📦

审计历史

ai-image-generation - 1 审计

2026年10月7日 15:00

All 199 static matches are false positives involving Markdown, public links, placeholder URLs, or documented token storage. One semantic finding identifies overbroad shell-safety guidance requiring explicit escaping before CLI execution. No evidence found of malicious instructions or credential exfiltration in the supplied file; the external CLI implementation was not reviewed.

1
已扫描文件
497
分析行数
4
复核项
0
已忽略误报

已确认安全问题 (1)

中
Overbroad Shell-Safety Guidance
The claim "No shell-injection surface from prompt content" overlooks shell parsing before CLI execution. Unescaped prompt quotes can break shell arguments despite valid JSON.
The document makes an unconditional safety claim while using shell-quoted JSON. One example escapes an apostrophe correctly, but safety still depends on consistent shell escaping.

风险因素

⚙️ 外部命令 (50)
🌐 网络访问 (50)
📁 文件系统访问 (5)
审计者: codex