📦

审计历史

youbike-realtime - 1 审计

2026年10月13日 04:29

Reviewed all 114 static findings: 109 are false positives from Markdown formatting, public-data URLs, read-only queries, and readable multilingual text. Five downloads use predictable shared temporary paths, allowing local symlink overwrite or cache tampering when another user controls those paths. No evidence found of prompt injection, credential access, or data exfiltration.

已扫描文件

239

分析行数

复核项

已忽略误报

能力复核项 (5)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中

SKILL.md:26

Temp directory access

curl -sm 60 https://apis.youbike.com.tw/json/station-yb2.json -o /tmp/youbike_all.json

Curl writes to predictable /tmp/youbike_all.json without creating a private directory. A local attacker can precreate a writable symlink target or tamper with shared cache data.

中

SKILL.md:105

Temp directory access

curl -sm 30 https://tcgbusfs.blob.core.windows.net/dotapp/youbike/v2/youbike_immediate.json -o /tmp/

Curl writes to predictable /tmp/youbike.json without establishing private ownership. A local attacker can redirect a writable download through a symlink or alter shared cache contents.

中

SKILL.md:132

Temp directory access

curl -sm 30 'https://data.ntpc.gov.tw/api/datasets/010E5B15-3823-4B20-B401-B1CF000550C5/json?page=0&

Curl downloads into predictable /tmp/youbike_ntpc.json without a private directory. Preexisting attacker-controlled symlinks can redirect writable output, and shared files permit cache tampering.

中

SKILL.md:160

Temp directory access

curl -sm 30 'https://newdatacenter.taichung.gov.tw/api/v1/no-auth/resource.download?rid=9468c0d0-e1e

Curl writes directly to predictable /tmp/youbike_tc.json. Without private ownership, another local user can precreate a writable symlink target or supply tampered cache data.

中

SKILL.md:168

Temp directory access

curl -sm 30 'https://opendata.tycg.gov.tw/api/v1/dataset.api_access?rid=08274d61-edbe-419d-8fcc-7a64

Curl writes directly to predictable /tmp/youbike_ty.json without isolating the cache. Local attackers can exploit preexisting writable symlinks or alter shared station data.

风险因素

⚙️ 外部命令 (50)

🌐 网络访问 (6)

SKILL.md:26 SKILL.md:105 SKILL.md:132 SKILL.md:160 SKILL.md:168 SKILL.md:225

📁 文件系统访问 (15)

SKILL.md:26 SKILL.md:67 SKILL.md:71 SKILL.md:76 SKILL.md:83 SKILL.md:92 SKILL.md:105 SKILL.md:126 SKILL.md:132 SKILL.md:152 SKILL.md:160 SKILL.md:168 SKILL.md:195 SKILL.md:199 SKILL.md:210

审计者: codex

← 返回技能