360 Secure SkillHub
360 安全技能中心

OrderCLI Security Advisory

这是OrderCLI的安全审计通告，2026-05-07审计检出0个关键、2个高危、2个中危安全问题，涵盖JSON无Schema校验、PII数据未受限等；适用于OrderCLI开发者排查工具安全风险，清晰列示问题及针对性修复措施，帮助快速定位风险并整改。

terrycarter1985
terrycarter1985
热度 29.61
最近更新 2026-05-11 17:47:47
分类：安全依赖：代码执行应用场景：报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add ordercli-security-advisory
Metadata
name
ordercli-security-advisory
description
Security advisory for OrderCLI — 2 high/critical issues found on 2026-05-07T09:15:31Z
version
0.1.0
metadata
{"type":"security-advisory","critical":0,"high":2,"medium":2}

OrderCLI Security Advisory

Date: 2026-05-07T09:15:31Z

Summary

Audit of /root/.openclaw/workspace/ordercli found 2 high/critical issues.

  • 🔴 Critical: 0
  • 🟠 High: 2
  • 🟡 Medium: 2

Findings

  • 🟡 MEDIUM: Some CRUD-like functions lack visible auth checks — manual review recommended
  • 🟠 HIGH: JSON is loaded without schema validation (1 json.load(s) calls, 0 validators)
  • 🟡 MEDIUM: File operations without try/except error handling
  • 🟠 HIGH: orders.json contains 3 PII field(s) — ensure access is restricted

Recommended Actions

  1. Fix all critical issues before any production deployment
  2. Rotate any exposed credentials immediately
  3. Add input validation and parameterized queries
  4. Restrict file permissions on data files containing PII
  5. Re-run audit after fixes: ./run-audit.sh /root/.openclaw/workspace/ordercli

Auto-generated by run-audit.sh