Codex, Plugin
Cloversec Ctf Forexample
Codex plugin marketplace for CloverSec CTF research, asset collection, Docker conversion, writeups, archiving, review, Hub preparation, and final reporting.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 40caf12c41c7, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_CAP_REACHED
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_browser_search.py, line 101
result = subprocess.run(["open", url], capture_output=True, text=True, timeout=5, check=False) - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_docker.py, line 746
with socket.create_connection((host_text, int(port_text)), timeout=max(float(timeout), 0.1)): - SECRETS_PATH_DOTENV Low
Mentions a .env file.
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-writeup-scaffold/scripts/extract_context.py, line 134
TEXT_EXTENSIONS = {".md", ".txt", ".yaml", ".yml", ".json", ".py", ".js", ".ts", ".php", ".sh", ".conf", ".ini", ".env", ".dockerfile"} - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_search.py, line 2396
token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN") - OBFUSCATION_FILE_CAP_REACHED Note
The 400 file cap was reached before every file was read.
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/templates/baseunit/Dockerfile.tpl, line 1
{{> snippets/docker-common-prolog.tpl }}
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_browser_search.py, line 101
result = subprocess.run(["open", url], capture_output=True, text=True, timeout=5, check=False)
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_delivery.py, line 488
shutil.rmtree(delivery)
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_delivery.py, line 1006
shutil.rmtree(delivery / PROCESS_EVIDENCE_DIR, ignore_errors=True)
Show more
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_delivery.py, line 1480
shutil.rmtree(path, ignore_errors=True)
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_delivery.py, line 1485
shutil.rmtree(path, ignore_errors=True)
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_docker.py, line 328
evidence["steps"].append(run_command(commands.get("stop", ["docker", "stop", container_name]), timeout=command_timeout))
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_docker.py, line 329
evidence["steps"].append(run_command(commands.get("rm", ["docker", "rm", container_name]), timeout=command_timeout))
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_docker.py, line 453
result = subprocess.run(args, check=False, capture_output=True, text=True, timeout=timeout)
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_docker.py, line 618
run_args = commands.get("run")
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_doctor.py, line 254
completed = subprocess.run(
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_doctor.py, line 305
completed = subprocess.run(command, check=False, capture_output=True, text=True, timeout=timeout)
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_progress.py, line 184
os.system("clear")
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/scripts/render_bundle.py, line 200
shutil.rmtree(app_dir)
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/scripts/render_scenario.py, line 215
shutil.rmtree(out_dir)
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/scripts/render_scenario.py, line 260
shutil.rmtree(out_dir)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_docker.py, line 746
with socket.create_connection((host_text, int(port_text)), timeout=max(float(timeout), 0.1)):
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_http.py, line 40
with fetch(request, timeout=timeout) as response: # noqa: S310 - public-source fetch helper.
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_review.py, line 537
with socket.create_connection((host_text, int(port_text)), timeout=max(float(timeout), 0.1)):
Show more
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/examples/java/smoke_assert.sh, line 11
with urllib.request.urlopen(url, timeout=10) as resp:
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/examples/java-jar-basic/smoke_assert.sh, line 11
with urllib.request.urlopen(url, timeout=10) as resp:
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/examples/node/smoke_assert.sh, line 11
with urllib.request.urlopen(url, timeout=10) as resp:
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/examples/node-awdp-basic/check/check.sh, line 5
BODY="$(curl -fsS --max-time 10 "http://${TARGET_IP}:${TARGET_PORT}/")"
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/examples/node-basic/smoke_assert.sh, line 11
with urllib.request.urlopen(url, timeout=10) as resp:
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_search.py, line 2396
token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_search.py, line 2399
if os.environ.get("CLOVERSEC_DISABLE_GH_AUTH_TOKEN") == "1":
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-writeup-scaffold/scripts/extract_context.py, line 134
TEXT_EXTENSIONS = {".md", ".txt", ".yaml", ".yml", ".json", ".py", ".js", ".ts", ".php", ".sh", ".conf", ".ini", ".env", ".dockerfile"}
Show more
plugins/cloversec-ctf-forexample/scripts/cloversec_ctf_workflow.py, line 3211
env_token = "GITHUB_TOKEN" if os.environ.get("GITHUB_TOKEN") else ("GH_TOKEN" if os.environ.get("GH_TOKEN") else "")
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/scripts/render_component.py, line 134
"env": ensure_dict(variant.get("env"), f"components.{component_id}.{variant_id}.env"),
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
plugins/cloversec-ctf-forexample/skills/cloversec-ctf-build-dockerizer/templates/baseunit/Dockerfile.tpl, line 1
{{> snippets/docker-common-prolog.tpl }}
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 40caf12c41c7. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: 40caf12c41c7721b36d6ca8a0c351e507d01f23c
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.