📦

审计历史

calil-books - 1 审计

2026年10月13日 03:22

All 42 static findings are benign Markdown formatting, expected Calil URLs, readable Japanese prose, library identifiers, or a fixed documentation link. No evidence found of prompt injection, malicious execution, or unauthorized data transmission in SKILL.md. One low-severity semantic finding concerns API keys exposed through expanded curl command arguments.

已扫描文件

120

分析行数

复核项

已忽略误报

已确认安全问题 (1)

低

SKILL.md:24 SKILL.md:65 SKILL.md:73 SKILL.md:84

API Key Exposure Through Command Arguments

The curl examples expand CALIL_APPKEY into URL arguments. The key can appear in process listings or captured command logs despite the guidance to keep credentials private.

Shell expansion places the key directly in curl's URL argument. Actual disclosure depends on process visibility and logging; no evidence found of deliberate exfiltration.

风险因素

审计者: codex

← 返回技能