技能 backlink-guard 審計紀錄
📦

審計紀錄

backlink-guard - 2 審計

版本對比

各稽核版本間的能力與發現變化,最新在前。

版本日期結果複核項目相對上一版變化
v2 最新2026年10月27日 上午09:11 1 已確認0能力無變化
v1 2026年10月26日 上午10:22 無已確認發現1基線

2026年10月27日 上午09:11

The static matches are Markdown formatting, ordinary documentation links, application state, credential names, or unrelated prose. The skill instructs users to execute a pinned external package that was not included in this review.

1
已掃描檔案
189
分析行數
5
複核項目
0
已忽略的誤報

已確認的安全問題 (1)

中
Unreviewed external package execution
The instructions download and execute a pinned PyPI package. Its implementation is outside the reviewed skill files, so its behavior and integrity remain unverified.
The instructions explicitly invoke a PyPI release, and the reviewed file set contains only the skill documentation.
審計單位: codex

2026年10月26日 上午10:22

Of 105 static findings, 104 are false positives involving Markdown, optional credential names, documented URLs, application state, or SEO terminology. One finding identifies the external-package execution boundary: the required PyPI runtime is absent from the audited files, so its behavior remains unverified. No evidence found of prompt injection, credential theft, destructive commands, or unauthorized reporting in SKILL.md.

1
已掃描檔案
177
分析行數
5
複核項目
0
已忽略的誤報
能力複核項目 (1)

這些是真實的本機能力,對此技能而言可能是預期行為,因此需要複核,但不會按已確認的惡意行為計分。

中
Ruby/shell backtick execution
1. Run the pinned release from PyPI: `uvx backlink-guard==0.10.0 <command>` when `uv` is there, else
The setup explicitly installs or executes a PyPI package absent from the audited files. Pinning does not verify its behavior with local access or optional credentials.
審計單位: codex