📦
审计历史
cwa-weather - 1 审计
审计版本 1 最新
2026年10月13日 02:46
Most alerts are false positives from Markdown backticks, official CWA links, dataset descriptions, and readable multilingual text. Predictable temporary files create overwrite and forecast-tampering risks, while command-line authorization URLs can expose API keys. No evidence found of prompt injection, malicious exfiltration, or concealed executable content.
1
已扫描文件
76
分析行数
7
复核项
0
已忽略误报
已确认安全问题 (1)
低
API Key Exposure Through Command-Line URLs
Both curl examples place the authorization key in a URL argument. Substituting a real key can expose it through process listings or command logs.
Both examples visibly put Authorization in the command-line URL. The secrecy guidance excludes replies and commits but does not prevent process-argument exposure.
能力复核项 (3)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Temp directory access
curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-C0032-001?Authorization=<授權碼>&locat
curl writes to the predictable shared path /tmp/cwa.json without exclusive creation. A local attacker could pre-create a symlink and redirect the write.
中
Temp directory access
curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-D0047-061?Authorization=<授權碼>' -o /
curl writes to the predictable shared path /tmp/cwa_tpe.json without exclusive creation. A pre-existing symlink could cause an unintended file overwrite.
中
Temp directory access
jq -r '.records.Locations[0].Location[] | select(.LocationName=="大安區") | .LocationName' /tmp/cwa_tpe
jq trusts /tmp/cwa_tpe.json without ownership or freshness checks. A local attacker controlling that predictable file could substitute misleading forecast data.
风险因素
⚙️ 外部命令 (16)
🌐 网络访问 (8)
📁 文件系统访问 (3)
审计者: codex