zlm

• Outcome: Pass
• Latest audit: May 27, 2026 · 10:55 PM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it fetches the public ZLMediaKit project, checks GitHub issues and PRs, and writes a local report, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable with the agent contacting GitHub, cloning or updating ZLMediaKit under the configured workspace, and writing a local report. If you provide GITHUB_TOKEN, use a low-scope token and treat it as a secret. For cautious use, set WORKSPACE_DIR to a dedicated folder and ask the agent before running sync or periodic workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(cmd, cwd=None):
    print(f"Running: {cmd}")
    result = subprocess.run(cmd, shell=True, cwd=cwd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"Error executing {cmd}:\n{result.stderr}")
    return result.stdout.strip()

• Confidence: 91% confidence
• Finding: The helper executes shell commands with shell=True, which turns any string passed into run_cmd into shell-interpreted input. In this file the current call sites are hardcoded git commands, but the design is unsafe and becomes exploitable if any repo path, command fragment, or future parameter is influenced by untrusted input or environment state.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares required tools but does not declare permissions despite instructing the agent to use shell commands, access environment variables, write to a local workspace, and access the network. This creates a capability/permission mismatch that can lead to overly broad execution at runtime without clear consent boundaries or security review.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill description is broad enough that common requests about ZLMediaKit updates, issues, PRs, or source analysis could trigger it unexpectedly. Because the workflow includes code synchronization and external queries, an accidental invocation can cause unintended network access and local workspace modification without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented workflow instructs the agent to run git clone/git pull and gh/curl commands, which both modify the local workspace and communicate with external services, but it does not require clear disclosure or confirmation to the user first. This creates a consent and safety problem because seemingly simple analysis requests could lead to persistent filesystem changes and network activity.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The README states that the skill will automatically clone/update a repository into a fixed local path and access the GitHub API, but it does not clearly disclose the privacy, network, and filesystem side effects to the operator. In an agent skill context, missing disclosure can lead users to trigger unexpected outbound requests and local writes, which is a real safety issue even if it is not inherently malicious.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger text is broad enough to activate on general requests about ZLMediaKit dynamics, issues, PRs, or source analysis, which can cause the skill to run shell and network operations more often than a user explicitly intended. Overbroad invocation increases the chance of unnecessary code pulls, remote queries, and local file changes in response to ambiguous prompts.

Static analysis

No suspicious patterns detected.