此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-2CC4D38C
7/5/2026, 8:15:58 AM
dependency-auditor 安全评估 v7
Skill 安全认证报告
审计模型: codex 历史报告
- 技能名称
- dependency-auditor
- 版本
- v7
- 维护者
- CuriousLearner
- 覆盖范围
- 1 已扫描文件 · 753 分析行数
- 策略版本
- 不可用
已确认问题摘要
未发现已确认的安全问题
已完成的审计没有记录已确认的安全问题，但这不证明该 Skill 没有副作用。
安装上下文
历史证据
本报告可能无法描述当前可安装的 artifact。请打开当前 Skill 详情页查看安装建议。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
The skill is a legitimate dependency-auditing guide with no evidence of prompt injection or malicious data exfiltration. Most static findings are Markdown fence or documentation false positives, but several package-manager, scanner, CI, and Snyk commands are real execution risks that require user confirmation.
报告位置
历史报告
使用本报告安装前，请先查看审计历史。
审计证明
无法签发证明
所需的不可变绑定不完整。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
1 已扫描文件 · 753 分析行数
有 23 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
绑定不可用
构件
身份信息不完整
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 9 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
本次审计未记录
环境变量
可能读取进程环境中的值。
本次审计未记录
外部命令
可能调用 Skill 之外的命令或程序。
在 58 个证据位置观察到
能力复核项 (23)
中
Ruby/shell backtick execution
```bash
The bash block lists npm, yarn, pnpm, npx, Snyk, and audit-ci commands, including npm audit fix. These external commands can modify dependencies or contact third-party services.
中
Ruby/shell backtick execution
```bash
The bash block instructs running pip-audit, safety, and bandit against the project. This is legitimate audit behavior, but it executes local tooling and reads project files.
中
Ruby/shell backtick execution
```bash
The bash block runs Go vulnerability tools and pipes module data to nancy. This executes external tooling over project dependency data.
中
Ruby/shell backtick execution
```bash
The bash block runs bundle audit commands, including an update of the advisory database. This is legitimate but still invokes external dependency tooling.
中
Ruby/shell backtick execution
```bash
The bash block runs Maven dependency-check and Snyk. These commands execute external scanners and may contact third-party services.
中
Ruby/shell backtick execution
```bash
The bash block runs dotnet package vulnerability checks against the project. It is read-only, but still executes external tooling on local project metadata.
中
Ruby/shell backtick execution
```bash
The remediation block includes npm install and npm update commands. These commands can modify dependency manifests and lockfiles.
中
Ruby/shell backtick execution
```bash
The remediation block instructs npm install for sequelize. This can change dependency state and retrieve packages from the registry.
中
Ruby/shell backtick execution
```bash
The remediation block instructs npm update mocha and dependency resolution changes. This can alter the dependency graph and lockfiles.
中
Ruby/shell backtick execution
```bash
The remediation block instructs npm install for marked. This can change project dependencies and fetch packages from the registry.
中
Ruby/shell backtick execution
```bash
The remediation block instructs npm install for express-fileupload. This can change project dependencies and fetch packages from the registry.
中
Ruby/shell backtick execution
```javascript
The migration example includes npm install and npm uninstall commands. These package manager actions can modify the project dependency set.
中
Ruby/shell backtick execution
```bash
The bash block instructs uninstalling node-uuid and installing uuid. These package manager actions modify dependencies and lockfiles.
中
Ruby/shell backtick execution
```bash
The remediation plan runs npm install and npm test as part of a hotfix workflow. These commands change dependencies and execute project scripts.
中
Ruby/shell backtick execution
```bash
The high-priority remediation plan runs npm install, npm update, npm test, and npm run test:e2e. These commands modify dependencies and execute project scripts.
中
Ruby/shell backtick execution
```bash
The remediation plan runs npm install and npm uninstall commands. These commands alter dependency state and may require migration testing.
中
Ruby/shell backtick execution
```bash
The maintenance block runs npm update, npm outdated, and npm prune. These commands can alter installed dependencies or inspect project state.
中
Ruby/shell backtick execution
```yaml
The CI workflow example runs npm ci, npm audit, and npm outdated. This configures external command execution in automation.
中
Ruby/shell backtick execution
```bash
The pre-commit hook block runs npm audit from a shell hook. This adds automatic local command execution before commits.
中
Ruby/shell backtick execution
```bash
The continuous monitoring block installs Snyk globally, runs authentication, and sends monitoring data. This executes networked third-party tooling.
中
Unix shell invocation
#!/bin/sh
The shebang is part of a pre-commit shell hook example that runs npm audit. This is legitimate, but it configures local shell execution.
低
HTTP client library
npm install axios
The npm install command retrieves axios from the package registry. This is legitimate remediation guidance, but it requires network access.
低
HTTP client library
npm install axios@1.6.0
The npm install command retrieves axios from the package registry. This is legitimate remediation guidance, but it requires network access.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
此次已完成的审计未记录已确认的安全发现。
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001中Package-manager commands can modify dependency files and lockfiles.State that install, update, uninstall, prune, and audit fix commands require explicit user confirmation and a clean working tree.
- FIX-002中Examples mix read-only audits with remediation commands.Separate audit-only commands from dependency-changing remediation steps, and recommend staging tests before applying fixes.
- FIX-003低Third-party scanners and registries require network access.Disclose when Snyk, npx, npm, pip-audit, or other tools may contact external services or registries.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 不可用
- 内容哈希
- 不可用
- 目录树哈希
- 不可用
- Skill 路径
- 不可用
- 审计载荷哈希
- 不可用
分析元数据
审计模型: codex
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: not_attestable