📦
审计历史
taiwan-museum - 1 审计
审计版本 1 最新
2026年10月13日 03:43
Seven findings are false positives: Markdown fences, public government URLs, and readable multilingual text do not demonstrate execution, exfiltration, or obfuscation. Two filesystem findings are confirmed because a predictable shared temporary path permits symlink overwrite and local data substitution. No evidence found of prompt injection, credential access, or malicious intent.
1
已扫描文件
61
分析行数
5
复核项
0
已忽略误报
能力复核项 (2)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Temp directory access
curl -sm 30 -A 'Mozilla/5.0' 'https://cloud.culture.tw/frontsite/trans/emapOpenDataAction.do?method=
curl writes to the predictable /tmp/museum.json path without exclusive creation or symlink protection. A local actor could precreate a symlink and overwrite another writable file.
中
Temp directory access
d = json.load(open('/tmp/museum.json'))
The parser opens the same predictable shared file without verifying its provenance. A local actor could substitute records, including after a failed download, and corrupt results.
风险因素
⚙️ 外部命令 (4)
🌐 网络访问 (2)
📁 文件系统访问 (2)
审计者: codex