Lap Tran
4a2301b077
CI / build (push) Has been cancelled
- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/ - status.py: add --cleanup-done and --install-cleanup-schedule commands - Add scripts/automaton-cleanup.sh for periodic task archiving - Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders - .rules.md: add Self-Documenting UI Names rule - New tests: test_cleanup_done.py, expanded test_app.py and test_task.py
820 B
820 B
Adversarial Bug Report — port-pi-guard
Attack Vectors
- Status.py not available: The plugin falls open (allows all edits) — can this be triggered maliciously?
- Command injection in execSync: Is the
cmdstring safe from injection? - Bash tool regex bypass: Can write operations evade the bash tool pattern check?
Findings
- Fall-open when status.py is missing is acceptable for offline/local use — an attacker who can remove status.py already has system access
execSyncuses hardcoded command parts +process.cwd()— no user input in the command string, safe- Bash regex could be evaded with alternative write commands (e.g.,
install,cat >), but this is a best-effort check and the guard primarily targets edit/write tools
Verdict
No exploitable vulnerabilities found.