技能 personwise-sop-process-training 审计历史
📦

审计历史

personwise-sop-process-training - 1 审计

审计版本 1 最新

2026年8月5日 18:38

The 142 static alerts are false positives caused by Markdown backticks, defensive installer operations, and signed high-entropy metadata. The skill still presents high external-code risk because it installs an opaque CLI with native signature enforcement disabled, and it uploads selected documents to PersonWise.

6
已扫描文件
648
分析行数
5
复核项
0
已忽略误报

已确认安全问题 (2)

高
SKILL.md:72-82assets/bootstrap.sh:132-169assets/bootstrap.ps1:43-88
Opaque External CLI Installation
The skill directs installation and execution of a remotely downloaded PersonWise binary. Hash pinning protects integrity, but the binary behavior is not auditable from this skill, and native signature enforcement is disabled.
The workflow explicitly installs a remote executable and both installers show disabled native signature requirements. The included files do not provide the executable source for behavioral review.
中
SKILL.md:197-205
Source Documents Uploaded to External Service
The workflow uploads user-selected SOP and policy files to PersonWise for processing. This can expose confidential operational material to a third-party service.
The documented source add command uploads exact local paths, and the surrounding instructions discuss upload grants and source processing. The transfer is an intended workflow step.

风险因素

🌐 网络访问 (2)
assets/bootstrap.ps1:43 assets/bootstrap.sh:132
⚙️ 外部命令 (50)
assets/bootstrap.sh:26 assets/bootstrap.sh:75 assets/bootstrap.sh:80 assets/bootstrap.sh:90 assets/bootstrap.sh:108 assets/bootstrap.sh:115 assets/bootstrap.sh:128 assets/bootstrap.sh:135 assets/bootstrap.sh:140 assets/bootstrap.sh:148 assets/bootstrap.sh:161 assets/bootstrap.sh:166 assets/bootstrap.sh:169 assets/bootstrap.sh:175 assets/bootstrap.sh:186 SKILL.md:48 SKILL.md:50-57 SKILL.md:57-68 SKILL.md:68-72 SKILL.md:72-73 SKILL.md:73-74 SKILL.md:74-79 SKILL.md:79-80 SKILL.md:80-81 SKILL.md:81-83 SKILL.md:83-86 SKILL.md:86 SKILL.md:88 SKILL.md:89-90 SKILL.md:90-99 SKILL.md:99-101 SKILL.md:101-103 SKILL.md:103 SKILL.md:105-107 SKILL.md:107 SKILL.md:109-110 SKILL.md:110-113 SKILL.md:113 SKILL.md:118 SKILL.md:119-120 SKILL.md:120-121 SKILL.md:121-123 SKILL.md:123 SKILL.md:125-126 SKILL.md:126 SKILL.md:139-140 SKILL.md:140-141 SKILL.md:141-147 SKILL.md:147-148 SKILL.md:148-150
📁 文件系统访问 (7)
assets/bootstrap.sh:81 assets/bootstrap.sh:83 assets/bootstrap.sh:128 assets/bootstrap.sh:16 assets/bootstrap.sh:18 assets/bootstrap.sh:128 assets/bootstrap.sh:180
审计者: codex
← 返回技能