此报告尚无所请求语言的翻译，当前显示规范英文报告。

版本化安全评估

报告编号: SA-5C948AF0

10/4/2026, 2:41:09 PM

oil-ui 安全评估 v1

Skill 安全认证报告

审计历史
扫描器版本 3.0.0 审计模型: codex 历史报告
技能名称
oil-ui
版本
v0.15.4
维护者
oil-oil
来源
github.com/oil-oil/oil-ui/tree/48518fd02946ccbda54cd3544f8bd102413128cf/
覆盖范围
24 已扫描文件 · 3,676 分析行数
策略版本
skillstore-security-audit-policy-v1

已确认问题的最高严重性

高

有 2 个已确认的安全问题需要处理。

安装上下文

历史证据

本报告可能无法描述当前可安装的 artifact。请打开当前 Skill 详情页查看安装建议。

打开当前 Skill 详情页

本报告不会阻止或授权 manifest 或 ZIP。

Most alerts are benign JavaScript syntax, image data, Chinese documentation, and negative test fixtures. Confirmed risks include unpinned automatic updates, inherited secrets, and unsafe preview input handling. Release-note trust and selector interpolation add injection risks; no evidence of intentional malware was found.

报告位置

历史报告

使用本报告安装前，请先查看审计历史。

审计证明

证明已被替代

已有更新的证明。

人工验证

未进行人工验证

本报告没有人工验证记录。

覆盖范围

24 已扫描文件 · 3,676 分析行数

有 8 项内容需要查看

局限

本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。

证据链

证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。

  1. 来源

    已绑定 commit 与路径

  2. 构件

    已绑定内容与 tree hash

  3. 审计

    已完成

  4. 安装契约

    打开 manifest 进行验证

    打开 manifest

观察到的能力

“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。

包含脚本

可能执行 Skill 随附的代码。

在 2 个证据位置观察到

网络访问

可能连接外部服务。

在 45 个证据位置观察到

文件系统访问

可能读取或写入本地文件。

在 38 个证据位置观察到

环境变量

可能读取进程环境中的值。

在 25 个证据位置观察到

外部命令

可能调用 Skill 之外的命令或程序。

在 52 个证据位置观察到

能力复核项 (6)
高
scripts/check_update.py:179
Python subprocess.run
result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,
The updater runs npx -y against an unpinned GitHub CLI and replaces the installed skill without fresh consent. Compromised upstream code could execute locally.
高
scripts/check_update.py:177
Python environment access
env = {**os.environ, "CI": "1"}
The updater copies every environment variable into the unpinned downloaded CLI process. This exposes unrelated credentials to code outside the audited package.
高
scripts/shoot.mjs:89
Synchronous file operations
res.end(readFileSync(local));
The server reads files after a string-prefix containment check, which accepts sibling directories and follows escaping symlinks. Local requests can disclose files outside the preview root.
高
SKILL.md:24
Ruby/shell backtick execution
版本检查:!`sh "${CLAUDE_SKILL_DIR}/scripts/check_update.sh" 2>/dev/null || true`
This is a real host command hook, not ordinary Markdown formatting. Loading the skill can trigger unpinned remote CLI execution through check_update.sh.
中
scripts/shoot.mjs:237
Synchronous file operations
writeFileSync(file, Buffer.from(data, "base64"));
Screenshot paths incorporate unchecked --states values at lines 358-359 and 366. Parent-directory segments can escape the output directory and overwrite writable PNG files.
中
scripts/shoot.mjs:289
Synchronous file operations
writeFileSync(tmp, html);
The generated sheet includes unescaped state labels from line 284, then opens the HTML at line 292. Crafted labels can execute scripts or load external resources.

风险问题

已确认的安全问题与仍需审核的项目分开展示。

已确认安全问题 (2)

RISK-001 高
scripts/check_update.py:107-119scripts/check_update.py:282-284SKILL.md:28
Untrusted Release Notes Enter Agent Instructions
Remote release notes are copied into updater notices after minimal trimming. SKILL.md tells agents to relay these notices, creating a prompt-injection channel.
The remote notes flow directly into output the agent consumes. No embedded attack was found, but the source-to-instruction trust boundary is explicit.
RISK-002 中
scripts/shoot.mjs:195-198scripts/shoot.mjs:268-270
Selector Interpolation Allows Browser Code Injection
The type action inserts its selector directly into a quoted JavaScript error message. Crafted quotes can execute unintended code in the inspected page.
The querySelector argument is serialized, but the same selector is interpolated without escaping in the error string. An isolated expression check confirmed injection.

补救措施

本次审计记录了建议的修复措施。实施这些措施是维护者的责任。

  1. FIX-001
    高
    Skill loading can execute an unpinned GitHub updater and replace audited files.
    Make updates opt-in, require confirmation, pin the CLI to a reviewed commit, and verify replacement artifacts before loading them.
  2. FIX-002
    高
    The downloaded updater inherits all environment variables.
    Pass a minimal environment allowlist and only explicitly authorized authentication values. Exclude unrelated project and service credentials.
  3. FIX-003
    高
    The local preview server uses string-prefix containment and follows symlinks.
    Resolve the root and target with realpath, enforce path-relative containment, and test encoded traversal, sibling prefixes, and escaping symlinks.
  4. FIX-004
    高
    Remote release notes are presented to agents without a clear trust boundary.
    Treat release notes as quoted untrusted data, remove control characters, and never execute or adopt instructions from updater output.
  5. FIX-005
    中
    Unchecked screenshot state names can escape the output directory.
    Generate safe artifact identifiers independently from state text, enforce output containment, and reject escaping paths before writing.
  6. FIX-006
    中
    Contact-sheet state labels are inserted into executable HTML.
    Render captions with textContent or HTML escaping. Apply a contact-sheet CSP that disables scripts and external resources.
  7. FIX-007
    中
    The type action embeds a raw selector in evaluated JavaScript.
    Serialize every dynamic string with JSON.stringify, including error messages. Add regression tests with quotes and code-like selectors.

专家证据

不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。

Artifact 主体

Marketplace 提交
5c948af074e24413a5278072a82a5caa758753ba
内容哈希
7e54a37acfc7601b6be919a53f5a3668db6beb7322f6e1fb8cc2e1ad8d328c30
目录树哈希
74dfcc43cd92eb80de5c25761160452842152842998f71db5053d996e5d148f7
Skill 路径
skills/oil-oil/oil-ui
审计载荷哈希
b55cb8c9d3c1bd4d5f8e963c51f69511

分析元数据

审计模型: codex

分析状态: 已完成

范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。

验证与导出

JSON 报告 已签名审计证明 CITATION.cff SARIF 2.1.0 已签名安装清单 来源

manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。

审计证明: superseded