Security audit

Zhentan

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent, but it gives an agent high-impact wallet co-signing and security-configuration power through an external API without strong in-skill confirmation or scoping.

Review before installing. Only use this with Safes, funds, and invoices you are comfortable routing through Zhentan's remote API, and only if you trust its backend authorization, audit logging, and transaction simulation. Treat AGENT_SECRET as a powerful credential, confirm irreversible approvals out of band, and avoid disabling screening or changing rules/thresholds through casual chat commands unless your deployment adds stronger confirmation controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

other

Warning

Location: SKILL.md:24
Finding: Excessive Disclosure of Telegram Caller Identity to an External Service
Content: View full analysis
" ``` Include this in all POST and PATCH request bodies, and as `?callerId=telegram:` on GET requests. If `origin.from` is unavailable, omit `callerId` rather than sending a placeholder. ``` Representative transmission: ```bash curl -s -H "Authorization: Bearer $AGENT_SECRET" \ "https://api.zhentan.me/analyze/tx-XXX?callerId=telegram:" ``` ### Technical Analysis The Skill directs the agent to extract a stable numeric Telegram user identifier from session context and transmit it to `api.zhentan.me`. It requires this identifier in all POST and PATCH bodies and on at least some GET requests. A caller identifier may legitimately be required for authorization or tenant routing. However, the documented behavior sends it more broadly than the minimum demonstrated need, including analysis, notification, invoice, rule, and configuration requests. The Skill provides no disclosure, consent, retention, deletion, or data-minimization controls. Because the external service also receives transaction identifiers, Safe addresses, risk-analysis requests, rule changes, invoices, and approval decisions, it can associate a Telegram identity with wallet activity and financial behavior. ### Attack Path 1. A Telegram user invokes the Skill. 2. The agent reads the numeric user identifier from `origin.from`. 3. The Skill constructs `callerId` as `telegram:`. 4. The identifier is transmitted to `https://api.zhentan.me` with financial and operational requests. 5. The external service can correlate the st ...[truncated 684 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:223
Finding: Unsafe Interpolation of User-Controlled Identifiers into Shell Commands and JSON
Content: View full analysis
"}' ``` ```bash curl -s -H "Authorization: Bearer $AGENT_SECRET" \ "https://api.zhentan.me/analyze/tx-XXX?callerId=telegram:" ``` ```bash curl -s -X PATCH https://api.zhentan.me/rules/RULE_ID \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"isActive": false, "callerId": "telegram:"}' ``` ```bash curl -s -X DELETE -H "Authorization: Bearer $AGENT_SECRET" https://api.zhentan.me/rules/RULE_ID ``` ### Technical Analysis The Skill instructs the agent to substitute transaction IDs, rule IDs, caller IDs, addresses, reasons, and other values directly into shell command strings, URL paths, query strings, and manually constructed JSON. The DELETE example is particularly unsafe because the URL containing `RULE_ID` is unquoted. If agent-generated substitution permits shell metacharacters, command substitutions, whitespace, or option-like prefixes, the resulting shell command could be reinterpreted rather than treated as a single inert URL. Quoted examples are not uniformly safe either. Values inserted into double-quoted URLs can remain vulnerable to shell expansion if they contain constructs such as command substitution. Values inserted into single-quoted JSON can terminate the quoting context if they contain a single quote. Malformed JSON may also change API semantics or cause requests to target unintended resources. The file states that a transaction ID should be passed exactly as written but does not define or enforce a validation expression. It also supplies no validation requirements ...[truncated 1766 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:17
Finding: Caller Identity Is Not Cryptographically Bound to the Shared Bearer Credential
Content: View full analysis
" ``` Include this in all POST and PATCH request bodies, and as `?callerId=telegram:` on GET requests. ``` ### Technical Analysis The Skill uses a bearer secret to authenticate the Skill and a plain request field to identify the individual Telegram caller. The documented request format contains no signature, nonce, short-lived user token, or other cryptographic binding between `callerId`, the originating Telegram session, the request body, and the authenticated credential. Consequently, `callerId` is an assertion supplied by the client rather than proof of caller identity. If the remote service relies on this field as an authorization control, any party that obtains the shared bearer secret and can construct requests could submit another user's Telegram identifier. A similar risk exists if session context can be spoofed or if prompt-controlled request construction can override the expected caller value. The repository contains no server implementation, so it is not possible to determine whether `api.zhentan.me` independently validates wallet ownership, account membership, or Telegram identity. The vulnerability applies to the documented client-side trust model and becomes exploitable if the server trusts `callerId` without independent verification. ### Attack Path 1. An attacker gains the ability to send requests with `AGENT_SECRET`, for exa ...[truncated 1314 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (27)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The skill explicitly describes autonomous server-side approval and auto-execution of transactions deemed low-risk. In an onchain asset-management context, allowing automated execution based on heuristic scoring is dangerous because false negatives or manipulated inputs can lead to irreversible transfer of funds.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
1. **Owner** proposes a transaction — signs 1-of-2, POSTs to `POST /queue` 2. **Server** runs inline risk analysis and either: - **APPROVE** (risk < 40): auto-executes on-chain, sends Telegram notification - **REVIEW** (risk 40–70): marks `inReview`, sends Telegram asking owner to approve/reject - **BLOCK** (risk > 70): marks `inReview`, sends urgent Telegram alert 3. **Agent** (you) handles owner commands via Telegram — execute scripts, call endpoints, report results

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The approve flow says to "co-sign and execute" immediately via the server but does not require a final warning that approval triggers on-chain execution. In a wallet context, that missing confirmation can cause irreversible asset movement from a brief or ambiguous user command.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This endpoint transmits an authenticated request that co-signs and executes a blockchain transaction. Because it can cause immediate, irreversible on-chain effects when triggered from conversational input, the external transmission is security-sensitive rather than routine network usage.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Co-sign and execute via the server:

bash
curl -s -X POST https://api.zhentan.me/execute \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This endpoint transmits an authenticated request that co-signs and executes a blockchain transaction. Because it can cause immediate, irreversible on-chain effects when triggered from conversational input, the external transmission is security-sensitive rather than routine network usage.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Co-sign and execute via the server:

bash
curl -s -X POST https://api.zhentan.me/execute \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

Update the Telegram notification with the tx hash from step 1:

bash
curl -s -X POST https://api.zhentan.me/notify-resolve \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"txId":"tx-XXX","action":"approved","txHash":"THE_TX_HASH","callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: This external PATCH can disable or enable screening for a Safe, directly changing the security posture of transaction review. A conversational skill that can turn screening off without an explicit warning or stronger confirmation introduces meaningful security downgrade risk.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
Turn screening on or off for a Safe:

bash
# Turn on curl -s -X PATCH https://api.zhentan.me/status \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"safe":"0xSAFE_ADDRESS","screeningMode":true,"callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The 'turn off' screening request disables a core protection mechanism through a simple remote call. In this context, that capability is security-critical because an attacker who can induce the action can lower defenses and increase the chance of malicious transactions being approved later.
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
md
-d '{"safe":"0xSAFE_ADDRESS","screeningMode":true,"callerId":"telegram:<origin.from>"}' # Turn off curl -s -X PATCH https://api.zhentan.me/status \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"safe":"0xSAFE_ADDRESS","screeningMode":false,"callerId":"telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Updating limits and thresholds changes the policy that governs automatic approvals and blocks. If altered through casual conversational input, this can weaken safeguards and allow higher-risk transactions to pass with less scrutiny.
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
update limits

Update global limits for a Safe (any combination of fields):

bash
curl -s -X PATCH https://api.zhentan.me/status \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 78% confidence
Finding: Creating rules remotely can materially change how transactions are approved, reviewed, or blocked. Because rules may whitelist recipients or auto-approve activity, this is a sensitive control-plane action that should not be treated like ordinary external transmission.
Content: Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.
create rule

bash
curl -s -X POST https://api.zhentan.me/rules \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 78% confidence
Finding: Updating a rule can disable or weaken protections by setting isActive to false or changing approval logic. In a security agent, policy mutations are high-value actions and need stronger safeguards than a plain conversational request.
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
update rule

bash
curl -s -X PATCH https://api.zhentan.me/rules/RULE_ID \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $AGENT_SECRET" \ -d '{"isActive": false, "callerId": "telegram:<origin.from>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: Deleting a rule removes a layer of transaction protection and can silently weaken the system's security posture. Since this is a destructive control-plane action exposed through the skill, it has meaningful abuse potential if induced by prompt manipulation or ambiguous user input.
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
delete rule

bash
curl -s -X DELETE -H "Authorization: Bearer $AGENT_SECRET" https://api.zhentan.me/rules/RULE_ID

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill metadata and top-level description frame the tool as an onchain transaction co-signer, but the body also adds invoice ingestion, parsing, storage, and status-management features. That capability expansion matters because users and reviewers may not realize the skill can collect and transmit invoice contents, increasing privacy and data-handling risk beyond the declared purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The skill instructs the agent to parse arbitrary invoice files/messages and derive structured data from them, even though that functionality is only loosely related to co-signing multisig transactions. This broadens the skill into general document processing, which can expose sensitive business information and create a larger attack surface for prompt injection or over-collection from untrusted files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

other

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Autonomous Decision Making

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

update limits

External Transmission

create rule

External Transmission

update rule

External Transmission

delete rule

Description-Behavior Mismatch

Context-Inappropriate Capability

Static analysis