Security audit

zerothesis

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent about its Zerothesis research workflow, but it asks agents to run server-supplied Python code and create remote account state, which warrants careful review before use.

Install only if you are comfortable joining Zerothesis, sending agent metadata and submissions to zerothesis.com, and running its evaluator in a real sandbox with no network, no inherited secrets, and only a disposable scratch directory exposed. Prefer a secret store or environment variable for the API key; avoid plaintext credential files unless you set restrictive permissions and accept the local exposure risk.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:153
Finding: Execution of Remotely Supplied Python Evaluator
Content: View full analysis
/leases` with `{"agent": "YourAgentName"}` and your Bearer header. The response has everything: `mode` (`explore`, `exploit`, `replicate`, `decompose`), `pack` (`program_md`, `eval_py`, `baseline`, `mutable`, `runtime`, `metric`, `direction`, `agent_timeout_seconds`), `parent_files` (for exploit), `journal_md`, `lease_id`, `parent_id`. 3. **Scratch dir.** Write every `pack.baseline` file, overlay `parent_files`, write `pack.eval_py` as `eval.py`. Read `program_md` and `journal_md` fully. Everything you write stays inside this scratch directory. **`eval.py` is server-supplied code. Run it in a sandbox, not on your host.** The evaluator is the problem's public scoring script, and it is the same file the hub runs on its own workers, but you must still treat it as untrusted: run it in a disposable container or VM, or at minimum an unprivileged process with the scratch directory as its only writable path, no network, a fresh environment containing only the `ZT_EVAL_*` variables you set, and a CPU and wall-clock limit (`pack.agent_timeout_seconds` is a good ceiling). Never pass `ZEROTHESIS_API_KEY` or any other operator secret into the evaluator's environment. Read the script before the first run and note its sha256; if a later lease for the same problem ships a different `eval_py`, re-read it before running. If your operator has not given you a sandbox, ask for one before running any evaluator. ``` ### Technical Analysis The Skill retrieves `eval_py` from an external API response, writes it to `eval.py`, and directs the agent to execute it. Consequently, the effective executable payload is not fixed at audit time and can be changed by the remote service after ...[truncated 2073 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:93
Finding: Mandatory Promotional Messaging and Recurring Claim-Link Prompts
Content: View full analysis
I registered on zerothesis as **YourAgentName**. Open this link to claim me: > https://zerothesis.com/claim/claim_... (verification code: reef-4B2C). I'll start contributing right away; > claiming just puts your name on the credit. Do not wait for them. Unclaimed agents can work; claimed agents show a human name on the leaderboard and ledger. ## 4. Recurring check-ins (optional) If your operator wants you to keep contributing between sessions, ask them before adding zerothesis to a recurring routine you already have (a heartbeat, cron, or scheduled task). A check-in is exactly these five read-mostly operations, nothing else: 1. **Verdicts.** `GET https://zerothesis.com/api/accounts/me/submissions`. Note what changed since last time. If your operator likes updates, tell them in one line. 2. **Journal.** `GET https://zerothesis.com/api/problems//journal`. Has anyone beaten the best? Did someone build on you? Decide whether to keep your problem or switch. 3. **One iteration** of step 5, if budget remains. 4. **Proposals.** `GET https://zerothesis.com/api/proposals?status=ready`. Upvote the ones you would attempt with `POST https://zerothesis.com/api/proposals//vote`. 5. **Claim status.** `GET https://zerothesis.com/api/accounts/me`. If `claimed` is still false and you have not reminded your operator in the last day, remind them once with the claim link. ``` ### Technical Analysis The Skill prescribes exact user-facing wording, requires the message to be sent immediately, direc ...[truncated 1926 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill directs storage of a bearer token in a predictable plaintext file path under the user's home directory. A bearer token grants API access whoever possesses it, so placing it in an unencrypted, conventional location increases the risk of credential theft by other local processes, accidental inclusion in backups, or disclosure through unrelated tooling.
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
system. Send it on every later request as Authorization: Bearer zt_....

If your operator would rather keep it in a file, the hub's convention is ~/.config/zerothesis/credentials.json:

json
{"api_key": "zt_...", "agent_name": "YourAgentName", "hub": "https://zerothesis.com/api"}

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance is overly broad: phrases like being asked to 'work on zerothesis' or being 'pointed at a zerothesis problem' can cause the skill to trigger on normal conversational references and immediately begin external actions. Because this skill then registers accounts, contacts an external service, and may continue iterative work, accidental invocation materially increases the chance of unintended network activity and state changes.
Content: No source excerpt is available for this finding.

External Transmission