ZKGov

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:18 AM UTC
• Version: 0.0.3

Overview

This skill is purpose-aligned for ZK governance, but it asks agents to install mutable npm code and perform wallet-backed on-chain actions with persistent key material.

Install only if you are comfortable running the current @zkgov npm packages and using a persistent testnet wallet. Prefer pinning reviewed package versions, using a sandboxed agent environment, keeping only testnet funds in the wallet, and requiring explicit confirmation before any register, create, vote, or finalize action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15

Finding

Unpinned npm Packages Allow Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-19
Vulnerability Type: Unpinned third-party package installation and execution
Risk Level: High

Vulnerable Code

bash

# MCP server (preferred — works with Claude Code, Cursor, Windsurf, VS Code)
# https://www.npmjs.com/package/@zkgov/mcp
claude mcp add zkgov npx @zkgov/mcp

# Standalone CLI
# https://www.npmjs.com/package/@zkgov/cli
npm install -g @zkgov/cli
zkgov --help

Technical Analysis

The installation instructions execute @zkgov/mcp through npx and install @zkgov/cli globally without specifying exact package versions or verifying package integrity. Consequently, the code installed or executed depends on whichever package release the npm registry resolves at the time of use, rather than a version reviewed with this skill.

npx @zkgov/mcp can download and execute the current registry version. Similarly, npm install -g @zkgov/cli installs a mutable latest release and may run npm lifecycle scripts during installation. If the publisher account, npm package, registry resolution, or a transitive dependency is compromised, a malicious release can execute code under the privileges of the user running the agent.

Registering the unpinned MCP command also creates an ongoing trust relationship: subsequent invocations may resolve a newer, unreviewed package version. The referenced npm web pages are informational links and provide no cryptographic integrity enforcement.

Attack Path

1. An attacker compromises the npm publisher account, an upstream dependency, or another part of the package publication pipeline.
2. The attacker publishes a malicious version of @zkgov/mcp, @zkgov/cli, or a dependency resolved by either package.
3. A user or agent follows the documented installation instructions without an explicit version or integrity lock.
4. npx retrieves and runs the malicious MCP package, or npm installs the malicio ...[truncated 1311 chars]

Remediation

View remediation

Remediation Suggestions

• Pin both packages to explicitly reviewed, immutable versions, for example:

  bash

  claude mcp add zkgov npx --yes @zkgov/mcp@<reviewed-version>
  npm install -g @zkgov/cli@<reviewed-version>
  

• Prefer a checked-in lockfile and local project installation over global installation. Use npm ci so dependency versions must match the lockfile.
• Verify package provenance, signatures where supported, publisher identity, and expected integrity hashes before execution.
• Review direct and transitive dependencies, including npm lifecycle scripts, before approving package upgrades.
• Disable lifecycle scripts during installation where compatible, such as with npm install --ignore-scripts, and execute only reviewed entry points.
• Do not run npm, npx, the CLI, or the MCP server with administrator or root privileges.
• Run the MCP server in a sandbox with restricted filesystem, environment-variable, credential, and network access.
• Do not expose wallet private keys to the MCP or CLI process unless strictly required. Use a dedicated low-value testnet wallet and narrowly scoped secret injection.
• Establish an explicit update process in which new package versions are reviewed, tested, and pinned before deployment rather than automatically consuming the latest release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation guidance is overly broad, including phrases like 'anything related to on-chain voting with privacy,' which can cause the skill to trigger in contexts where the user did not explicitly request this tool. Because the skill can progress from informational queries into wallet-aware and transaction-capable flows, over-triggering increases the chance of unintended tool use and exposure to on-chain actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs the agent to run an unpinned package via npx @zkgov/mcp, which fetches and executes the latest published code at runtime. This creates a supply-chain risk: a compromised maintainer account, poisoned dependency, or malicious update could cause arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes write tools and autonomous participation in governance but does not require an explicit warning that wallet creation and on-chain transactions may occur. In an agent setting, this can mislead users into triggering state-changing actions with financial or governance consequences without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill persists a generated private key at ~/.zkgov/config.json, creating session-to-session credential state. Even with 0o600 permissions, persistent wallet material increases the blast radius of host compromise, accidental reuse across tasks, and unintended autonomous identity continuity for governance actions.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

## Wallet

On first write operation, a wallet is auto-generated at `~/.zkgov/config.json` (mode 0o600). The same private key derives both the EVM account and the Semaphore ZK identity.

Override with env var: `ZKGOV_PRIVATE_KEY=0x...`

Static analysis

No suspicious patterns detected.