Skip to content

fix(e2): report child-process env pass-through as LOW instead of HIGH #492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
malinfossum wants to merge 6 commits into
base: main
Choose a base branch
from
Open

fix(e2): report child-process env pass-through as LOW instead of HIGH #492

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4c7c849
fix(e2): exempt child-process env pass-through from harvesting
malinfossum Sep 7, 2026
cd13a66
fix(e2): scope child-process env pass-through to the reaching definition
malinfossum Sep 14, 2026
3eba306
fix(e2): track environment bindings per lexical scope
malinfossum Sep 30, 2026
3c4ab83
fix(e2): close environment bindings only on rebindings that surely run
malinfossum Oct 7, 2026
42fa2cf
fix(e2): trust only imported launchers and unreachable bindings
malinfossum Oct 14, 2026
ac40099
fix(e2): visit annotations and report pass-through copies as LOW
malinfossum Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -561,7 +561,7 @@ SkillSpector detects **71 vulnerability patterns** across 17 categories:
| ID | Pattern | Severity | Description |
|----|---------|----------|-------------|
| E1 | External Transmission | MEDIUM | Sending data to external URLs |
| E2 | Env Variable Harvesting | HIGH | Enumerating, copying, or searching environment data to collect secrets |
| E2 | Env Variable Harvesting | HIGH | Enumerating, copying, or searching environment data to collect secrets. A copy traced only to a child process's `env=` is reported LOW |
| E3 | File System Enumeration | MEDIUM | Scanning directories for sensitive files |
| E4 | Context Leakage | HIGH | Transmitting conversation context externally |

Expand Down
Loading
Loading