Security audit

Zeko

Security checks across malware telemetry and agentic risk

Overview

The skill appears aimed at legitimate Zeko development, but its examples handle private keys and live transaction broadcasts without enough safety gating.

Install only if you intend to perform hands-on Zeko operations. Use disposable testnet keys, avoid pasting real secrets inline, review commands before execution, and require explicit confirmation before any signing, bridging, or transaction broadcast.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill description is broad enough to activate on many generic 'Zeko' requests, including informational or conceptual questions that may not require privileged tooling or this specific skill. Over-broad activation increases the chance the agent loads a capability-bearing skill unnecessarily, exposing sensitive environment assumptions and making downstream unsafe actions more likely if the skill is selected in marginal cases.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The instruction 'Use this skill when the user wants to use Zeko, inspect the network, bridge assets, get faucet funds, or build on Zeko' lacks clear boundaries for non-activation, so routine discussion of Zeko could trigger the skill. In a skill that references credentials and operational CLIs, ambiguous activation expands attack surface by increasing unnecessary invocation of tool-oriented guidance in contexts where a safer, generic response would suffice.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file includes command examples that directly place secrets in environment variables inline (`MINA_PRIVATE_KEY=...`, `GITHUB_TOKEN=...`) without any warning about secret handling, shell history exposure, process inspection, or safer loading methods. In an agent automation context, this is more dangerous because users may copy these patterns into unattended scripts, CI logs, or shared terminals, increasing the chance of credential leakage and downstream unauthorized bridge signing or faucet abuse.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The file provides a directly runnable example that broadcasts a signed payment to a live public endpoint, but it does not clearly warn that this can move funds, incur fees, and may be irreversible once submitted. In an agent skill intended for automation and terminal-driven workflows, this increases the chance that an agent or user will execute the example in a real environment without sufficient confirmation or test-safety checks.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The example instructs users to load a private key from an environment variable and use it directly in an inline script, but it provides no warning about secret handling, shell history, process exposure, logging, or use of dedicated low-privilege test credentials. In a terminal-driven builder skill, this can normalize unsafe secret handling and lead users or downstream agents to expose real keys while experimenting or automating transactions.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.