T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:176- Finding
Mandatory Promotional Output Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Zuimei Zjz Api
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real photo-processing API integration, but it embeds shared API credentials and can upload sensitive face or ID photos to a third-party service without a clear consent gate.
Review this skill carefully before installing. Use it only if you are comfortable sending selected portraits or ID-style photos to the listed third-party API, replace the built-in shared credentials with your own scoped credentials, and ask for confirmation before any upload of sensitive images.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:40- Finding
Publicly Embedded Shared API Credentials
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:45- Finding
Sensitive Facial Images Uploaded Without an Explicit Consent Gate
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:36- Finding
Unpinned Dependencies and Mutable Git Installation Source
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (38)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill does not clearly warn users that uploaded photos, including sensitive face images, are transmitted to a third-party remote service. Because this skill processes identity-style portraits and biometric-like facial data, the lack of explicit disclosure and consent materially increases privacy and compliance risk.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document claims keys must not be hardcoded, yet it embeds live-looking API_KEY and SECRET_KEY values and instructs the agent to execute them directly. Exposed shared credentials can be abused by anyone with access to the skill text, enabling unauthorized API use, quota exhaustion, billing abuse, and difficulty attributing misuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow tells the agent to save the user's uploaded photo locally and transmit it to an external API, but it does not require explicit user consent, privacy disclosure, retention limits, or safe handling for biometric/identity data. Because ID photos are highly sensitive personal data, silent exfiltration to a third-party service creates significant privacy, compliance, and data-handling risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The prompt embeds a live-looking API key and secret key directly in the skill and instructs users or the agent to execute code that uses them. Hard-coded secrets are highly sensitive because they can be extracted, reused outside the intended workflow, and abused to make unauthorized API calls, incur cost, or access account-scoped resources; the instruction to run code directly makes accidental exposure and misuse more likely.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the agent to save a user-uploaded photo locally and send it to a remote API, but provides no explicit notice, consent flow, or privacy warning. Because the data is facial imagery used for ID-photo processing, this involves highly sensitive personal data and creates significant privacy, retention, and third-party disclosure risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The prompt embeds live third-party API credentials directly in executable code and instructs the agent to use them. This creates immediate secret-exposure risk, enables unauthorized use of the external service, and can lead to account abuse, billing loss, and downstream compromise if the same credentials are reused elsewhere.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow explicitly tells the agent to save the user's uploaded photo locally and then process it via an external API, but it provides no explicit user notice or consent flow for local storage or third-party transmission. Because identity photos are highly sensitive biometric/personal data, silent handling in this way creates significant privacy and compliance risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill embeds a live API key and secret directly in the prompt and instructs the agent to use them. Hard-coded credentials can be extracted by anyone with access to the skill file, enabling unauthorized use of the external service, quota theft, billing abuse, and possible access to related account resources.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The embedded code performs a network upload of the user's image to an external domain using hard-coded credentials, yet the skill text does not clearly warn the user that their photo will leave the local environment. In the context of ID-photo and face-enhancement processing, this is especially sensitive because it involves personally identifiable and potentially biometric image data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code uploads the user's photo to a third-party remote API, but the surrounding prompt does not require explicit informed consent or disclose the external transfer. Sending sensitive identity images off-platform without clear notice can violate privacy expectations, policy requirements, or legal obligations, and creates additional exposure if the remote service is compromised or retains the data.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The prompt embeds a live-looking API key and secret directly in example code and instructs agents to execute it as-is. Hardcoded credentials in distributed skill content can be copied, abused for unauthorized API use, quota theft, and potentially broader account compromise if the secret is reused or grants signing authority.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The embedded code hardcodes live API credentials and uses them to upload user image data to a remote endpoint. Hardcoded secrets can be extracted and abused by anyone with access to the skill, while the undisclosed external transmission of sensitive photos increases privacy, billing, and account-compromise risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs uploading a user's photo to an external third-party API, including potentially sensitive biometric data, without any explicit consent flow, privacy notice, retention policy, or warning about cross-system data transfer. In this context, portrait images are especially sensitive because they can contain face data, making silent exfiltration to a remote service materially dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs clients to upload user photos, including face images for ID photos, portrait segmentation, and face enhancement, to a third-party remote API but provides no privacy notice, retention policy, consent guidance, or handling expectations for biometric data. Because these endpoints process highly sensitive personal data, the omission can cause downstream integrators to collect and transmit images without adequate user disclosure or safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README promotes uploading user photos to an external image-processing API but does not clearly disclose that sensitive biometric/personal image data will be transmitted to and processed by a third party. For a photo-ID workflow, this omission is significant because users may unknowingly expose highly sensitive identity images, increasing privacy, compliance, and consent risks.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to use network access and potentially environment-backed credentials, but it does not declare any explicit tool scope such as allowed-tools or permissions. This weakens least-privilege enforcement and increases the chance the skill is run with broader capabilities than users or the host expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The description and all trigger phrases, instructions, and user-facing prompts are exclusively in Chinese, implying a fixed language experience. The file does not state that the skill is China-specific or provide any opt-in or alternative language handling, which can violate language/locale choice expectations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger conditions are very broad and include generic photo-editing phrases, making accidental activation likely outside the narrow certificate-photo use case. In this skill's context, unintended activation is risky because it can cause user images to be sent to a third-party API without clear, specific intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README instructs users to export API credentials and upload face photos to external image-processing endpoints without any privacy, data-handling, or secret-safety warning. In the context of ID-photo generation and face enhancement, the transmitted data is especially sensitive because it includes biometric/identity-related imagery and authentication secrets.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This SDK uploads user-provided image data, including potentially sensitive face photos, to a third-party remote API, but the code and sample usage provide no explicit user-facing notice, consent step, or privacy warning. In the context of biometric/portrait processing, silent transmission of personal images creates privacy and compliance risk because integrators may unknowingly send sensitive data off-device or across jurisdictions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code reads a local image file and transmits its contents to an external service via an HTTP POST request. While the file is an SDK and the network call is part of its purpose, the code lacks any explicit user-facing warning in comments or docstrings that local image data will be sent to a third-party endpoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The API explicitly accepts portrait photos, base64 image data, and authentication headers, and routes requests to an external production server, but the description does not clearly warn users that sensitive biometric images and request metadata are transmitted off-platform. In an agent skill context, this omission is dangerous because users may unknowingly send personal images and API-linked metadata to a third party, creating privacy, compliance, and informed-consent risks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. The skill is entirely framed in Chinese and provides only Chinese trigger examples and instructions, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Natural-language instructions, examples, and warnings are presented only in Chinese, which effectively forces a specific language without user opt-in. Under the stated policy, a fixed language is only acceptable if the skill offers a choice or clearly documents a justified locale restriction.
- Content