workflow places an API key into a URL query string, which can leak through logs, history, or referrers. This is real credential exposure risk.
High
Generic API/secret keys
- `KEY_FOUND:<api_key>`:当前是普通 AI Agent 环境。将该 API Key 用于后续 direct 模式发布请求。
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
node scripts/save_api_key.js <用户提供的KEY>
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
如果输出 `GUEST_KEY_CREATED:<api_key>`,这是阻塞性用户通知。必须先回复用户以下内容,然后才能继续原操作:
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
> 已为您自动分配临时 API Key:`<api_key>`
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
> 绑定账号链接:https://shareone.app/?key=<api_key>
The workflow places an API key into a URL query string, which can leak through logs, history, or referrers. This is real credential exposure risk.
High
Generic API/secret keys
如果输出 `ERROR:SUDOWORK_AUTH_PROXY_SAVE_FAILED:<api_key>`,暂停操作并提示:
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
> 已为您自动分配临时 API Key:`<api_key>`
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
node scripts/save_api_key.js <用户提供的KEY>
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
确认输出 `KEY_FOUND:<api_key>` 后继续原操作。
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
如果输出 `GUEST_KEY_CREATED:<api_key>`,这是阻塞性用户通知。必须先回复用户以下内容,然后才能继续原操作:
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
> 已为您自动分配临时 API Key:`<api_key>`
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
> 绑定账号链接:https://shareone.app/?key=<api_key>
The workflow places an API key into a URL query string, which can leak through logs, history, or referrers. This is real credential exposure risk.
High
Generic API/secret keys
普通 AI Agent 环境会把临时 API Key 保存到本地凭证文件。即使保存成功,也不能省略上面的用户通知。后续也可以使用环境变量 `SHAREONE_API_KEY` 或命令参数 `--api
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
- 普通 AI Agent:可以传 `--api-key`,也可以依赖 `SHAREONE_API_KEY` 或本地凭证。
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
- 普通 AI Agent 环境可传 `--api-key`,也可以依赖 `SHAREONE_API_KEY` 或本地凭证。
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
- 普通 AI Agent 环境可传 `--api-key`,也可以依赖 `SHAREONE_API_KEY` 或本地凭证。
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
- 普通 AI Agent 环境可传 `--api-key`,也可以依赖 `SHAREONE_API_KEY` 或本地凭证。
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
High
Generic API/secret keys
- 普通 AI Agent 环境可传 `--api-key`,也可以依赖 `SHAREONE_API_KEY` 或本地凭证。
The cited line reads, stores, passes, or displays ShareOne API key material. This is intentional credential handling and should be treated as sensitive.
Medium
Node.js fs operations
const data = JSON.parse(fs.readFileSync(CREDENTIALS_PATH, 'utf8'));
The code reads, writes, or deletes a local credentials file containing the ShareOne API key. That is intentional but security-sensitive filesystem access.
Medium
Node.js fs operations
fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify({ api_key: apiKey }));
The code reads, writes, or deletes a local credentials file containing the ShareOne API key. That is intentional but security-sensitive filesystem access.
Medium
Node.js fs operations
fs.unlinkSync(CREDENTIALS_PATH);
The code reads, writes, or deletes a local credentials file containing the ShareOne API key. That is intentional but security-sensitive filesystem access.
Medium
Synchronous file operations
const data = JSON.parse(fs.readFileSync(CREDENTIALS_PATH, 'utf8'));
The code reads, writes, or deletes a local credentials file containing the ShareOne API key. That is intentional but security-sensitive filesystem access.
Medium
Synchronous file operations
fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify({ api_key: apiKey }));
The code reads, writes, or deletes a local credentials file containing the ShareOne API key. That is intentional but security-sensitive filesystem access.
Medium
Node.js fs operations
const fileData = fs.readFileSync(filePath);
The script reads or checks a user-selected local file before uploading it to ShareOne. This is expected capability but real local file access.
Medium
Node.js fs operations
const fileData = fs.readFileSync(filePath);
The script reads or checks a user-selected local file before uploading it to ShareOne. This is expected capability but real local file access.
Medium
Synchronous file operations
const fileData = fs.readFileSync(filePath);
The script reads or checks a user-selected local file before uploading it to ShareOne. This is expected capability but real local file access.
Medium
Synchronous file operations
const fileData = fs.readFileSync(filePath);
The script reads or checks a user-selected local file before uploading it to ShareOne. This is expected capability but real local file access.
Medium
Node.js fs operations
const content = fs.readFileSync(filePath, "utf-8");
The script reads or checks a user-selected local file before uploading it to ShareOne. This is expected capability but real local file access.
Medium
Synchronous file operations
const content = fs.readFileSync(filePath, "utf-8");
The script reads or checks a user-selected local file before uploading it to ShareOne. This is expected capability but real local file access.
Low
Environment variable access (dot notation)
let apiKey = process.env.SHAREONE_API_KEY || readLocalApiKey();
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
Environment variable object
let apiKey = process.env.SHAREONE_API_KEY || readLocalApiKey();
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
HTTP client library
const req = client.request(target, {
The script constructs outbound HTTP or HTTPS requests to ShareOne or configured endpoints. This is necessary for the skill but is real network egress.
Low
Hardcoded URL
const DEFAULT_BASE_URL = 'https://shareone.app';
The script constructs outbound HTTP or HTTPS requests to ShareOne or configured endpoints. This is necessary for the skill but is real network egress.
Low
Node.js fs stat operations
if (!fs.existsSync(CREDENTIALS_PATH)) return null;
The code reads, writes, or deletes a local credentials file containing the ShareOne API key. That is intentional but security-sensitive filesystem access.
Low
Node.js fs stat operations
if (!fs.existsSync(CREDENTIALS_PATH)) return false;
The code reads, writes, or deletes a local credentials file containing the ShareOne API key. That is intentional but security-sensitive filesystem access.
Low
Environment variable access (dot notation)
return Boolean(process.env.SUDOWORK_AUTH_PROXY_URL && process.env.SUDOWORK_AUTH_PROXY_TOKEN);
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
Environment variable access (dot notation)
return process.env.SUDOWORK_AUTH_PROXY_BASE_URL || String(process.env.SUDOWORK_AUTH_PROXY_URL || '')
The code reads environment-controlled proxy endpoints used for authenticated ShareOne requests. This is expected but relevant to request routing.
Low
Environment variable access (dot notation)
return process.env.SHAREONE_BASE_URL || DEFAULT_BASE_URL;
The environment variable controls the outbound API base URL. This is configuration access, but it can redirect credentialed requests if untrusted.
Low
Environment variable access (dot notation)
return explicitApiKey || process.env.SHAREONE_API_KEY || readLocalApiKey();
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
Environment variable access (dot notation)
Authorization: `Bearer ${process.env.SUDOWORK_AUTH_PROXY_TOKEN}`,
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
Environment variable access (dot notation)
url: process.env.SUDOWORK_AUTH_PROXY_URL,
The code reads environment-controlled proxy endpoints used for authenticated ShareOne requests. This is expected but relevant to request routing.
Low
Environment variable access (dot notation)
Authorization: `Bearer ${process.env.SUDOWORK_AUTH_PROXY_TOKEN}`,
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
Environment variable object
return Boolean(process.env.SUDOWORK_AUTH_PROXY_URL && process.env.SUDOWORK_AUTH_PROXY_TOKEN);
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
Environment variable object
return process.env.SUDOWORK_AUTH_PROXY_BASE_URL || String(process.env.SUDOWORK_AUTH_PROXY_URL || '')
The code reads environment-controlled proxy endpoints used for authenticated ShareOne requests. This is expected but relevant to request routing.
Low
Environment variable object
return process.env.SHAREONE_BASE_URL || DEFAULT_BASE_URL;
The environment variable controls the outbound API base URL. This is configuration access, but it can redirect credentialed requests if untrusted.
Low
Environment variable object
return explicitApiKey || process.env.SHAREONE_API_KEY || readLocalApiKey();
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
Environment variable object
Authorization: `Bearer ${process.env.SUDOWORK_AUTH_PROXY_TOKEN}`,
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
Environment variable object
url: process.env.SUDOWORK_AUTH_PROXY_URL,
The code reads environment-controlled proxy endpoints used for authenticated ShareOne requests. This is expected but relevant to request routing.
Low
Environment variable object
Authorization: `Bearer ${process.env.SUDOWORK_AUTH_PROXY_TOKEN}`,
The code reads secret-bearing environment variables used for ShareOne or Sudowork authentication. This is expected but sensitive.
Low
Node.js fs stat operations
if (!fs.existsSync(filePath)) {
The script reads or checks a user-selected local file before uploading it to ShareOne. This is expected capability but real local file access.
Low
Environment variable access (dot notation)
process.env.SHAREONE_BASE_URL = args[++i];
The environment variable controls the outbound API base URL. This is configuration access, but it can redirect credentialed requests if untrusted.
Low
Environment variable object
process.env.SHAREONE_BASE_URL = args[++i];
The environment variable controls the outbound API base URL. This is configuration access, but it can redirect credentialed requests if untrusted.
Low
Environment variable access (dot notation)
process.env.SHAREONE_BASE_URL = explicitBaseUrl;
The environment variable controls the outbound API base URL. This is configuration access, but it can redirect credentialed requests if untrusted.
Low
Environment variable access (dot notation)
process.env.SHAREONE_BASE_URL = `${parsed.protocol}//${parsed.host}`;
The environment variable controls the outbound API base URL. This is configuration access, but it can redirect credentialed requests if untrusted.
Low
Environment variable object
process.env.SHAREONE_BASE_URL = explicitBaseUrl;
The environment variable controls the outbound API base URL. This is configuration access, but it can redirect credentialed requests if untrusted.
Low
Environment variable object
process.env.SHAREONE_BASE_URL = `${parsed.protocol}//${parsed.host}`;
The environment variable controls the outbound API base URL. This is configuration access, but it can redirect credentialed requests if untrusted.
Low
Hardcoded URL
- "帮我下载这个 ShareOne 链接的文件:https://shareone.app/s/xxx"
The skill documentation intentionally routes users to ShareOne URLs. This is expected behavior but confirms external network interaction.
Low
Hardcoded URL
- "拉取一下这个链接的评论:https://shareone.app/s/xxx"
The skill documentation intentionally routes users to ShareOne URLs. This is expected behavior but confirms external network interaction.
Low
Hardcoded URL
- "给这个 ShareOne 链接加水印:https://shareone.app/s/xxx"
The skill documentation intentionally routes users to ShareOne URLs. This is expected behavior but confirms external network interaction.
Low
Hardcoded URL
- "根据这个链接的评论修改页面:https://shareone.app/s/xxx"
The skill documentation intentionally routes users to ShareOne URLs. This is expected behavior but confirms external network interaction.
Low
Hardcoded URL
- "修改这个 ShareOne 链接的内容:https://shareone.app/s/xxx"
The skill documentation intentionally routes users to ShareOne URLs. This is expected behavior but confirms external network interaction.
Low
Hardcoded URL
import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs';
The workflow recommends loading Mermaid from a public CDN in generated HTML. That is expected but creates third-party network dependency for published pages.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (8)
RISK-001 Critical
scripts/update_share_settings.js:98-103scripts/shareone_client.js:164-190workflows/update-share-settings.md:28-31
User-Controlled API Host Can Receive Credentials
update_share_settings.js derives SHAREONE_BASE_URL from a full user-provided URL, then shareone_client.js attaches ShareOne credentials to requests built from that base URL. A malicious non-ShareOne origin could receive API keys or proxy-injected credentials during an update request.
The code directly assigns the API base URL from the parsed input URL origin and later sends authenticated requests to getBaseUrl(). This is a concrete credential exfiltration path if the input origin is attacker controlled.
RISK-002 High
Environment file access
let apiKey = process.env.SHAREONE_API_KEY || readLocalApiKey();
The code accesses secret-bearing environment variables or local API key material for authentication. This is expected but sensitive credential access.
RISK-003 High
Environment file access
return Boolean(process.env.SUDOWORK_AUTH_PROXY_URL && process.env.SUDOWORK_AUTH_PROXY_TOKEN);
The code accesses secret-bearing environment variables or local API key material for authentication. This is expected but sensitive credential access.
RISK-004 High
Environment file access
return explicitApiKey || process.env.SHAREONE_API_KEY || readLocalApiKey();
The code accesses secret-bearing environment variables or local API key material for authentication. This is expected but sensitive credential access.
RISK-005 High
Environment file access
Authorization: `Bearer ${process.env.SUDOWORK_AUTH_PROXY_TOKEN}`,
The code accesses secret-bearing environment variables or local API key material for authentication. This is expected but sensitive credential access.
RISK-006 High
Environment file access
Authorization: `Bearer ${process.env.SUDOWORK_AUTH_PROXY_TOKEN}`,
The code accesses secret-bearing environment variables or local API key material for authentication. This is expected but sensitive credential access.
RISK-007 High
scripts/check_api_key.js:18-20scripts/create_guest_key.js:16-31workflows/environment-and-credentials.md:60-64workflows/environment-and-credentials.md:113-119
API Keys Are Printed to Output and Chat Workflows
check_api_key.js prints KEY_FOUND with the full API key, and create_guest_key.js prints generated keys. The workflow also instructs the agent to display generated keys and key-bearing account binding links to the user, which can expose credentials in transcripts and logs.
The cited code and workflow explicitly output full API key values. This is not just secret access; it is intentional disclosure through process output and chat instructions.
RISK-008 High
Local API Key Stored Without Permission Hardening
shareone_client.js writes the ShareOne API key as plaintext JSON in the user home directory without setting restrictive file permissions. Other local users or backup tools could read the credential depending on the environment.
The credential path and write call are explicit, and there is no chmod or atomic permission handling nearby. The impact depends on host file permissions, so confidence is high but not absolute.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalUser-provided URLs can control the API base URL for credentialed update requests.Allowlist trusted ShareOne origins and reject or normalize non-ShareOne hosts before attaching API keys or proxy credentials.
- FIX-002HighScripts and workflows expose full API keys in stdout, chat, and key-bearing URLs.Return only redacted key status, avoid key query strings, and pass secrets through a protected secret store or stdin when needed.
- FIX-003HighLocal API keys are stored as plaintext without explicit file permission hardening.Write credentials with mode 0600, avoid broad-readable files, and prefer OS keychain or managed secret storage.
- FIX-004MediumThe generic API request helper can send authenticated requests to broad ShareOne paths.Restrict allowed paths and methods to the documented workflows or require explicit user approval for administrative calls.
- FIX-005MediumThe skill uploads local content to an external public sharing service.Keep the explicit publish confirmation step and clearly warn users before uploading confidential or regulated content.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable