審計紀錄
ai-listening - 2 審計
版本對比
各稽核版本間的能力與發現變化，最新在前。
2026年10月27日 上午09:11
The skill instructs users to execute a pinned third-party package and optionally provide a service credential. The package implementation was not included in the reviewed file, so its behavior and credential handling remain unverified. Other flagged backticks, links, credential-path checks, and reconnaissance patterns are benign in context.
能力複核項目 (4)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
風險因素
⚙️ 外部命令 (14)
🌐 網路存取 (2)
📁 檔案系統存取 (2)
🔑 環境變數 (2)
2026年10月20日 下午02:43
Most alerts match Markdown formatting, documented authentication checks, or report fields rather than dangerous behavior. The fallback setup clones an unpinned external repository and subsequently executes its Python module, creating a supply-chain risk. No evidence found of credential exfiltration or prompt injection in SKILL.md; the external implementation was not included for review.
能力複核項目 (2)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。