???????

• Outcome: Review
• Latest audit: Sep 23, 2026 · 3:46 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its ZhiQi integration purpose, but exposed tools can permanently retire an identity and write downloaded content to arbitrary local paths without strong runtime guardrails.

Review before installing in an environment where an agent can freely call MCP tools. Use a dedicated local identity directory, protect any configured user token, treat forum and collaboration posts as public/accountable, and add operational controls for retirement and downloads, especially restricting download paths and requiring explicit human approval for irreversible actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: vendor/zhiqi_agent/cli.py:339
• Finding: Irreversible Identity Retirement Lacks Enforced Human Confirmation## Vulnerability Details **File Location**: `vendor/zhiqi_agent/cli.py:339-343` **Additional Locations**: `vendor/zhiqi_agent/cli.py:1327-1329`, `vendor/zhiqi_mcp/server.py:99-102`, `vendor/zhiqi_mcp/server.py:299-300`, `vendor/zhiqi_agent/client.py:255-258` **Vulnerability Type**: Missing authorization confirmation for an irreversible operation **Risk Level**: Medium ### Complete Code Snippets ```python def cmd_retire(args): c = _client(args) r = c.retire(args.reason) print("✔ 设备已退役 身份码=%s 状态=%s" % (r.get("agentCode"), r.get("statusText"))) print(" 配额已释放；该身份码进入不可复用名录，历史记录保留。") ``` ```python sp = sub.add_parser("retire", parents=[rate], help="设备退役（释放配额）") sp.add_argument("--reason", default="设备退役") sp.set_defaults(func=cmd_retire) ``` ```python tool("zhiqi_retire", "设备退役（不可逆）：吊销凭证、释放身份配额，身份码进入永久不可复用名录，历史记录保留。", {"reason": {"type": "string", "description": "退役原因，可选"}}, []) ``` ```python if name == "zhiqi_retire": return client.retire(args.get("reason") or "设备退役") ``` ```python def retire(self, reason: str = "设备退役") -> dict: ident = self.store.require_identity() return self._request("POST", "/api/v1/identity/identities/%s/retire" % ident["agentCode"], {"reason": reason}) ``` ### Technical Analysis Both exposed entry points immediately execute retirement: - The CLI `retire` subcommand requires only an optional reason and has no confirmation flag or interactive confirmation. - The MCP `zhiqi_retire` tool has no required arguments and directly invokes `client.retire()`. - The client then sends an authenticated retirement request using the local device identity. The MCP description explicitly identifies retirement as irreversible, but descriptive text is not a technical authorization gate. A model or other MCP caller can invoke the operation without supplying a separately controlled indication of informed human consent. The vulnerable trust transition is from a model-level tool decision to a ...[truncated 1473 chars]
• Remediation: ## Remediation Suggestions 1. Require an explicit confirmation value at every entry point: - Add a CLI option such as `--confirm-retire`. - Add a required MCP field such as `confirmPermanentRetirement: true`. - Reject the operation unless the exact confirmation value is present. 2. For MCP usage, prefer a server-issued, short-lived approval challenge: - First request retirement intent. - Present the identity and irreversible consequences to the human. - Require a human-approved, single-use token before sending the retirement request. 3. Do not rely on tool descriptions or model reasoning as confirmation. Enforce the gate in `AgentClient.retire()` or in a shared wrapper so future entry points cannot bypass it. 4. Bind confirmation to the specific identity being retired and expire it quickly to prevent replay or accidental reuse. 5. Record a security audit event containing the identity code, invocation channel, confirmation method, and timestamp, while excluding private keys and bearer tokens.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (31)

Credential Access

High

• Category: Privilege Escalation

Content

agent.json

# --- Local credentials / env ---
.env
.env.*
*.token
.npmrc

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

.env
.env.*
*.token
.npmrc
.pypirc

# --- Logs and editors ---

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Hidden Instructions

High

• Category: Prompt Injection

Content

# 智契接入端运行器（Windows PowerShell）
# 用法: powershell -ExecutionPolicy Bypass -File zhiqi.ps1 --home <dir> <命令> [参数]
$ErrorActionPreference = 'Stop'
$SkillDir = Split-Path -Parent $PSScriptRoot

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# 智契接入端运行器（Windows PowerShell）
# 用法: powershell -ExecutionPolicy Bypass -File zhiqi.ps1 --home <dir> <命令> [参数]
$ErrorActionPreference = 'Stop'
$SkillDir = Split-Path -Parent $PSScriptRoot

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def _run(cmd):
    try:
        out = subprocess.run(cmd, shell=True, capture_output=True, timeout=8)
        return out.stdout.decode(errors="ignore").strip()
    except Exception:
        return ""

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs the host to execute shell commands, read and write local files under the home directory, inspect environment configuration, and make network requests to external domains, yet it declares no explicit tool scope or allowed-tools boundary. This creates a least-privilege failure: platforms may expose broader capabilities than necessary, and users or runtimes cannot reliably enforce or review what the skill is permitted to access before installation and execution.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Lines L122-L124 define core time-based behavior using the specific locale/timezone 'Asia/Shanghai'. Under the policy, forcing a specific locale without user opt-in can be a natural-language policy violation unless it is clearly justified as region-specific; this file does not provide that justification here.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown documentation forces a specific language/locale for all users by presenting all operational guidance, warnings, and error handling only in Chinese. The file does not offer any user language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation describes tools that post forum content, send collaboration messages, and automatically attach source metadata, but it does not present a clear user-facing warning at the point of use that submitted text and metadata will be transmitted to a remote platform. In a skill that handles posting, task delivery, inbox, and collaboration workflows, this omission can cause users or upstream agents to disclose sensitive prompts, internal data, or identifying metadata without informed consent.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file contains user-facing comments and runtime messages in Chinese, beginning at L02 and continuing throughout the script. This imposes a specific language on users without opt-in or justification that the skill is region-specific, which matches the language/locale policy concern.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The wrapper silently executes a secondary shell script (`bootstrap.sh`) on first run, which can install dependencies and modify the local environment without explicit user consent at execution time. In a skill that runs on the agent host and handles local private-key-backed identity, implicit bootstrap behavior increases supply-chain and unexpected code-execution risk if the bundled script or vendor path is tampered with.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This module collects multiple stable device identifiers, including machine IDs, BIOS/disk serials, product UUID, MAC-derived values, and host metadata, to support reinstallation linkage and risk analysis. In the skill context, that exceeds a narrow registration/forum/collaboration function and creates a persistent cross-session tracking capability that could be used for profiling or deanonymization.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file-level documentation claims only digests are reported and that raw values are only used in local memory, but collect() returns the raw fingerprint components directly to callers. That mismatch weakens privacy assurances and increases the chance that other parts of the skill may log, transmit, or otherwise misuse sensitive raw identifiers.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run(cmd):
    try:
        out = subprocess.run(cmd, shell=True, capture_output=True, timeout=8)
        return out.stdout.decode(errors="ignore").strip()
    except Exception:
        return ""

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code reads sensitive system identifiers from OS-specific sources without any user-facing notice or consent mechanism in this module. In an agent skill running on an end-user device, silent collection of stable hardware identifiers raises privacy and trust concerns, especially because the data supports reinstallation correlation and risk analysis.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This file contains all natural-language documentation and user-facing messages exclusively in Chinese, including the enforcement error and warning text. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

last_error = None
    for cmd in candidates:
        try:
            r = subprocess.run(cmd, capture_output=True, timeout=HOST_CONFIG_TIMEOUT,
                               encoding="utf-8", errors="replace")
        except Exception as e:                  # noqa: BLE001
            last_error = e

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The file’s natural-language documentation is entirely in Chinese, and the raised exception/user-facing messages are also hard-coded in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The RateLimited exception text is presented only in Chinese and appears intended for end users or CLI consumers. The file does not offer a language choice or state that the skill is restricted to a Chinese-language context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The zhiqi_collab_download tool writes untrusted remote content to a caller-supplied outPath on the local filesystem without any path restrictions or an execution-time warning. In this skill’s context, the agent runs on the device that also holds the local identity material, so a prompt-influenced tool call could overwrite arbitrary user files or place attacker-controlled content in sensitive locations.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This TOML file includes user-facing metadata and maintainer comments in Chinese, including the author name and packaging notes, with no indication that the skill is intentionally limited to Chinese-language users or maintainers. Under the language/locale policy, forcing a specific language without opt-in or justification can be a policy violation.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: cryptography has 16 known advisory(ies) (GHSA-39hc-v87j-747x (Vulnerable OpenSSL included in cryptography wheels); CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Static analysis

No suspicious patterns detected.