ZLQA-GMT-API-Test

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

This appears to be a real GM API testing helper, but it runs and edits unverified project test scripts from a mutable external checkout and handles sensitive test configuration with limited safeguards.

Review this before installing. Only use it with a ZLQA checkout you trust, avoid placing real production secrets in markdown config files, keep the checkout out of shared commits unless secrets are excluded, and expect the skill to edit and execute project-local Python and open generated HTML reports.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/runner.py:180

Finding

Mutable Remote Repository Scripts Are Discovered and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-18, scripts/runner.py:63-76, and scripts/runner.py:180-191
Vulnerability Type: Remote payload retrieval and execution without version pinning or integrity verification
Risk Level: High

Vulnerable Code

SKILL.md:14-18 instructs users to clone a mutable remote repository without selecting a reviewed commit or verifying its integrity:

bash

git clone https://codeup.aliyun.com/6364d32c1d6d547e3e84d9fc/ZLQA.git

scripts/runner.py:63-76 trusts any interface directory containing a file named run_tests.py:

python

# Scan interface directories (subdirectories containing run_tests.py)
interfaces = {}
for item in os.listdir(gmt_api_dir):
    item_path = os.path.join(gmt_api_dir, item)
    if os.path.isdir(item_path):
        run_script = os.path.join(item_path, 'run_tests.py')
        if os.path.exists(run_script):
            interfaces[item] = item_path

if not interfaces:
    return f"[ERROR] No interface test directory found (must contain run_tests.py)"

The original messages in the source are localized, but the executable behavior is shown without alteration.

scripts/runner.py:180-191 subsequently executes the discovered script with the current user's privileges:

python

# Set cases to execute
set_execute_cases(script_path, case_ids)

# Execute tests
result = subprocess.run(
    ['python', 'run_tests.py'],
    cwd=interface_dir,
    capture_output=True,
    text=True,
    encoding='utf-8',
    errors='replace',
    timeout=120
)

Technical Analysis

The documented setup process retrieves a repository from an external URL without pinning a commit, validating a cryptographic digest, or verifying a trusted signature. The effective code executed by the Skill can therefore change after this Skill package has been reviewed.

During initialization, the runner treats the mere presence of `r ...[truncated 2524 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the external project to a specifically reviewed commit hash or immutable signed release rather than cloning the default branch.
2. Publish an allowlist manifest containing the approved relative path and SHA-256 digest of every executable test script.
3. Verify the manifest signature and each script digest immediately before execution; fail closed on missing, modified, or unexpected files.
4. Do not authorize scripts based only on the filename run_tests.py. Register only explicitly approved interfaces and canonicalize all configured paths before use.
5. Store the expected repository origin and commit identifier in skill_config.json, then verify the checkout against both values before every run.
6. Execute external tests in an isolated environment, such as a disposable container or restricted worker account, with a read-only project mount where feasible.
7. Expose only the minimum required configuration to the test process. Keep signing secrets in a dedicated secret store and provide scoped, short-lived credentials.
8. Deny outbound network access by default and allow only the specific GM API endpoints required for testing.
9. Invoke the intended interpreter through sys.executable after validating the runtime environment, rather than resolving a generic python executable from PATH.
10. Record the verified commit, script digest, execution time, and selected interface in an audit log so test runs can be traced to exact reviewed code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to place sensitive values such as server URLs, app secrets, and test account data into local markdown config files without any guidance on secure storage, redaction, access control, or avoiding commits to version control. In a workflow that starts with cloning a shared repository and scanning project directories, this creates a realistic risk of credential leakage through local files, repository commits, logs, screenshots, or report artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are very generic Chinese terms such as '执行' and '初始化', which are likely to appear in unrelated user requests. In an agent ecosystem, broad triggers can cause this skill to activate unintentionally, leading to unexpected execution of its runner and possible invocation of testing or report-generation logic outside the intended context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Natural-language strings throughout the file, including the skill description and prompts, assume Chinese usage and the parser recognizes Chinese command phrases. There is no opt-in or documented language choice, which can violate language/locale policy requirements for user-selectable interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill modifies another script file in place without warning or confirmation, changing EXECUTE_CASES directly inside run_tests.py. Silent mutation of project code can corrupt working trees, interfere with concurrent users, or be abused to persist changes in repositories the user did not expect to alter. The danger is amplified because the target path comes from previously stored configuration rather than an immediate, explicit choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The code executes a project-local run_tests.py in a subprocess using a user-configurable project path discovered during initialization. Because the skill trusts and runs whatever script exists in that directory, a malicious or compromised project can achieve arbitrary code execution under the user's account. The skill context increases risk because code execution is a core behavior but there are no trust checks, allowlists, or explicit warnings before running untrusted local code.

Content

Scanner excerpt · scripts/runner.py (reported line 196)May include surrounding context.

python

set_execute_cases(script_path, case_ids)

    # 执行测试
    result = subprocess.run(
        ['python', 'run_tests.py'],
        cwd=interface_dir,
        capture_output=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This skill both executes project-provided code and opens generated HTML reports from the same untrusted project tree. That combination can lead to arbitrary code execution first, then launching attacker-controlled HTML in the browser, which may trigger phishing, local file access prompts, or exploitation of browser/file-handler quirks. The lack of manifest justification and user-facing warning makes the behavior more dangerous in an agent skill setting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill runs a subprocess that executes local project code without a clear warning that arbitrary code from the selected project will run. Users may believe they are invoking a benign test helper, but the discovered run_tests.py can perform any action available to the current account, including filesystem, network, or credential access. In an agent context, hidden code execution is especially risky because it violates informed consent expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill states that runner.py will automatically call os.startfile() to open an HTML report, causing local content to launch without an explicit user confirmation or warning. While opening a local report is often legitimate, automatic execution of associated handlers increases risk if report files are tampered with, generated in unsafe locations, or contain active content that triggers browser or shell-integrated behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The docstring presents the module as a configuration-adapting executor, but the implementation silently rewrites run_tests.py before execution. This mismatch hides a side effect that changes project files, which can break workflows, alter test logic, or create an unexpected persistence point if an attacker influences the target file. In security-sensitive tooling, undisclosed file modification materially increases risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.