📦
审计历史
heatstroke - 1 审计
审计版本 1 最新
2026年10月13日 03:52
All 70 static findings are false positives involving public API access, documented cache storage, Markdown syntax, or readable Japanese text. No evidence found of prompt injection, credential access, or unauthorized data exfiltration. Two semantic findings identify host-timezone errors and misleading safe classifications when observations contain no valid values.
5
已扫描文件
327
分析行数
5
复核项
0
已忽略误报
已确认安全问题 (2)
中
Host Timezone Can Select Stale Heat Forecasts
Default forecast announcements and survey dates use naive host-local timestamps, although the API expects JST. Non-JST hosts can retrieve older forecasts or the wrong observation date, misleading heat-risk decisions.
The helper uses datetime.now() without timezone conversion. A local check selected the previous day's 17:00 announcement at 03:30 UTC, instead of the current day's 11:00 JST announcement.
中
Missing Observations Produce a Misleading Safe Maximum
The survey maximum starts at zero and remains zero when every outdoor reading is missing or nonnumeric. The summary then labels the day safe despite having no valid observations, potentially encouraging unsafe heat exposure.
A mocked survey containing an empty outdoor reading produced a 0.0 maximum with the safe category. The code does not track whether any valid observations exist.
风险因素
🌐 网络访问 (15)
📁 文件系统访问 (9)
⚙️ 外部命令 (30)
SKILL.md:20 SKILL.md:21 SKILL.md:22 SKILL.md:23 SKILL.md:27 SKILL.md:31-33 SKILL.md:33-35 SKILL.md:35-37 SKILL.md:37 SKILL.md:41-43 SKILL.md:43-45 SKILL.md:45-46 SKILL.md:46 SKILL.md:47 SKILL.md:49-51 SKILL.md:51-53 SKILL.md:53-55 SKILL.md:55 SKILL.md:59-61 SKILL.md:61-63 SKILL.md:63-64 SKILL.md:64 SKILL.md:66 SKILL.md:84 SKILL.md:85 SKILL.md:86 SKILL.md:92-94 SKILL.md:94-98 SKILL.md:98-100 SKILL.md:100
审计者: codex