zsxq-fetch-subscription

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:57 PM UTC
• Version: 1.0.0

Overview

The skill’s ZSXQ database workflow is coherent, but its documented server startup can expose private synced content and sync controls on all network interfaces without documented authentication.

Install only if you trust the local ZSXQ API service and can keep port 8000 private. Prefer binding the service to 127.0.0.1, adding authentication, and approving manual syncs only when you actually want fresh external content fetched into the local database.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Network-Exposed Data API Without Documented Authentication

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29 and 46–75
Vulnerability Type: Insecure network binding and missing access-control guidance
Risk Level: Medium

Vulnerable code snippet:

bash

uvicorn app.main:app --host 0.0.0.0 --port 8000

The following documented API operations do not include authentication credentials:

bash

curl "http://127.0.0.1:8000/api/v1/sync_status"
curl -X POST "http://127.0.0.1:8000/api/v1/trigger_sync"
curl "http://127.0.0.1:8000/api/v1/topics?group_id=GROUP_ID&limit=50&offset=0"
curl "http://127.0.0.1:8000/api/v1/groups/all"
curl "http://127.0.0.1:8000/api/v1/documents?group_id=GROUP_ID&limit=50"
curl "http://127.0.0.1:8000/api/v1/search_documents?q=KEYWORD&group_id=GROUP_ID"

Technical Analysis

The documented startup command binds the API service to 0.0.0.0, causing it to listen on every available network interface rather than only the loopback interface. Although the example client requests use 127.0.0.1, this does not restrict remote access to a server listening on all interfaces.

The documented endpoints expose synchronization state, group metadata, stored topics, downloaded documents, and document-search functionality. They also include a state-changing endpoint that triggers synchronization. No authentication or authorization mechanism is shown in the audited Skill documentation.

If the underlying API lacks controls not visible in this repository, any network client capable of reaching port 8000 could invoke these endpoints. The repository contains only Skill documentation and agent metadata, so the server implementation could not be inspected to determine whether it independently enforces access controls.

Attack Path

1. A user follows the documented command and starts Uvicorn with --host 0.0.0.0.
2. Port 8000 becomes reachable through any host interface permitted by local firewall and network policy.
3. A network-adjace ...[truncated 1234 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the default startup command to bind only to the loopback interface:

   bash

   uvicorn app.main:app --host 127.0.0.1 --port 8000
   

2. Require strong authentication for every API endpoint. Use short-lived tokens or another established authentication mechanism rather than static credentials embedded in the Skill.

3. Enforce server-side authorization for each group and document operation. Do not rely on the client or agent to restrict requested group identifiers.

4. Apply stricter authorization, rate limiting, and audit logging to POST /api/v1/trigger_sync.

5. If remote access is required, place the API behind a secured reverse proxy with TLS, authentication, network allowlisting, and request-size and rate limits.

6. Configure host firewall rules so port 8000 is not reachable from untrusted networks.

7. Document the API's authentication requirements in every curl example and avoid presenting unauthenticated commands as a secure production configuration.

8. Add automated tests confirming that anonymous requests to content and synchronization endpoints are rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs the agent to call a manual sync endpoint that can change local application state and fetch fresh external content, but it does not clearly warn about those side effects at the point of use. In an agent setting, this matters because a user asking for information could unintentionally cause network activity and database mutation, violating expectations of a read-only retrieval workflow.

Content

No source excerpt is available for this finding.