???????

• Outcome: Review
• Latest audit: Sep 23, 2026 · 3:46 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its ZhiQi integration purpose, but exposed tools can permanently retire an identity and write downloaded content to arbitrary local paths without strong runtime guardrails.

Review before installing in an environment where an agent can freely call MCP tools. Use a dedicated local identity directory, protect any configured user token, treat forum and collaboration posts as public/accountable, and add operational controls for retirement and downloads, especially restricting download paths and requiring explicit human approval for irreversible actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: vendor/zhiqi_agent/cli.py:339

Finding

Irreversible Identity Retirement Lacks Enforced Human Confirmation

Content

View full analysis

Vulnerability Details

File Location: vendor/zhiqi_agent/cli.py:339-343
Additional Locations: vendor/zhiqi_agent/cli.py:1327-1329, vendor/zhiqi_mcp/server.py:99-102, vendor/zhiqi_mcp/server.py:299-300, vendor/zhiqi_agent/client.py:255-258
Vulnerability Type: Missing authorization confirmation for an irreversible operation
Risk Level: Medium

Complete Code Snippets

python

def cmd_retire(args):
    c = _client(args)
    r = c.retire(args.reason)
    print("✔ 设备已退役 身份码=%s 状态=%s" % (r.get("agentCode"), r.get("statusText")))
    print("  配额已释放；该身份码进入不可复用名录，历史记录保留。")

python

sp = sub.add_parser("retire", parents=[rate], help="设备退役（释放配额）")
sp.add_argument("--reason", default="设备退役")
sp.set_defaults(func=cmd_retire)

python

tool("zhiqi_retire",
     "设备退役（不可逆）：吊销凭证、释放身份配额，身份码进入永久不可复用名录，历史记录保留。",
     {"reason": {"type": "string", "description": "退役原因，可选"}}, [])

python

if name == "zhiqi_retire":
    return client.retire(args.get("reason") or "设备退役")

python

def retire(self, reason: str = "设备退役") -> dict:
    ident = self.store.require_identity()
    return self._request("POST", "/api/v1/identity/identities/%s/retire" % ident["agentCode"],
                         {"reason": reason})

Technical Analysis

Both exposed entry points immediately execute retirement:

• The CLI retire subcommand requires only an optional reason and has no confirmation flag or interactive confirmation.
• The MCP zhiqi_retire tool has no required arguments and directly invokes client.retire().
• The client then sends an authenticated retirement request using the local device identity.

The MCP description explicitly identifies retirement as irreversible, but descriptive text is not a technical authorization gate. A model or other MCP caller can invoke the operation without supplying a separately controlled indication of informed human consent.

The vulnerable trust transition is from a model-level tool decision to a ...[truncated 1473 chars]

Remediation

View remediation

Remediation Suggestions

1. Require an explicit confirmation value at every entry point:

   • Add a CLI option such as --confirm-retire.
   • Add a required MCP field such as confirmPermanentRetirement: true.
   • Reject the operation unless the exact confirmation value is present.

2. For MCP usage, prefer a server-issued, short-lived approval challenge:

   • First request retirement intent.
   • Present the identity and irreversible consequences to the human.
   • Require a human-approved, single-use token before sending the retirement request.

3. Do not rely on tool descriptions or model reasoning as confirmation. Enforce the gate in AgentClient.retire() or in a shared wrapper so future entry points cannot bypass it.

4. Bind confirmation to the specific identity being retired and expire it quickly to prevent replay or accidental reuse.

5. Record a security audit event containing the identity code, invocation channel, confirmation method, and timestamp, while excluding private keys and bearer tokens.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (31)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 31)May include surrounding context.

text

agent.json

# --- Local credentials / env ---
.env
.env.*
*.token
.npmrc

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 34)May include surrounding context.

text

.env
.env.*
*.token
.npmrc
.pypirc

# --- Logs and editors ---

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/bootstrap.ps1 (reported line 1)May include surrounding context.

text

# 智契接入端运行器（Windows PowerShell）
# 用法: powershell -ExecutionPolicy Bypass -File zhiqi.ps1 --home <dir> <命令> [参数]
$ErrorActionPreference = 'Stop'
$SkillDir = Split-Path -Parent $PSScriptRoot

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/zhiqi.ps1 (reported line 1)May include surrounding context.

text

# 智契接入端运行器（Windows PowerShell）
# 用法: powershell -ExecutionPolicy Bypass -File zhiqi.ps1 --home <dir> <命令> [参数]
$ErrorActionPreference = 'Stop'
$SkillDir = Split-Path -Parent $PSScriptRoot

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · vendor/zhiqi_agent/fingerprint.py (reported line 18)May include surrounding context.

python

def _run(cmd):
    try:
        out = subprocess.run(cmd, shell=True, capture_output=True, timeout=8)
        return out.stdout.decode(errors="ignore").strip()
    except Exception:
        return ""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs the host to execute shell commands, read and write local files under the home directory, inspect environment configuration, and make network requests to external domains, yet it declares no explicit tool scope or allowed-tools boundary. This creates a least-privilege failure: platforms may expose broader capabilities than necessary, and users or runtimes cannot reliably enforce or review what the skill is permitted to access before installation and execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Lines L122-L124 define core time-based behavior using the specific locale/timezone 'Asia/Shanghai'. Under the policy, forcing a specific locale without user opt-in can be a natural-language policy violation unless it is clearly justified as region-specific; this file does not provide that justification here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown documentation forces a specific language/locale for all users by presenting all operational guidance, warnings, and error handling only in Chinese. The file does not offer any user language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation describes tools that post forum content, send collaboration messages, and automatically attach source metadata, but it does not present a clear user-facing warning at the point of use that submitted text and metadata will be transmitted to a remote platform. In a skill that handles posting, task delivery, inbox, and collaboration workflows, this omission can cause users or upstream agents to disclose sensitive prompts, internal data, or identifying metadata without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file contains user-facing comments and runtime messages in Chinese, beginning at L02 and continuing throughout the script. This imposes a specific language on users without opt-in or justification that the skill is region-specific, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The wrapper silently executes a secondary shell script (bootstrap.sh) on first run, which can install dependencies and modify the local environment without explicit user consent at execution time. In a skill that runs on the agent host and handles local private-key-backed identity, implicit bootstrap behavior increases supply-chain and unexpected code-execution risk if the bundled script or vendor path is tampered with.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This module collects multiple stable device identifiers, including machine IDs, BIOS/disk serials, product UUID, MAC-derived values, and host metadata, to support reinstallation linkage and risk analysis. In the skill context, that exceeds a narrow registration/forum/collaboration function and creates a persistent cross-session tracking capability that could be used for profiling or deanonymization.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file-level documentation claims only digests are reported and that raw values are only used in local memory, but collect() returns the raw fingerprint components directly to callers. That mismatch weakens privacy assurances and increases the chance that other parts of the skill may log, transmit, or otherwise misuse sensitive raw identifiers.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · vendor/zhiqi_agent/fingerprint.py (reported line 18)May include surrounding context.

python

def _run(cmd):
    try:
        out = subprocess.run(cmd, shell=True, capture_output=True, timeout=8)
        return out.stdout.decode(errors="ignore").strip()
    except Exception:
        return ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code reads sensitive system identifiers from OS-specific sources without any user-facing notice or consent mechanism in this module. In an agent skill running on an end-user device, silent collection of stable hardware identifiers raises privacy and trust concerns, especially because the data supports reinstallation correlation and risk analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file contains all natural-language documentation and user-facing messages exclusively in Chinese, including the enforcement error and warning text. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · vendor/zhiqi_agent/provenance.py (reported line 197)May include surrounding context.

python

last_error = None
    for cmd in candidates:
        try:
            r = subprocess.run(cmd, capture_output=True, timeout=HOST_CONFIG_TIMEOUT,
                               encoding="utf-8", errors="replace")
        except Exception as e:                  # noqa: BLE001
            last_error = e

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file’s natural-language documentation is entirely in Chinese, and the raised exception/user-facing messages are also hard-coded in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The RateLimited exception text is presented only in Chinese and appears intended for end users or CLI consumers. The file does not offer a language choice or state that the skill is restricted to a Chinese-language context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The zhiqi_collab_download tool writes untrusted remote content to a caller-supplied outPath on the local filesystem without any path restrictions or an execution-time warning. In this skill’s context, the agent runs on the device that also holds the local identity material, so a prompt-influenced tool call could overwrite arbitrary user files or place attacker-controlled content in sensitive locations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This TOML file includes user-facing metadata and maintainer comments in Chinese, including the author name and packaging notes, with no indication that the skill is intentionally limited to Chinese-language users or maintainers. Under the language/locale policy, forcing a specific language without opt-in or justification can be a policy violation.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: cryptography has 16 known advisory(ies) (GHSA-39hc-v87j-747x (Vulnerable OpenSSL included in cryptography wheels); CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.