此報告尚無所請求語言的翻譯，目前顯示規範英文報告。
版本化安全評估
報告編號: SA-18789A6C
10/13/2026, 2:45:11 PM
spawn 安全評估 v12
Skill 安全認證報告
掃描器版本 3.0.0 稽核模型: codex 最新發佈的報告
- 技能名稱
- spawn
- 版本
- v12
- 維護者
- Consiliency
- 涵蓋範圍
- 12 已掃描檔案 · 1,587 分析行數
- 策略版本
- skillstore-security-audit-policy-v1
已確認問題的最高嚴重性
高
有 1 個已確認的安全問題需要處理。
The 86 findings include real shell quoting and temporary-file risks, alongside false positives from documentation, platform detection, and dictionary operations. Provider instructions also recommend disabling approval safeguards and, for Codex, the sandbox. No evidence found of credential theft, concealed malware, or instructions to manipulate this audit.
報告位置
最新發佈的報告
「最新」僅指報告序列，不代表成品目前有效。
稽核證明
有效證明
此精確報告有可公開驗證的證明。
人工驗證
未進行人工驗證
本報告沒有人工作驗證記錄。
涵蓋範圍
12 已掃描檔案 · 1,587 分析行數
有 24 項內容需要查看
限制
本報告不聲稱已進行執行階段或沙箱執行，也不證明不存在副作用。
證據鏈
證據從來源綁定延伸至安裝契約。證據可用於驗證，但並非安全保證。
來源
已綁定 commit 與路徑
構件
已綁定內容與 tree hash
稽核
已完成
觀察到的能力
「已觀察到」表示本報告記錄了支持證據；「未記錄」不證明該能力不存在。
包含腳本
可能執行 Skill 隨附的程式碼。
此次稽核未記錄
網路存取
可能連線至外部服務。
此次稽核未記錄
檔案系統存取
可能讀取或寫入本機檔案。
在 23 個證據位置觀察到
環境變數
可能讀取處理程序環境中的值。
在 3 個證據位置觀察到
外部命令
可能叫用 Skill 以外的命令或程式。
在 48 個證據位置觀察到
能力複核項目 (23)
高
Python subprocess.run
subprocess.run(
The AppleScript contains unescaped shell_cmd text, including unquoted cwd. Quotes or metacharacters in directory names can change the executed script.
高
Python subprocess.run
subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)
The fallback interpolates command into nested Unix and Windows shell text with shell=True. Embedded quotes can cross parser boundaries and execute unintended commands.
高
Python subprocess.Popen
subprocess.Popen(wt_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
The argument list launches PowerShell with generated script text. POSIX shlex.quote does not safely escape PowerShell cwd values, allowing directory text to become code.
高
Python subprocess.Popen
subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)
Caller-supplied command text is executed with shell=True and no restricted argument mode. Legitimate shell use is intended, but untrusted interpolated data can execute commands.
高
Python subprocess.Popen
subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)
The debug path executes arbitrary command text with shell=True. The caller trust boundary is unspecified, so unsafe interpolation remains a risk.
高
Python subprocess.Popen
subprocess.Popen(command, shell=True, cwd=cwd)
The fallback passes caller-supplied command directly to shell=True without validation. Requested shell execution is legitimate, but untrusted command construction is not protected.
高
PowerShell invocation
"wt.exe", "-w", "new", "powershell.exe",
PowerShell receives generated script text using POSIX quoting for cwd. That mismatch can interpret directory-name characters as PowerShell syntax.
高
Windows cmd.exe
subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)
Command text is embedded in a cmd.exe command passed through another shell. Missing parser-specific escaping permits unintended interpretation of embedded quotes and metacharacters.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
Agent output is written by tee into shared /tmp without private permissions or exclusive creation. Sensitive responses may be readable under common umasks.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
Debug logs collect terminal output in shared /tmp without permission hardening. Logs may expose sensitive output to other local users.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The completion marker is not securely created or checked for ownership. Another local user who discovers the filename can spoof completion.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
The WSL script writes agent output into shared /tmp through tee. No private directory, restrictive permissions, or exclusive creation protects the response.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The WSL debug log stores full terminal output in shared /tmp. Its creation does not enforce privacy or resist existing symlinks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The WSL completion marker uses a shared temporary path without exclusive creation or ownership verification. A local attacker can spoof its existence.
中
Temp directory access
script_file = f"/tmp/fork-script-{output_id}.sh"
A shell script containing caller commands is placed directly in shared /tmp. Later nonexclusive creation and permissions 0755 expose its contents and permit symlink attacks.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
The tmux branch saves agent output in shared /tmp using tee. It does not ensure private permissions or exclusive file creation.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The tmux debug path stores terminal output in a shared temporary file. Sensitive output can remain readable under common umasks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The tmux completion marker has no secure creation or ownership checks. Its existence can be spoofed by another local user.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
Background execution writes responses into shared /tmp without permission hardening. Sensitive agent output can be exposed to other local users.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The background debug file collects stdout and stderr without private permissions or exclusive creation. This creates disclosure and symlink risks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The background completion marker is placed in shared /tmp and checked only for existence. Local users can forge completion after discovering its path.
中
Python file write/append
with open(script_file, 'w') as f:
open(script_file, 'w') follows existing symlinks and truncates their targets. The script is created in shared /tmp without exclusive or no-follow flags.
中
Python os file operations
os.chmod(script_file, 0o755)
chmod sets command-bearing scripts to 0755, exposing prompts to other local users. It also follows a substituted symlink when changing target permissions.
風險問題
已確認的安全問題與仍需審核的項目分開顯示。
已確認的安全問題 (1)
RISK-001 高
agent/cookbook/codex-cli.md:44-46agent/cookbook/codex-cli.md:69-83agent/cookbook/cursor-cli.md:40-43
Approval and sandbox safeguards disabled by default
The Codex cookbook says: "Always run with `--dangerously-bypass-approvals-and-sandbox` for full auto mode". Cursor similarly recommends force-allowing commands, increasing exposure to destructive actions and injected repository instructions.
These are explicit operational instructions to remove approval controls, not merely flag descriptions. Codex examples also disable sandboxing.
補救措施
本次稽核記錄了建議的修復措施。實施這些措施是維護者的責任。
- FIX-001高Provider cookbooks recommend bypassing approvals and sandbox protections.Keep approvals and workspace confinement enabled by default. Require explicit user consent before enabling unrestricted execution.
- FIX-002高The macOS launcher inserts cwd and commands into shell and AppleScript text without correct escaping.Quote cwd for the shell and escape AppleScript strings separately. Reject malformed inputs and test quotes, spaces, and shell metacharacters.
- FIX-003高Windows uses POSIX quoting for PowerShell, and the WSL fallback interpolates command text across multiple shell parsers.Use platform-specific argument handling and avoid nested shell interpolation. Test directory names and prompts containing quotes and metacharacters.
- FIX-004高Background execution accepts arbitrary shell strings without a restricted execution boundary.Offer an argument-list execution mode without shell=True. Require confirmation for shell mode and treat prompts and filenames as data.
- FIX-005中Output, completion markers, and executable scripts use shared temporary paths without secure creation or private permissions.Create a private temporary directory with exclusive file creation. Use permissions 0600 for logs and 0700 for scripts, then remove artifacts.
專家證據
不可變主體身分、掃描器中繼資料、已排除的相符項目和原始碼層級證據。
Artifact 主體
- Marketplace 提交
- 18789a6c1a8a9ebc818b76ac8686bbd38eb802a8
- 內容雜湊
- 6e33576dcdea5824d6a486f854a089549fe3520627d0bae4d0f41a48220d4175
- 目錄樹雜湊
- a92bcb1c88fe565c8883adb9bf6c07b1bc13ca512914608e5abd34f6470511fd
- Skill 路徑
- skills/consiliency/spawn
- 稽核承載資料雜湊
- 832fac0330b781f0197473c63359bca3
分析中繼資料
稽核模型: codex
分析狀態: 已完成
範圍僅限於已記錄的檔案、行數、方法和證據；本報告不聲稱進行了執行階段或沙箱執行。
驗證與匯出
manifest 和 lockfile 將安裝 artifact 綁定到加密雜湊。該完整性聲明獨立於安全評估。
稽核證明: active