zhipu-image

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:02 AM UTC
• Version: 2.0.0

Overview

This skill is for Zhipu image generation, but it handles browser session cookies in a broad and persistent way that users should review before installing.

Install only if you are comfortable letting the skill connect to a Chrome remote-debugging browser, extract Zhipu-related cookies, and store them locally in plaintext. Use a dedicated browser profile if possible, remove the session JSON when done, and avoid using the network monitor unless you intentionally want request details and POST bodies printed for debugging.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/zhipu_api.js:101

Finding

Overbroad browser-cookie collection bypasses normal domain scoping

Content

View full analysis

Vulnerability Details

File Location: scripts/zhipu_api.js, lines 101-111; cookie forwarding occurs at lines 63-72
Vulnerability Type: Excessive credential collection and cross-domain cookie forwarding
Risk Level: High

Vulnerable Code

javascript

async function captureCookies() {
  const client = await CDP({ port: 18800 });
  const { Network } = client;
  await Network.enable();
  const cookies = await Network.getCookies();
  await client.close();

  const picked = cookies.cookies.filter(c =>
    c.domain.includes('z.ai') || c.domain.includes('bigmodel.cn') || c.domain.includes('chatglm')
  );
  if (!picked.length) throw new Error('No Zhipu cookies found. Please log in at image.z.ai first.');

  const session = { cookies: picked.map(c => ({ name: c.name, value: c.value })), savedAt: new Date().toISOString() };
  saveSession(session);
  return session;
}

The collected cookies are subsequently combined into a manually constructed header:

javascript

function buildCookieString(cookies) {
  return (cookies || []).map(c => `${c.name}=${c.value}`).join('; ');
}

function buildHeaders(cookies) {
  return {
    'Content-Type': 'application/json',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
    'Accept': 'application/json',
    'Cookie': buildCookieString(cookies),
    'Origin': 'https://image.z.ai',
    'Referer': 'https://image.z.ai/',
  };
}

Technical Analysis

Network.getCookies() retrieves browser cookies without restricting the request to the precise service URL. The code then selects cookies using substring checks instead of exact, browser-equivalent domain and path validation.

This collects cookies from bigmodel.cn, chatglm domains, unrelated z.ai subdomains, and potentially domains whose names merely contain one of these strings. Cookie attributes such as domain, path, expiration, Secure, `SameSit ...[truncated 2191 chars]

Remediation

View remediation

Remediation Suggestions

• Request cookies specifically for https://image.z.ai/ rather than retrieving the browser-wide cookie set.
• Enforce exact domain rules, allowing only image.z.ai and an explicitly documented parent-domain cookie where required.
• Preserve and validate domain, path, expiration, host-only, and secure attributes before using a cookie.
• Do not collect cookies from bigmodel.cn, chatglm, or unrelated z.ai subdomains unless each cookie is demonstrably required.
• Prefer executing authenticated requests inside the browser context so the browser retains responsibility for cookie scoping.
• Verify the CDP target, expected browser profile, page origin, and debugging endpoint before extracting any authentication state.
• Reject duplicate cookie names and use an explicit allowlist of the minimum session-cookie names required by the service.
• Clear sensitive arrays and session state promptly after use.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/zhipu_api.js:50

Finding

Authentication cookies are persisted in plaintext

Content

View full analysis

Vulnerability Details

File Location: scripts/zhipu_api.js, lines 50-52 and 109
Vulnerability Type: Plaintext storage of sensitive authentication material
Risk Level: High

Vulnerable Code

javascript

function saveSession(session) {
  fs.writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2));
}

The saved object contains raw cookie values:

javascript

const session = { cookies: picked.map(c => ({ name: c.name, value: c.value })), savedAt: new Date().toISOString() };
saveSession(session);

The destination is defined as:

javascript

const SESSION_FILE = path.join(process.env.USERPROFILE, '.zhipu_image_session.json');

Technical Analysis

Browser cookies are bearer credentials: possession may be sufficient to impersonate the authenticated user until the session expires or is revoked. The implementation serializes raw names and values to a predictable plaintext file in the user's profile directory.

No operating-system credential vault, encryption, explicit access-control configuration, or restrictive file-creation policy is used. The effective protection therefore depends entirely on inherited directory permissions and local system configuration. The JSON format also makes credentials directly readable and easy to copy.

Cookie security attributes do not protect this copy. In particular, HttpOnly only prevents access through page JavaScript and does not protect credentials extracted through CDP and written to disk.

Attack Path

1. The user runs a command that invokes captureCookies().
2. Authentication cookies are extracted from the browser.
3. saveSession() writes their raw values to the predictable file %USERPROFILE%\.zhipu_image_session.json.
4. Another process, account with access to the profile, backup utility, diagnostic collector, or malware reads or copies the file.
5. The attacker extracts the cookie names and values from the JSON docume ...[truncated 806 chars]

Remediation

View remediation

Remediation Suggestions

• Store authentication material in the operating system's protected credential store, such as Windows Credential Manager or DPAPI, rather than plaintext JSON.
• Prefer not to persist cookies at all. Retrieve a narrowly scoped session only when needed and retain it in memory for the shortest practical time.
• If file persistence is unavoidable, encrypt credentials with a per-user protected key and explicitly restrict access to the current user.
• Store only the minimum required cookie names and retain their expiry metadata.
• Delete expired or invalid session files immediately, and provide a logout or cleanup command that securely removes persisted credentials.
• Avoid including session files in backups, logs, crash reports, or synchronization systems.
• Document the credential sensitivity and exact storage lifetime for users.
• Rotate or revoke the affected browser session after migrating away from existing plaintext session files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The stated purpose is image generation and download, but the skill also includes browser network monitoring and capture of request details and POST bodies as a reverse-engineering aid. That materially expands the data exposure surface beyond user-expected behavior and could capture sensitive tokens, cookies, prompts, or other account data from browser traffic.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

- `scripts/zhipu_api.js`：检查 session、必要时自动打开登录页、生成图片并下载

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins ws to version 7.5.10, which is flagged as affected by a high-severity memory exhaustion denial-of-service issue. Even though this is a transitive dependency of chrome-remote-interface, the project still ships and installs the vulnerable version, so an attacker able to influence or reach WebSocket traffic could potentially crash or destabilize the process. In this skill’s context, the package interacts with a browser via the Chrome DevTools protocol, making WebSocket handling a core runtime path rather than dead code.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises capabilities that include environment access and network activity but does not declare an explicit tool scope or permissions boundary. That makes it harder for reviewers and policy layers to understand what the skill can access, and in this case is especially concerning because the skill handles browser session state and cookie capture for a third-party site.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation examples are broad enough to match common user requests like generating or sending an image, which increases the chance the skill is auto-selected without the user realizing it will inspect browser login state and potentially capture cookies. In a skill with sensitive browser-session behavior, overly generic triggering makes unintended execution more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown explicitly states that the skill captures browser cookies and downloads files locally, but it does not provide a clear privacy/security warning or explain retention, scope, and handling of those sensitive artifacts. Because cookies can enable account access and local downloads create persistent artifacts, omission of these warnings meaningfully increases the risk of unsafe or uninformed use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script attaches to a browser over the Chrome DevTools Protocol and passively captures request metadata and bodies for any traffic matching broad patterns such as 'api', 'z.ai', or 'generation'. In the stated skill context, which already involves checking login state and grabbing browser cookies, this expands collection well beyond a narrow image-generation workflow and can expose unrelated authenticated API activity and sensitive user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script logs POST bodies directly to stdout, truncating length but not removing secrets, tokens, prompts, personal data, or other sensitive fields. In this skill's context of authenticated browser use and cookie-related automation, request bodies may contain highly sensitive session-linked data that could be exposed in terminal logs, transcripts, or monitoring systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script captures live browser authentication cookies via the Chrome DevTools Protocol and persists them in plaintext to a predictable file under the user's profile. In this skill's context, those cookies are sufficient to impersonate the user's logged-in session to image.z.ai, so any local process, malware, or another skill with file access can reuse them without reauthentication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file-level natural-language description is written only in Chinese and does not provide any user choice or indication that the language is optional. Under the policy provided, forcing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code comment says it only shows API-related requests, but the implemented filter also captures any URL containing 'z.ai', which is much broader than API endpoints. This mismatch can mislead reviewers or users about the true collection scope and increases the chance that non-API authenticated traffic is captured unexpectedly.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · scripts/package.json (reported line 30)May include surrounding context.

json

"author": "小虎",
  "license": "MIT",
  "dependencies": {
    "chrome-remote-interface": "^0.33.3"
  },
  "engines": {
    "node": ">=14.0.0"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script invokes a shell command to open the login page automatically using exec, which is a subprocess operation affecting the user's system state. While the top comment mentions auto-opening the browser, there is no runtime disclosure or confirmation immediately before executing the shell command.

Content

No source excerpt is available for this finding.