此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-18789A6C
10/13/2026, 2:45:11 PM
spawn 安全评估 v12
Skill 安全认证报告
扫描器版本 3.0.0 审计模型: codex 最新发布的报告
- 技能名称
- spawn
- 版本
- v12
- 维护者
- Consiliency
- 覆盖范围
- 12 已扫描文件 · 1,587 分析行数
- 策略版本
- skillstore-security-audit-policy-v1
已确认问题的最高严重性
高
有 1 个已确认的安全问题需要处理。
安装上下文
请查看当前 Skill 详情页
本页仅汇总报告证据。Skill 详情页提供 canonical install advisory。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
The 86 findings include real shell quoting and temporary-file risks, alongside false positives from documentation, platform detection, and dictionary operations. Provider instructions also recommend disabling approval safeguards and, for Codex, the sandbox. No evidence found of credential theft, concealed malware, or instructions to manipulate this audit.
报告位置
最新发布的报告
“最新”仅指报告序列，不代表 artifact 当前有效。
审计证明
有效证明
此精确报告有可公开验证的证明。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
12 已扫描文件 · 1,587 分析行数
有 24 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
已绑定 commit 与路径
构件
已绑定内容与 tree hash
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
本次审计未记录
文件系统访问
可能读取或写入本地文件。
在 23 个证据位置观察到
环境变量
可能读取进程环境中的值。
在 3 个证据位置观察到
外部命令
可能调用 Skill 之外的命令或程序。
在 48 个证据位置观察到
能力复核项 (23)
高
Python subprocess.run
subprocess.run(
The AppleScript contains unescaped shell_cmd text, including unquoted cwd. Quotes or metacharacters in directory names can change the executed script.
高
Python subprocess.run
subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)
The fallback interpolates command into nested Unix and Windows shell text with shell=True. Embedded quotes can cross parser boundaries and execute unintended commands.
高
Python subprocess.Popen
subprocess.Popen(wt_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
The argument list launches PowerShell with generated script text. POSIX shlex.quote does not safely escape PowerShell cwd values, allowing directory text to become code.
高
Python subprocess.Popen
subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)
Caller-supplied command text is executed with shell=True and no restricted argument mode. Legitimate shell use is intended, but untrusted interpolated data can execute commands.
高
Python subprocess.Popen
subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)
The debug path executes arbitrary command text with shell=True. The caller trust boundary is unspecified, so unsafe interpolation remains a risk.
高
Python subprocess.Popen
subprocess.Popen(command, shell=True, cwd=cwd)
The fallback passes caller-supplied command directly to shell=True without validation. Requested shell execution is legitimate, but untrusted command construction is not protected.
高
PowerShell invocation
"wt.exe", "-w", "new", "powershell.exe",
PowerShell receives generated script text using POSIX quoting for cwd. That mismatch can interpret directory-name characters as PowerShell syntax.
高
Windows cmd.exe
subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)
Command text is embedded in a cmd.exe command passed through another shell. Missing parser-specific escaping permits unintended interpretation of embedded quotes and metacharacters.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
Agent output is written by tee into shared /tmp without private permissions or exclusive creation. Sensitive responses may be readable under common umasks.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
Debug logs collect terminal output in shared /tmp without permission hardening. Logs may expose sensitive output to other local users.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The completion marker is not securely created or checked for ownership. Another local user who discovers the filename can spoof completion.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
The WSL script writes agent output into shared /tmp through tee. No private directory, restrictive permissions, or exclusive creation protects the response.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The WSL debug log stores full terminal output in shared /tmp. Its creation does not enforce privacy or resist existing symlinks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The WSL completion marker uses a shared temporary path without exclusive creation or ownership verification. A local attacker can spoof its existence.
中
Temp directory access
script_file = f"/tmp/fork-script-{output_id}.sh"
A shell script containing caller commands is placed directly in shared /tmp. Later nonexclusive creation and permissions 0755 expose its contents and permit symlink attacks.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
The tmux branch saves agent output in shared /tmp using tee. It does not ensure private permissions or exclusive file creation.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The tmux debug path stores terminal output in a shared temporary file. Sensitive output can remain readable under common umasks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The tmux completion marker has no secure creation or ownership checks. Its existence can be spoofed by another local user.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
Background execution writes responses into shared /tmp without permission hardening. Sensitive agent output can be exposed to other local users.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The background debug file collects stdout and stderr without private permissions or exclusive creation. This creates disclosure and symlink risks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The background completion marker is placed in shared /tmp and checked only for existence. Local users can forge completion after discovering its path.
中
Python file write/append
with open(script_file, 'w') as f:
open(script_file, 'w') follows existing symlinks and truncates their targets. The script is created in shared /tmp without exclusive or no-follow flags.
中
Python os file operations
os.chmod(script_file, 0o755)
chmod sets command-bearing scripts to 0755, exposing prompts to other local users. It also follows a substituted symlink when changing target permissions.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (1)
RISK-001 高
agent/cookbook/codex-cli.md:44-46agent/cookbook/codex-cli.md:69-83agent/cookbook/cursor-cli.md:40-43
Approval and sandbox safeguards disabled by default
The Codex cookbook says: "Always run with `--dangerously-bypass-approvals-and-sandbox` for full auto mode". Cursor similarly recommends force-allowing commands, increasing exposure to destructive actions and injected repository instructions.
These are explicit operational instructions to remove approval controls, not merely flag descriptions. Codex examples also disable sandboxing.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001高Provider cookbooks recommend bypassing approvals and sandbox protections.Keep approvals and workspace confinement enabled by default. Require explicit user consent before enabling unrestricted execution.
- FIX-002高The macOS launcher inserts cwd and commands into shell and AppleScript text without correct escaping.Quote cwd for the shell and escape AppleScript strings separately. Reject malformed inputs and test quotes, spaces, and shell metacharacters.
- FIX-003高Windows uses POSIX quoting for PowerShell, and the WSL fallback interpolates command text across multiple shell parsers.Use platform-specific argument handling and avoid nested shell interpolation. Test directory names and prompts containing quotes and metacharacters.
- FIX-004高Background execution accepts arbitrary shell strings without a restricted execution boundary.Offer an argument-list execution mode without shell=True. Require confirmation for shell mode and treat prompts and filenames as data.
- FIX-005中Output, completion markers, and executable scripts use shared temporary paths without secure creation or private permissions.Create a private temporary directory with exclusive file creation. Use permissions 0600 for logs and 0700 for scripts, then remove artifacts.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 18789a6c1a8a9ebc818b76ac8686bbd38eb802a8
- 内容哈希
- 6e33576dcdea5824d6a486f854a089549fe3520627d0bae4d0f41a48220d4175
- 目录树哈希
- a92bcb1c88fe565c8883adb9bf6c07b1bc13ca512914608e5abd34f6470511fd
- Skill 路径
- skills/consiliency/spawn
- 审计载荷哈希
- 832fac0330b781f0197473c63359bca3
分析元数据
审计模型: codex
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: active