📦
审计历史
taiwan-suspension - 1 审计
审计版本 1 最新
2026年10月13日 04:13
Ten static alerts are false positives involving Markdown, official URLs, HTML entity decoding, and multilingual text. Two temporary-file alerts expose local overwrite or tampering risks; an additional finding addresses stale announcements after failed downloads. No evidence found of prompt injection, credential collection, exfiltration, or hidden code execution.
1
已扫描文件
77
分析行数
6
复核项
0
已忽略误报
已确认安全问题 (1)
中
Failed Downloads Can Reuse Stale Announcements
The curl example does not require success before parsing the existing file. An early download failure can leave old announcements available for a newly timestamped response.
The examples lack a download-status gate, while responses require a current query time. Prose warns about failures, but the executable workflow does not enforce freshness.
能力复核项 (2)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Temp directory access
curl -sm 30 -A 'Mozilla/5.0' 'https://www.dgpa.gov.tw/typh/daily/nds.html' -o /tmp/nds.html
curl writes to the predictable shared path /tmp/nds.html without private creation or symlink protection. A local attacker could redirect writes to files accessible to the executing user.
中
Temp directory access
t = open('/tmp/nds.html', encoding='utf-8', errors='replace').read()
The parser reopens the same predictable temporary path without ownership or integrity checks. A local attacker could replace its contents and cause false suspension reports.
风险因素
🌐 网络访问 (2)
📁 文件系统访问 (2)
审计者: codex