技能 astrale-cli 审计历史
📦

审计历史

astrale-cli - 1 审计

2026年10月10日 14:10

All 269 static findings are documentation false positives, including Markdown delimiters, example URLs, and descriptions of owner-private credential caches. Token examples introduce one semantic risk by passing bearer credentials through command-line arguments. No evidence found of prompt injection, malicious exfiltration, or unauthorized execution; external CLI implementation was not included.

1
已扫描文件
631
分析行数
4
复核项
0
已忽略误报

已确认安全问题 (1)

中
Bearer Credentials Exposed Through Command Arguments
The examples pass minted bearer credentials using --creds "$TOKEN" and --creds "$(astrale token --raw)". Shell expansion places credentials in process arguments, potentially exposing them to process inspection or execution logging while tokens remain valid.
The examples directly expand bearer credentials into argv. Exposure depends on local process visibility and logging; short token lifetimes reduce the exploitation window.
审计者: codex