📦

审计历史

personwise-customer-education - 1 审计

2026年8月5日 18:37

Most static findings are false positives caused by secure installer checks and Markdown formatting. Shell substitutions use quoted validation inputs, while descriptor entropy comes from Base64 metadata and a Minisign signature. Native installation, service-provided update commands, and document uploads still create meaningful third-party trust and execution risks.

已扫描文件

649

分析行数

复核项

已忽略误报

已确认安全问题 (3)

中

SKILL.md:73-79

Native CLI installation expands the trust boundary

When the CLI is missing, the workflow installs a downloaded native PersonWise executable. Fixed hashes reduce tampering risk, but third-party native code still executes locally.

The workflow explicitly directs the agent to run bundled bootstrap scripts that install the required native executable.

中

SKILL.md:108-116

Service-provided update commands can be executed

The workflow runs an update command returned by PersonWise after user approval. It does not require parsing the response against a fixed executable and argument allowlist.

The text explicitly says to quote and run the returned action command. User approval mitigates risk, but command validation is not specified.

中

SKILL.md:198-206

Selected customer materials are uploaded to PersonWise

The workflow treats user-selected documents as authorized and uploads them to PersonWise. Sensitive content can cross a third-party boundary without destination-specific confirmation.

The source add command and surrounding instructions directly describe uploading selected local documents to the service.

风险因素

🌐 网络访问 (2)

assets/bootstrap.ps1:43 assets/bootstrap.sh:132

⚙️ 外部命令 (50)

📁 文件系统访问 (7)

assets/bootstrap.sh:81 assets/bootstrap.sh:83 assets/bootstrap.sh:128 assets/bootstrap.sh:16 assets/bootstrap.sh:18 assets/bootstrap.sh:128 assets/bootstrap.sh:180

审计者: codex

← 返回技能