📦
审计历史
taiwan-holidays - 1 审计
审计版本 1 最新
2026年10月13日 03:13
Three temporary-file writes pose overwrite and symlink risks because they use predictable paths in a shared directory. The remaining 33 alerts concern Markdown formatting, public government data, local parsing, or readable multilingual text rather than dangerous behavior. No evidence found of prompt injection, credential theft, or data exfiltration.
1
已扫描文件
90
分析行数
6
复核项
0
已忽略误报
能力复核项 (3)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Temp directory access
curl -sm 30 -o /tmp/cal115.csv 'https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202506/a5
curl writes to the predictable shared path /tmp/cal115.csv without exclusive creation. A preexisting file or attacker-planted symlink can cause unintended overwrites under the agent's permissions.
中
Temp directory access
curl -sm 30 'https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202510/b84cb88a-803c-4621-a8
Shell redirection truncates the predictable shared path /tmp/cal114.csv and follows existing symlinks. A planted link can redirect the write to another writable file.
中
Temp directory access
curl -sm 30 -o /tmp/cal.xlsx 'https://www.dgpa.gov.tw/uploads/dgpa/files/202511/1d88999f-f893-47dd-8
curl writes the workbook to predictable /tmp/cal.xlsx without exclusive creation or a private directory. Existing files or planted symlinks can redirect or suffer overwrites.
风险因素
⚙️ 外部命令 (14)
🌐 网络访问 (11)
审计者: codex