📦
审计历史
taiwan-parking - 1 审计
审计版本 1 最新
2026年10月13日 03:49
Eighteen findings are false positives involving Markdown, public parking feeds, JSON reads, and parking identifiers. Two download commands use predictable shared temporary paths, enabling local file overwrite through preexisting symlinks. No evidence found of prompt injection, credential theft, or concealed executable content.
1
已扫描文件
64
分析行数
5
复核项
0
已忽略误报
能力复核项 (2)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Temp directory access
curl -sm 30 -o /tmp/park.json 'https://tcgbusfs.blob.core.windows.net/blobtcmsv/TCMSV_allavailable.j
curl writes to predictable /tmp/park.json without exclusive creation. A local attacker can precreate a symlink, causing overwrite of another file writable by the agent.
中
Temp directory access
curl -sm 30 -o /tmp/parkdesc.json 'https://tcgbusfs.blob.core.windows.net/blobtcmsv/TCMSV_alldesc.js
curl writes to predictable /tmp/parkdesc.json without a private temporary directory. A preexisting attacker-controlled symlink can redirect the write to another agent-writable file.
风险因素
⚙️ 外部命令 (10)
🌐 网络访问 (3)
📁 文件系统访问 (4)
审计者: codex