📦
审计历史
brag-doc-from-git - 1 审计
审计版本 1 最新
2026年10月17日 19:42
All six static findings are false positives involving Markdown formatting, read-only history queries, or ordinary prose. The GitHub search lacks repository filters and can return private repository metadata outside the named scope, despite an explicit prohibition. No evidence found of malicious exfiltration, destructive commands, or prompt injection.
1
已扫描文件
50
分析行数
2
复核项
0
已忽略误报
已确认安全问题 (1)
中
GitHub Search Exceeds Named Repository Scope
The command uses --author @me without repository filters, so it can retrieve titles, URLs, and repository names from unnamed private repositories. This conflicts with the instruction to avoid unnamed private repositories and risks including unauthorized metadata in the draft.
The documented command contains no repository filter, while line 24 explicitly restricts private repository access. Actual exposure depends on authenticated access and matching history.
风险因素
⚙️ 外部命令 (4)
审计者: codex