技能 oil-ui 审计历史

📦

审计历史

oil-ui - 2 审计

版本对比

各审计版本间的能力与发现变化，最新在前。

版本	日期	结果	复核项	相对上一版变化
v2 最新	2026年10月5日 04:08	2 已确认	2	能力无变化
v1	2026年10月4日 14:41	2 已确认	6	基线

审计版本 2 最新

2026年10月5日 04:08

Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.

已扫描文件

3,794

分析行数

复核项

已忽略误报

已确认安全问题 (2)

高

references/style-explorer.md:48-50 references/style-explorer.md:72 scripts/build_explorer.py:289-302

Stored Manifest Commands Can Trigger Agent Execution

The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.

The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.

中

scripts/build_explorer.py:22-26 scripts/build_explorer.py:144-147 assets/style-explorer.html:206-208 references/style-explorer.md:44

Interactive Preview Navigation Bypasses Claimed Network Isolation

Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.

The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.

能力复核项 (2)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

scripts/check_update.py:182

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.

中

scripts/shoot.mjs:94

Synchronous file operations

res.end(readFileSync(local));

The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.

风险因素

⚡ 包含脚本 (5)

assets/style-explorer.html:267 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6

⚙️ 外部命令 (50)

🌐 网络访问 (50)

📁 文件系统访问 (44)

assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:94 scripts/shoot.mjs:245 scripts/shoot.mjs:293 scripts/shoot.mjs:298 scripts/shoot.mjs:313 scripts/shoot.mjs:330 scripts/shoot.mjs:336 scripts/shoot.mjs:386 scripts/shoot.mjs:59 scripts/shoot.mjs:79 scripts/shoot.mjs:6 scripts/shoot.mjs:128 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:66 tests/test_check_update.py:69 tests/test_check_update.py:70 tests/test_check_update.py:84 tests/test_check_update.py:206 tests/test_check_update.py:285 tests/test_shoot.py:171 tests/test_shoot.py:192 tests/test_shoot.py:9 tests/test_shoot.py:99 tests/test_shoot.py:166

🔑 环境变量 (34)

审计者: codex

审计版本 1

2026年10月4日 14:41

Most alerts are benign JavaScript syntax, image data, Chinese documentation, and negative test fixtures. Confirmed risks include unpinned automatic updates, inherited secrets, and unsafe preview input handling. Release-note trust and selector interpolation add injection risks; no evidence of intentional malware was found.

已扫描文件

3,676

分析行数

复核项

已忽略误报

已确认安全问题 (2)

高

scripts/check_update.py:107-119 scripts/check_update.py:282-284 SKILL.md:28

Untrusted Release Notes Enter Agent Instructions

Remote release notes are copied into updater notices after minimal trimming. SKILL.md tells agents to relay these notices, creating a prompt-injection channel.

The remote notes flow directly into output the agent consumes. No embedded attack was found, but the source-to-instruction trust boundary is explicit.

中

scripts/shoot.mjs:195-198 scripts/shoot.mjs:268-270

Selector Interpolation Allows Browser Code Injection

The type action inserts its selector directly into a quoted JavaScript error message. Crafted quotes can execute unintended code in the inspected page.

The querySelector argument is serialized, but the same selector is interpolated without escaping in the error string. An isolated expression check confirmed injection.

能力复核项 (6)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

scripts/check_update.py:179

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

The updater runs npx -y against an unpinned GitHub CLI and replaces the installed skill without fresh consent. Compromised upstream code could execute locally.

高

scripts/check_update.py:177

Python environment access

env = {**os.environ, "CI": "1"}

The updater copies every environment variable into the unpinned downloaded CLI process. This exposes unrelated credentials to code outside the audited package.

高

scripts/shoot.mjs:89

Synchronous file operations

res.end(readFileSync(local));

The server reads files after a string-prefix containment check, which accepts sibling directories and follows escaping symlinks. Local requests can disclose files outside the preview root.

高

SKILL.md:24

Ruby/shell backtick execution

版本检查:!`sh "${CLAUDE_SKILL_DIR}/scripts/check_update.sh" 2>/dev/null || true`

This is a real host command hook, not ordinary Markdown formatting. Loading the skill can trigger unpinned remote CLI execution through check_update.sh.

中

scripts/shoot.mjs:237

Synchronous file operations

writeFileSync(file, Buffer.from(data, "base64"));

Screenshot paths incorporate unchecked --states values at lines 358-359 and 366. Parent-directory segments can escape the output directory and overwrite writable PNG files.

中

scripts/shoot.mjs:289

Synchronous file operations

writeFileSync(tmp, html);

The generated sheet includes unescaped state labels from line 284, then opens the HTML at line 292. Crafted labels can execute scripts or load external resources.

风险因素

⚡ 包含脚本 (5)

assets/style-explorer.html:267 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6

⚙️ 外部命令 (50)

🌐 网络访问 (50)

📁 文件系统访问 (40)

assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:89 scripts/shoot.mjs:237 scripts/shoot.mjs:284 scripts/shoot.mjs:289 scripts/shoot.mjs:304 scripts/shoot.mjs:321 scripts/shoot.mjs:327 scripts/shoot.mjs:377 scripts/shoot.mjs:76 scripts/shoot.mjs:6 scripts/shoot.mjs:120 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:60 tests/test_check_update.py:63 tests/test_check_update.py:64 tests/test_check_update.py:78 tests/test_check_update.py:159 tests/test_check_update.py:237 tests/test_shoot.py:9 tests/test_shoot.py:99

🔑 环境变量 (29)

审计者: codex

← 返回技能