📦
审计历史
taiwan-stock - 1 审计
审计版本 1 最新
2026年10月13日 04:09
Thirty-three alerts are false positives involving Markdown backticks, readable multilingual text, public HTTPS endpoints, and JSON reads. Four download commands use predictable shared temporary paths, creating conditional file collision and symlink overwrite risks. No evidence found of credential theft, malicious payload execution, or prompt injection.
1
已扫描文件
83
分析行数
7
复核项
0
已忽略误报
能力复核项 (4)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Temp directory access
curl -sm 30 'https://openapi.twse.com.tw/v1/exchangeReport/STOCK_DAY_ALL' -o /tmp/twse.json
curl writes to predictable /tmp/twse.json without exclusive creation. A pre-existing writable symlink can redirect the write, and concurrent runs can overwrite data.
中
Temp directory access
curl -sm 30 'https://www.tpex.org.tw/openapi/v1/tpex_mainboard_daily_close_quotes' -o /tmp/tpex.json
curl writes to predictable /tmp/tpex.json without exclusive creation. A pre-existing writable symlink can redirect the write, and concurrent runs can overwrite data.
中
Temp directory access
curl -sm 30 'https://www.twse.com.tw/exchangeReport/STOCK_DAY?response=json&date=20260901&stockNo=23
curl writes to predictable /tmp/stock.json without exclusive creation. A pre-existing writable symlink can redirect the write, and simultaneous stock queries share one file.
中
Temp directory access
curl -sm 30 'https://www.twse.com.tw/exchangeReport/MI_INDEX?response=json&date=20260911&type=ALLBUT
curl writes to predictable /tmp/mi.json without exclusive creation. A pre-existing writable symlink can redirect the write, and concurrent date queries can overwrite data.
风险因素
⚙️ 外部命令 (22)
SKILL.md:18-20 SKILL.md:20-22 SKILL.md:22 SKILL.md:24-36 SKILL.md:36-40 SKILL.md:40-42 SKILL.md:42-44 SKILL.md:44 SKILL.md:46-48 SKILL.md:48-52 SKILL.md:52-55 SKILL.md:55-57 SKILL.md:57 SKILL.md:59-61 SKILL.md:61-65 SKILL.md:65-67 SKILL.md:67-69 SKILL.md:69 SKILL.md:74 SKILL.md:75 SKILL.md:76 SKILL.md:82
🌐 网络访问 (5)
审计者: codex