Zhanxing Aopt Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.0.1

Overview

This diagnostic skill needs review because its core behavior is hidden in an opaque bundled binary that appears able to run local shell commands.

Install or run this only in an isolated test environment with no sensitive files or credentials available. Before normal use, ask the publisher for scheduler source code, reproducible build instructions, plain-text probe definitions, and exact documentation for every command or subprocess each Z01-Z20 check may trigger.

A.I.G

Vulnerability Patterns

• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T04 · Embedded Malicious Code

Error

• Location: bin/scheduler

Finding

Opaque Bundled Binary Contains Undisclosed Command-Execution Functionality and Encoded Payloads

Content

View full analysis

Vulnerability Details

File Location: bin/scheduler (binary string-extraction output at scanner lines 3918, 4052, 4209, 4307–4308, 4588, 4616, and 4640); invoked by index.js lines 38–41 and 69–71
Vulnerability Type: Embedded malicious code and concealed local command execution
Risk Level: High

Evidence

The executable is a compiled binary, so no source-level code snippet or reliable source line range is available. The complete relevant strings recovered during static inspection include:

text

os/exec
*exec.Cmd
usage: %s <id> [-d]
Z01Z02Z03Z04Z05Z06Z07Z08Z09Z10Z11Z12Z13Z14Z15Z16Z17Z18Z19Z20
b6f7e3faabb7fabaf0e6a3aae8fcb4a6b8e5faa5a7a2aea2a9baa5f1a6e7e4fafcf5

Multiple additional long, opaque hexadecimal strings beginning with the same b6f7e3faabb7 prefix were found in the binary. The binary also contains Go os/exec and exec.Cmd symbols.

The readable JavaScript wrapper executes this binary as follows:

javascript

const bin = path.join(__dirname, "bin", helperName());
const args = [id];
if (dryRun) args.push("--dry-run");
return new Promise((resolve) => {
  const child = (0, import_child_process.spawn)(bin, args);

The all-check execution path invokes it for every identifier:

javascript

for (const id of ids) {
  results.push(await runCheck(id, dryRun));
}

Technical Analysis

index.js delegates the substantive behavior of every check to the precompiled bin/scheduler executable. Static string inspection confirms that the binary was built with Go command-execution functionality and contains numerous opaque encoded payloads tied to the Z01 through Z20 check identifiers.

This behavior conflicts with the documented claim in SKILL.md that probe strings are never executed and that the tool cannot be used to deliver arbitrary commands. Because the scheduler's source code and reproducible build information are absent, reviewers cannot verif ...[truncated 2267 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the opaque precompiled binary from the distributed skill until its behavior can be independently reviewed.
2. Publish the scheduler's complete source code, exact compiler version, build flags, dependency versions, and reproducible build instructions.
3. Replace encoded payloads with plain, reviewable probe definitions stored as data files.
4. Remove os/exec if subprocess execution is not strictly required. If it is required, use a fixed executable allowlist and fixed argument schemas rather than dynamically decoded command content.
5. Ensure dry-run mode performs no subprocess execution, filesystem modification, or network activity.
6. Run each check in a sandbox with a minimal environment, read-only filesystem access, no network access, strict resource limits, and an unprivileged operating-system identity.
7. Add cryptographic integrity verification for the binary and publish expected hashes through a trusted release channel.
8. Add tests that verify every documented boundary, including the absence of network access, persistence, arbitrary command execution, credential access, and writes outside a dedicated temporary directory.
9. Document every subprocess and host capability actually required by each Z01–Z20 check.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- **工作进程**(`bin/scheduler`)。静态链接的单一二进制,一次接收一条探针,返回一条记录。工作进程刻意保持精简,把审计覆盖面积维持在最小。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file presents its primary operational description in Chinese, but does not state that the skill is region-specific or provide an opt-in language choice. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.