Zhipu Asr

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:43 PM UTC
• Version: 1.0.2

Overview

This is a coherent Zhipu AI transcription skill, but users should know selected audio and optional context are sent to Zhipu and the API key may be briefly visible in local curl process arguments.

Install only if you are comfortable sending the selected audio file, any prompt text, and hotwords to Zhipu AI for transcription. Avoid using it for confidential recordings without authorization, and prefer a hardened version that passes the API key through a protected curl config or equivalent mechanism instead of process arguments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/speech_to_text.sh:145

Finding

Zhipu API Key Exposed Through Command-Line Arguments

Content

View full analysis

/cmdline`, `ps`, or auditing and monitoring software. Exploitation requires local process-inspection access, generally from the same account or a sufficiently privileged account, depending on operating-system process-isolation settings. ### Attack Path 1. A victim runs `scripts/speech_to_text.sh` with a valid `ZHIPU_API_KEY`. 2. The script launches `curl` and embeds the bearer token in its argument vector. 3. A local attacker or monitoring process observes newly launched `curl` processes. 4. The attacker reads the process arguments while the request is active and extracts the Authorization header. 5. The attacker reuses the recovered token when sending requests to Zhipu AI. The observation window may be ...[truncated 577 chars]

Remediation

View remediation

"$CURL_CONFIG" RESPONSE=$(curl --silent --show-error \ --config "$CURL_CONFIG" \ --request POST \ "$API_ENDPOINT" \ --form "file=@$AUDIO_FILE" \ --form "model=glm-asr-2512") ``` The implementation should also preserve the existing prompt and hotword form fields without placing the API key back into the argument vector. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/speech_to_text.sh (reported line 10)May include surrounding context.

sh

# Configuration
API_ENDPOINT="https://open.bigmodel.cn/api/paas/v4/audio/transcriptions"

# Get API key from environment
if [ -z "$ZHIPU_API_KEY" ]; then
    echo "Error: ZHIPU_API_KEY environment variable is not set" >&2
    echo "" >&2

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to transcribe audio with a third-party Zhipu AI service but does not clearly warn that the audio content will be uploaded off-host to an external provider. This can lead users to unknowingly send sensitive voice recordings, meetings, calls, or personal data to a remote service, creating privacy, confidentiality, and compliance risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

bash

# Install dependencies (if needed)
sudo apt-get install jq ffmpeg

# Set your API key
export ZHIPU_API_KEY="your-key-here"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly instructs users to run shell commands and declares required binaries, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an avoidable trust and governance gap: an agent may invoke shell-capable behavior without a narrowly documented execution boundary, increasing the risk of unintended command execution or misuse in environments that rely on manifest scoping for enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends user-provided audio to Zhipu AI's external ASR API, but the description and setup do not clearly warn users that their audio and optional prompt/hotwords leave the local environment. This omission can cause users to unknowingly disclose sensitive voice content, personal data, meeting recordings, or confidential context to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script uploads the supplied audio file to Zhipu's remote transcription API, but it does not present an explicit privacy warning or confirmation that audio content will leave the local system. In an agent skill context, users may assume local processing, so this can cause unintended disclosure of sensitive voice content, background speech, or embedded secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description and introduction explicitly position the skill for Chinese audio transcription and the examples are all Chinese-focused, but the file does not state this as an optional preference or explain a necessary region-specific limitation. This can be a natural-language locale policy issue when a skill appears to enforce a specific language context without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest keywords include "chinese", which signals a language-specific scope in the skill metadata, but the file does not document that this language constraint is optional or user-selectable. Under the policy rule for natural-language constraints, language-specific behavior should be opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.