📦

監査履歴

oil-ui - 2 監査

バージョン比較

監査済みバージョン間の機能と検出結果の変化（新しい順）。

バージョン	日付	結果	レビュー項目	前バージョンとの変化
v2 最新	2026年10月5日上午04:08	2 確認済み	2	機能の変化なし
v1	2026年10月4日下午02:41	2 確認済み	6	基準

監査バージョン 2 最新

2026年10月5日上午04:08

Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.

スキャンされたファイル

3,794

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (2)

高

references/style-explorer.md:48-50 references/style-explorer.md:72 scripts/build_explorer.py:289-302

Stored Manifest Commands Can Trigger Agent Execution

The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.

The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.

中

scripts/build_explorer.py:22-26 scripts/build_explorer.py:144-147 assets/style-explorer.html:206-208 references/style-explorer.md:44

Interactive Preview Navigation Bypasses Claimed Network Isolation

Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.

The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.

機能レビュー項目 (2)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

scripts/check_update.py:182

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.

中

scripts/shoot.mjs:94

Synchronous file operations

res.end(readFileSync(local));

The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.

リスク要因

⚡ スクリプトを含む (5)

assets/style-explorer.html:267 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6

⚙️ 外部コマンド (50)

🌐 ネットワークアクセス (50)

📁 ファイルシステムへのアクセス (44)

assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:94 scripts/shoot.mjs:245 scripts/shoot.mjs:293 scripts/shoot.mjs:298 scripts/shoot.mjs:313 scripts/shoot.mjs:330 scripts/shoot.mjs:336 scripts/shoot.mjs:386 scripts/shoot.mjs:59 scripts/shoot.mjs:79 scripts/shoot.mjs:6 scripts/shoot.mjs:128 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:66 tests/test_check_update.py:69 tests/test_check_update.py:70 tests/test_check_update.py:84 tests/test_check_update.py:206 tests/test_check_update.py:285 tests/test_shoot.py:171 tests/test_shoot.py:192 tests/test_shoot.py:9 tests/test_shoot.py:99 tests/test_shoot.py:166

🔑 環境変数 (34)

監査者: codex

監査バージョン 1

2026年10月4日下午02:41

Most alerts are benign JavaScript syntax, image data, Chinese documentation, and negative test fixtures. Confirmed risks include unpinned automatic updates, inherited secrets, and unsafe preview input handling. Release-note trust and selector interpolation add injection risks; no evidence of intentional malware was found.

スキャンされたファイル

3,676

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (2)

高

scripts/check_update.py:107-119 scripts/check_update.py:282-284 SKILL.md:28

Untrusted Release Notes Enter Agent Instructions

Remote release notes are copied into updater notices after minimal trimming. SKILL.md tells agents to relay these notices, creating a prompt-injection channel.

The remote notes flow directly into output the agent consumes. No embedded attack was found, but the source-to-instruction trust boundary is explicit.

中

scripts/shoot.mjs:195-198 scripts/shoot.mjs:268-270

Selector Interpolation Allows Browser Code Injection

The type action inserts its selector directly into a quoted JavaScript error message. Crafted quotes can execute unintended code in the inspected page.

The querySelector argument is serialized, but the same selector is interpolated without escaping in the error string. An isolated expression check confirmed injection.

機能レビュー項目 (6)

高

scripts/check_update.py:179

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

The updater runs npx -y against an unpinned GitHub CLI and replaces the installed skill without fresh consent. Compromised upstream code could execute locally.

高

scripts/check_update.py:177

Python environment access

env = {**os.environ, "CI": "1"}

The updater copies every environment variable into the unpinned downloaded CLI process. This exposes unrelated credentials to code outside the audited package.

高

scripts/shoot.mjs:89

Synchronous file operations

res.end(readFileSync(local));

The server reads files after a string-prefix containment check, which accepts sibling directories and follows escaping symlinks. Local requests can disclose files outside the preview root.

高

SKILL.md:24

Ruby/shell backtick execution

版本检查:!`sh "${CLAUDE_SKILL_DIR}/scripts/check_update.sh" 2>/dev/null || true`

This is a real host command hook, not ordinary Markdown formatting. Loading the skill can trigger unpinned remote CLI execution through check_update.sh.

中

scripts/shoot.mjs:237

Synchronous file operations

writeFileSync(file, Buffer.from(data, "base64"));

Screenshot paths incorporate unchecked --states values at lines 358-359 and 366. Parent-directory segments can escape the output directory and overwrite writable PNG files.

中

scripts/shoot.mjs:289

Synchronous file operations

writeFileSync(tmp, html);

The generated sheet includes unescaped state labels from line 284, then opens the HTML at line 292. Crafted labels can execute scripts or load external resources.

リスク要因

⚡ スクリプトを含む (5)

assets/style-explorer.html:267 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6

⚙️ 外部コマンド (50)

🌐 ネットワークアクセス (50)

📁 ファイルシステムへのアクセス (40)

assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:89 scripts/shoot.mjs:237 scripts/shoot.mjs:284 scripts/shoot.mjs:289 scripts/shoot.mjs:304 scripts/shoot.mjs:321 scripts/shoot.mjs:327 scripts/shoot.mjs:377 scripts/shoot.mjs:76 scripts/shoot.mjs:6 scripts/shoot.mjs:120 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:60 tests/test_check_update.py:63 tests/test_check_update.py:64 tests/test_check_update.py:78 tests/test_check_update.py:159 tests/test_check_update.py:237 tests/test_shoot.py:9 tests/test_shoot.py:99

🔑 環境変数 (29)

監査者: codex

← スキルに戻る