此報告尚無所請求語言的翻譯，目前顯示規範英文報告。

版本化安全評估

報告編號: SA-47F59DC5

10/5/2026, 4:08:57 AM

oil-ui 安全評估 v2

Skill 安全認證報告

審計紀錄

掃描器版本 3.0.0 稽核模型: codex 最新發佈的報告

技能名稱: oil-ui
版本: v0.15.5
維護者: oil-oil
來源: github.com/oil-oil/oil-ui/tree/48518fd02946ccbda54cd3544f8bd102413128cf/
涵蓋範圍: 24 已掃描檔案 · 3,794 分析行數
策略版本: skillstore-security-audit-policy-v1

已確認問題的最高嚴重性

高

有 2 個已確認的安全問題需要處理。

安裝情境

請查看目前的 Skill 詳情頁

本頁僅彙整報告證據。Skill 詳情頁提供權威安裝建議。

開啟目前的 Skill 詳情頁

本報告不會阻止或授權 manifest 或 ZIP。

Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.

報告位置

證據鏈

證據從來源綁定延伸至安裝契約。證據可用於驗證，但並非安全保證。

來源

已綁定 commit 與路徑
構件

已綁定內容與 tree hash
稽核

已完成
安裝契約

開啟 manifest 進行驗證
開啟 manifest

觀察到的能力

「已觀察到」表示本報告記錄了支持證據；「未記錄」不證明該能力不存在。

包含腳本

可能執行 Skill 隨附的程式碼。

在 2 個證據位置觀察到

網路存取

可能連線至外部服務。

在 45 個證據位置觀察到

檔案系統存取

可能讀取或寫入本機檔案。

在 42 個證據位置觀察到

環境變數

可能讀取處理程序環境中的值。

在 27 個證據位置觀察到

外部命令

可能叫用 Skill 以外的命令或程式。

在 51 個證據位置觀察到

能力複核項目 (2)

高

scripts/check_update.py:182

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.

中

scripts/shoot.mjs:94

Synchronous file operations

res.end(readFileSync(local));

The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.

風險問題

已確認的安全問題與仍需審核的項目分開顯示。

已確認的安全問題 (2)

RISK-001 高

references/style-explorer.md:48-50 references/style-explorer.md:72 scripts/build_explorer.py:289-302

Stored Manifest Commands Can Trigger Agent Execution

The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.

The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.

RISK-002 中

scripts/build_explorer.py:22-26 scripts/build_explorer.py:144-147 assets/style-explorer.html:206-208 references/style-explorer.md:44

Interactive Preview Navigation Bypasses Claimed Network Isolation

Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.

The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.

補救措施

本次稽核記錄了建議的修復措施。實施這些措施是維護者的責任。

FIX-001
高
Explicit updates execute an external CLI that is not included in the audited source.

Retain explicit consent and commit pinning. Audit and vendor the CLI, verify its integrity before execution, and restrict its filesystem and authorization access.
FIX-002
高
Saved manifest commands become executable agent instructions when reopening a comparison.

Treat saved commands as untrusted data. Show the command and working directory, verify their provenance, and request approval after changes.
FIX-003
中
The loopback preview server serves every regular file within its root.

Serve an explicit public-asset allowlist and reject hidden or sensitive resources. Use a dedicated preview directory without private project files.
FIX-004
中
Interactive previews can navigate outside the claimed offline boundary.

Disable scripts for untrusted candidates. Use a network-blocked browser for interactive previews, or clearly disclose that navigation can make external requests.

專家證據

不可變主體身分、掃描器中繼資料、已排除的相符項目和原始碼層級證據。

Artifact 主體

Marketplace 提交: 47f59dc55cb81458b6e112128ee16cf32ef77f31
內容雜湊: b0cb831880a5c7b06680c69a1fb58377e3880c6b39f3cac99ebc6dd647b7e05f
目錄樹雜湊: a1ededc25c8944a52727a8d0e2d657af08e24ca8883570b3b2c0a58c9e1085ec
Skill 路徑: skills/oil-oil/oil-ui
稽核承載資料雜湊: 0a8b43ee1876f952e44388ae71229efc

分析中繼資料

稽核模型: codex

分析狀態: 已完成

範圍僅限於已記錄的檔案、行數、方法和證據；本報告不聲稱進行了執行階段或沙箱執行。

驗證與匯出

JSON 報告已簽署稽核證明 CITATION.cff SARIF 2.1.0 已簽署安裝清單來源

manifest 和 lockfile 將安裝 artifact 綁定到加密雜湊。該完整性聲明獨立於安全評估。

稽核證明: active