📦
审计历史
zipcode-lookup - 1 审计
审计版本 1 最新
2026年10月13日 04:34
All 15 static findings are false positives involving Markdown formatting, legitimate downloads, fixed shell commands, and a documentation link. No evidence found of prompt injection, credential access, or data exfiltration. A separate low-severity concern is archive extraction that can overwrite local files without isolating the destination.
1
已扫描文件
81
分析行数
4
复核项
0
已忽略误报
已确认安全问题 (1)
低
Archive Extraction Can Overwrite Local Files
The workflow uses unzip -o in the current directory without validating archive contents. A supplied archive can overwrite matching local files during extraction.
The overwrite option and user-supplied archive fallback are explicit. Impact depends on archive contents and existing files; no malicious archive is shown.
风险因素
⚙️ 外部命令 (11)
🌐 网络访问 (2)
📁 文件系统访问 (1)
审计者: codex