Codex, Plugin
Blackbox Plugin
Blackbox Plugin, a plugin listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
plugins/blackbox/assets/anomalies.js, line 499
ackboxRequest(path,method,body) : await fetch(path, {method,headers:{Authorization:`Be
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
plugins/blackbox/scripts/blackbox_codex.py, line 150
process = subprocess.Popen(
plugins/blackbox/scripts/blackbox_compat.py, line 35
process = subprocess.run([str(powershell), '-NoProfile', '-NonInteractive', '-Command',
plugins/blackbox/scripts/blackbox_install.py, line 22
result = subprocess.run([executable, 'plugin', *args], capture_output=True,
Show more
plugins/blackbox/scripts/blackbox_install.py, line 46
response = subprocess.run([executable, 'plugin', *command, '--help'],
plugins/blackbox/scripts/blackbox_launcher.py, line 354
child = subprocess.Popen(args, **options)
tools/bash_error_cases.py, line 94
subprocess.run([sys.executable, '-c', 'import time; time.sleep(2)'], timeout=.1,
tools/benchmark_list_fields.py, line 130
proc=subprocess.run(command,capture_output=True,text=True,timeout=120,check=True)
tools/bootstrap_blackbox.py, line 35
result = subprocess.run([str(shell), '-NoProfile', '-NonInteractive', '-Command', command],
tools/verify_windows_install.py, line 385
shutil.rmtree(resolved)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
plugins/blackbox/assets/anomalies.js, line 499
ackboxRequest(path,method,body) : await fetch(path, {method,headers:{Authorization:`Be
plugins/blackbox/assets/review.js, line 17
try { response = await fetch(path, {signal: AbortSignal.timeout(15000), headers: {Authorization: `Bearer ${token}`}}); }
plugins/blackbox/scripts/blackbox_anomalies.py, line 18
'指定单输出流 curl --write-out 尾部 JSON 支持传输失败和 HTTP 状态；不猜测拆分旧混合文本。'
Show more
plugins/blackbox/scripts/blackbox_anomalies.py, line 25
'支持指定 fail 选项、重定向及中间响应链；只观察最终状态，curl (22) 与状态不重复列出。'
plugins/blackbox/scripts/blackbox_anomalies.py, line 26
'另识别指定完整 curl TLS/证书验证、响应不完整、连接重置、重定向超限和空回复诊断。'
plugins/blackbox/scripts/blackbox_anomalies.py, line 143
# A literal native curl call owns its HTTP payload. Do not reinterpret
plugins/blackbox/scripts/blackbox_business_errors.py, line 30
"""Literal Windows curl POST with inline JSON and headers included in stdout.
plugins/blackbox/scripts/blackbox_business_errors.py, line 88
# curl globbing can silently create multiple requests.
plugins/blackbox/scripts/blackbox_curl_result.py, line 1
"""Explicit native curl write-out contract; never infer state from body text."""
plugins/blackbox/scripts/blackbox_curl_result.py, line 46
return {'rule': 'curl-transfer-result', 'title': f'curl 报告传输失败（代码 {code}）',
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 57c3f6bf542c. can delete files. accepts a host from input, with no fixed list in this file.
Date and source
Date checked:
github.com
Commit graded: 57c3f6bf542c4b4f9f79ad67604631492f447202
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.