Security audit

ZLQA-GMT-API-Test

Security checks across malware telemetry and agentic risk

Overview

This GM API testing skill appears purpose-built, but it should be reviewed because it runs and modifies local project Python test files that may use API secrets.

Install only if you trust the ZLQA repository and every run_tests.py it contains. Use least-privilege test credentials, avoid production GM secrets, keep config files with secrets out of version control, and check your project diff after running because this skill edits project files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: set_execute_cases(script_path, case_ids) # 执行测试 result = subprocess.run( ['python', 'run_tests.py'], cwd=interface_dir, capture_output=True,
Confidence: 95% confidence
Finding: The code executes a discovered `run_tests.py` from a user-configured project path after scanning the filesystem, so the skill will run arbitrary Python code located in whatever project directory the user points it at. Although `subprocess.run` is used without a shell, reducing classic shell-injection risk, this is still dangerous because the trust boundary is the external project content, and the skill also selects the working directory from that untrusted path.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The module description frames the skill as dynamic path configuration, but the implementation goes further by discovering, modifying, and executing `run_tests.py` files inside the target project. This mismatch is security-relevant because it can cause users to underestimate the level of code execution and file modification the skill performs, weakening informed consent and increasing the chance of unsafe use.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs users to place sensitive values such as the signing secret and test account data into project config files, but provides no guidance on secure storage, redaction, access control, or avoiding commits to version control. In a testing skill that relies on a cloned repository and automated discovery, this increases the chance of credential exposure through source control, logs, reports, or local file leakage.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The skill states that runner.py will automatically invoke os.startfile() to open a generated HTML report, causing an unsolicited local file action. While opening a local report is often convenient, doing so automatically without explicit user confirmation or warning can surprise users and increases risk if report content is unsafe or if the default browser executes active content.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases are extremely generic terms such as '执行', '初始化', '测试报告', and '接口列表', which can easily appear in normal user conversations unrelated to this skill. This increases the chance of accidental invocation or routing collisions, causing the agent to run testing-related actions in unintended contexts.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: `set_execute_cases` rewrites `run_tests.py` in place based on user input, altering code in the target project without backup, validation, or clear prior warning. This is dangerous because it can corrupt project files, create persistent unintended changes, and, in combination with later execution, turns the skill into a code-modifying launcher for external scripts.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.