Versioned security assessment
Report ID: SA-4A1D5A3C
8/17/2026, 5:52:28 AM
shareone security assessment v6
Skill Security Certification Report
Scanner version 3.0.0 Audit model: codex Latest published report
- Skill name
- shareone
- Version
- v1.2.10
- Maintainer
- sudoprivacy
- Coverage
- 41 Files scanned · 4,419 Lines analyzed
- Policy version
- skillstore-security-audit-policy-v1
Highest confirmed finding severity
Critical
9 confirmed security findings require attention.
Installation context
Check the current Skill page
This page summarizes report evidence only. The Skill page provides the canonical install advisory.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The audit confirmed remote pipe-to-shell execution, unsafe filename insertion into HTML, transcript exposure of guest keys, and authenticated requests to caller-selected origins. Most scanner matches are false positives from documentation, JavaScript template literals, loopback tests, and expected CLI file or network operations. No prompt injection or obfuscated payload evidence was found. Static review was capped at 400/531 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Report position
Latest published report
Latest refers to the report sequence, not to artifact currentness.
Audit attestation
Active attestation
A public attestation is available for this exact report.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
41 Files scanned · 4,419 Lines analyzed
32 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Commit and path bound
Artifact
Content and tree hashes bound
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 4 evidence locations
Network access
May connect to external services.
Observed in 40 evidence locations
Filesystem access
May read or write local files.
Observed in 35 evidence locations
Env variables
May read values from the process environment.
Observed in 43 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 50 evidence locations
Capability review items (23)
Critical
Hardcoded URL
curl -fsSL https://skillhub.cn/install/install.sh | bash -s -- --cli-only
This URL supplies the unpinned installer executed through Bash on the same line, creating a direct remote code execution supply-chain risk.
High
Generic API/secret keys
console.log(`GUEST_KEY_CREATED:${result.api_key}`);
This outputs or requires relaying a newly issued API key through the agent transcript, exposing a bearer credential to logs and conversation retention.
High
Generic API/secret keys
console.log(`GUEST_KEY_CREATED:${result.api_key}`);
This outputs or requires relaying a newly issued API key through the agent transcript, exposing a bearer credential to logs and conversation retention.
High
Generic API/secret keys
console.log(`GUEST_KEY_CREATED:${result.api_key}`);
This outputs or requires relaying a newly issued API key through the agent transcript, exposing a bearer credential to logs and conversation retention.
High
Generic API/secret keys
console.log(guestKeyNotification(result.api_key));
This outputs or requires relaying a newly issued API key through the agent transcript, exposing a bearer credential to logs and conversation retention.
High
Generic API/secret keys
- 如果 `ensure_credentials.js --create-guest` 或底层 `create_guest_key.js` 输出 `GUEST_KEY_CREATED:<api_key
This outputs or requires relaying a newly issued API key through the agent transcript, exposing a bearer credential to logs and conversation retention.
High
Generic API/secret keys
- `GUEST_KEY_CREATED:<api_key>`:**阻塞性用户通知**。分隔线之后是需要原样转发给用户的完整通知文本(含临时 API Key、绑定账号链接和保存提醒)。必须先把该通知发
This outputs or requires relaying a newly issued API key through the agent transcript, exposing a bearer credential to logs and conversation retention.
High
innerHTML assignment (XSS risk)
chip.innerHTML = '<span class="name">📄 ' + file.name + '</span><span class="meta">' + human(file.si
A local filename is concatenated into innerHTML without escaping, so a crafted filename can inject executable markup into the published page.
High
Environment variable access (dot notation)
process.env.SHAREONE_BASE_URL = explicitBaseUrl;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable access (dot notation)
process.env.SHAREONE_BASE_URL = `${parsed.protocol}//${parsed.host}`;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable access (dot notation)
return process.env.SHAREONE_BASE_URL || DEFAULT_BASE_URL;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable access (dot notation)
process.env.SHAREONE_BASE_URL = nextValue(i, args[i]);
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable access (dot notation)
process.env.SHAREONE_BASE_URL = explicitBaseUrl;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable access (dot notation)
process.env.SHAREONE_BASE_URL = host === 'shareone.vip' || host.endsWith('.shareone.vip')
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable access (dot notation)
process.env.SHAREONE_BASE_URL = nextValue(i, args[i]);
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable object
process.env.SHAREONE_BASE_URL = explicitBaseUrl;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable object
process.env.SHAREONE_BASE_URL = `${parsed.protocol}//${parsed.host}`;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable object
return process.env.SHAREONE_BASE_URL || DEFAULT_BASE_URL;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable object
process.env.SHAREONE_BASE_URL = nextValue(i, args[i]);
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable object
process.env.SHAREONE_BASE_URL = explicitBaseUrl;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable object
process.env.SHAREONE_BASE_URL = host === 'shareone.vip' || host.endsWith('.shareone.vip')
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
High
Environment variable object
process.env.SHAREONE_BASE_URL = nextValue(i, args[i]);
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
Medium
Hardcoded URL
import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs';
The generated page imports a floating major-version script from a CDN without integrity verification, exposing published pages to dependency compromise.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (9)
RISK-001 Critical
Pipe to shell pattern
curl -fsSL https://skillhub.cn/install/install.sh | bash -s -- --cli-only
The workflow downloads an unpinned remote installer and immediately pipes it to Bash, allowing upstream compromise to execute arbitrary code.
RISK-002 High
Environment file access
process.env.SHAREONE_BASE_URL = explicitBaseUrl;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
RISK-003 High
Environment file access
process.env.SHAREONE_BASE_URL = `${parsed.protocol}//${parsed.host}`;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
RISK-004 High
Environment file access
return process.env.SHAREONE_BASE_URL || DEFAULT_BASE_URL;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
RISK-005 High
Environment file access
process.env.SHAREONE_BASE_URL = nextValue(i, args[i]);
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
RISK-006 High
Environment file access
process.env.SHAREONE_BASE_URL = explicitBaseUrl;
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
RISK-007 High
Environment file access
process.env.SHAREONE_BASE_URL = host === 'shareone.vip' || host.endsWith('.shareone.vip')
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
RISK-008 High
Environment file access
process.env.SHAREONE_BASE_URL = nextValue(i, args[i]);
This accepts or propagates a caller-controlled API origin that later receives authenticated ShareOne requests, enabling credential disclosure to an untrusted host.
RISK-009 High
scripts/manage_collaborators.js:89-93scripts/update_share_settings.js:92-99scripts/upload_page.js:52-53scripts/shareone_client.js:415-418
Authenticated Requests Can Target Arbitrary Origins
Full share URLs and --base-url can select an arbitrary API origin. Direct mode then attaches the ShareOne API key to requests sent there.
The origin is derived from caller input, while direct authenticated requests add X-API-Key without an origin allowlist or HTTPS requirement.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalThe SkillHub workflow executes an unpinned remote installer through Bash.Download a versioned artifact, verify a pinned checksum or signature, and execute only after verification.
- FIX-002HighAuthenticated API requests can use a caller-controlled origin.Require HTTPS, allowlist trusted ShareOne origins, and attach credentials only after exact origin validation.
- FIX-003HighA filename is inserted into innerHTML without escaping.Create elements with textContent and set the filename as text instead of HTML.
- FIX-004HighGuest API keys are printed and relayed through agent transcripts.Return a one-time retrieval link or store the key directly without printing the bearer value.
- FIX-005MediumStatic review cappedManually review the omitted 131 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-006MediumGenerated pages load a floating Mermaid version from a third-party CDN.Self-host a pinned Mermaid build or verify an exact immutable asset before publication.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- 4a1d5a3cacc2dca08f354afcc67d19c7cd5c5ed4
- Content hash
- 4df13a89d426c3a70d0a1f334bfca3979cf66be745e11f71ec2fec6fe567fef1
- Tree hash
- 4a1e9c87e868f6cb9cd775b67b8367a74bc9a751a083d69dac735b6c1032ff42
- Skill path
- skills/sudoprivacy/shareone
- Audit payload hash
- f0c919df9b1a8dc72fb691de99e85dd0
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: active