Bijian AI Writing Expert

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:17 PM UTC
• Version:
  1.1.0

Overview

This skill is a disclosed Ziniao Browser bridge controller that uses a local API key and local HTTP bridge as expected for its purpose.

Install only if you intend to let the agent control Ziniao Browser through the local ZClaw bridge. Protect the ZCLAW_API_KEY, review ~/.zclaw/config.json permissions, and confirm browser/store actions before using it on sensitive accounts or transactions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to source a local config file to read API credentials and make outbound network requests, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users or the platform may not realize the skill can access environment-derived secrets and contact external services, increasing the risk of unintended secret use or data exfiltration.

VirusTotal

66/66 vendors flagged this skill as clean.