Zhipu GLM Image

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.0.1

Overview

This skill is an image-generation helper, but it uses and stores browser login cookies in ways that deserve careful review before installation.

Install only if you are comfortable giving the skill access to a debug-enabled logged-in browser session. Use a dedicated browser profile for image.z.ai, avoid running the network monitor around unrelated sites, treat ~/.zhipu_image_session.json as a sensitive credential file, and delete or rotate the session if you stop using the skill.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/zhipu_api.js:101

Finding

Unscoped Browser Cookie Collection Through Chrome DevTools

Content

View full analysis

c.domain.includes('z.ai') || c.domain.includes('bigmodel.cn') || c.domain.includes('chatglm') ); ``` ### Technical Analysis `Network.getCookies()` is invoked without a URL allowlist. Consequently, the process retrieves every cookie visible to the connected Chrome DevTools Protocol target before filtering the results locally. This breaks the principle of least privilege because image generation only requires cookies associated with explicitly trusted Zhipu service domains. The filtering logic is also based on substring matching rather than exact domain or validated subdomain matching. A domain containing one of the selected strings in an unrelated position could therefore be treated as trusted. Although only filtered cookies are subsequently persisted, all cookies returned by Chrome are temporarily exposed within the Node.js process. Any process instrumentation, malicious modification, debugging hook, crash dump, or compromise affecting this process could expose unrelated authenticated browser sessions. ### Attack Path 1. The user runs the Skill while Chrome exposes a DevTools endpoint on port `18800`. 2. The Skill connects to the endpoint and requests cookies without specifying target URLs. 3. Chrome returns all cookies available to the connected DevTools target. 4. The complete cookie collection enters the Skill process before local filtering occurs. 5. An attacker who can instrument or compromise that process can extract unrelated session cookies. 6. Broad substring matching may ad ...[truncated 578 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/zhipu_api.js:48

Finding

Reusable Authentication Cookies Stored in Plaintext

Content

View full analysis

({ name: c.name, value: c.value })), savedAt: new Date().toISOString() }; saveSession(session); return session; ``` ### Technical Analysis The Skill serializes reusable browser authentication cookies directly into `~/.zhipu_image_session.json` as plaintext JSON. It does not use an operating-system credential vault, encryption, or explicitly restrictive file permissions. Authentication cookies function as bearer credentials: possession may be sufficient to act as the authenticated user until the cookies expire or are revoked. The implementation also persists only names and values, without tracking expiration or minimizing storage duration. The actual exposure depends on the host's existing filesystem access controls. However, the Skill does not enforce owner-only access or verify that an existing session file is not readable by unintended principals. ### Attack Path 1. The user authenticates to Zhipu in the browser. 2. The Skill captures the relevant authentication cookies through CDP. 3. `saveSession` writes those cookie names and values to a predictable file in plaintext. 4. Malware, another process running under the user account, a backup collector, or another principal allowed by the file ACL reads the file. 5. The attacker reconstructs the `Cookie` header from the saved values. 6. The cookies are replayed against the relevant Zhipu service while the session remains valid. ### Impact Assessment An attacker who obtains valid cookies may impersonate the user to the extent authorized by the captured browser session. Poten ...[truncated 385 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/network_monitor.js:23

Finding

Network Monitor Can Log Unrelated Sensitive Request Bodies

Content

View full analysis

{ const url = params.request.url; // 只显示API相关请求 if (url.includes('api') || url.includes('z.ai') || url.includes('generation')) { requestCount++; console.log(`\n[${requestCount}] ${params.request.method} ${url}`); // 显示请求体 if (params.request.postData) { try { const postData = JSON.parse(params.request.postData); console.log(' POST data:', JSON.stringify(postData).substring(0, 200)); } catch (e) { console.log(' POST data:', params.request.postData.substring(0, 200)); } } } }); ``` ### Technical Analysis The monitor observes all requests visible to the connected CDP target and decides what to print using generic substring checks. In particular, `url.includes('api')` and `url.includes('generation')` can match unrelated websites and endpoints. For matching requests, up to 200 characters of the POST body are written to standard output without secret detection or redaction. Request bodies can contain API keys, bearer tokens, passwords, personal information, prompts, or other sensitive values. Terminal output may also be retained by shell transcripts, CI logs, remote support tooling, or monitoring systems. ### Attack Path 1. The user runs `network_monitor.js` against a normal browser profile. 2. The monitored browser target sends a POST request to an unrelated URL containing `api` or `generation`. 3. The request body contains sensitive information. 4. The generic substring test accepts the request. 5. The Skill prints the first 200 characters of the body to standard output. 6. An attacker or unintended log consumer obtains the terminal output ...[truncated 501 chars]

Remediation

View remediation

other

Warning

• Location: scripts/zhipu_api.js:127

Finding

Session Validation Triggers a Real Image-Generation Operation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is image generation, but the skill also references browser network monitoring, request capture, POST-body extraction, and CDP attachment to a debug-enabled browser. Those are materially more sensitive capabilities than ordinary image generation and can expose authenticated traffic, session artifacts, or unrelated browser activity if misused or if the browser is broadly accessible.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

- `scripts/zhipu_api.js`：检查 session、必要时自动打开登录页、生成图片并下载

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares browser-cookie capture, session checking, auto-login flow, and networked image generation, but provides no explicit tool scope or permission boundaries in the manifest. That omission weakens reviewability and consent controls, making it easier for an agent or user to invoke environment and network-capable behavior without clear disclosure or restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly relies on grabbing browser cookies/session state from a logged-in browser, yet the description does not present this as a prominent security warning or consent-sensitive action. Capturing authenticated browser session data is dangerous because it can enable account access, replay of authenticated requests, or leakage of sensitive tokens beyond the user's expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script attaches to a Chrome DevTools Protocol endpoint and passively captures network requests and request bodies based on broad URL substring matching, not just the minimum traffic needed for image generation. In the context of a skill explicitly designed to inspect login state, grab browser cookies, and automate a logged-in browser session, this can expose unrelated authenticated API traffic and sensitive request payloads from the same browser profile.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script logs request bodies directly to stdout, which may include prompts, tokens, identifiers, cookies embedded in payloads, or other sensitive user data. Because the skill operates around authenticated web use and browser-state inspection, these logs can create a secondary data-exposure channel even if the requests themselves are legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script connects to a local Chrome DevTools endpoint, extracts authentication cookies for z.ai-related domains, and writes them in plaintext to a file under the user's profile for later reuse. This creates a credential theft and session hijacking risk: any local process or user with access to that file can reuse the authenticated web session, and the skill context explicitly centers on capturing and replaying browser auth state rather than using a scoped API token.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file header documentation is written only in Chinese and gives no indication that language selection is optional or region-specific. Under the language/locale policy, skills should not implicitly force a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The comments describe the tool as analyzing Zhipu AI API requests, but the implementation captures broader traffic through imprecise filters, creating a mismatch between stated purpose and actual collection scope. That discrepancy can mislead operators into running a tool that collects more authenticated browser traffic than they reasonably expect.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The dependency is version-ranged with a caret, which allows newer minor/patch releases to be installed over time without explicit review. In a skill that interacts with browser debugging features and login state, a compromised or unexpectedly changed dependency could alter behavior or introduce credential-exfiltration risk through the supply chain.

Content

Scanner excerpt · scripts/package.json (reported line 30)May include surrounding context.

json

"author": "小虎",
  "license": "MIT",
  "dependencies": {
    "chrome-remote-interface": "^0.33.3"
  },
  "engines": {
    "node": ">=14.0.0"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

When session refresh fails, the script automatically launches the login URL via a shell command. While the file header mentions auto-opening the browser login, there is no runtime prompt or visible console disclosure immediately before triggering that external action.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/zhipu_api.js:118