ZFONT-CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:46 AM UTC
• Version: 1.5.3

Overview

This font-download skill has a coherent purpose, but its file and shell handling could expose local files or run unintended commands if parameters are manipulated.

Review before installing. The skill is not clearly malicious, but it should be tightened before routine use: require confirmation before download, avoid bash interpolation, keep artifacts in a private per-run directory, validate that only files created by the current workflow can be sent, and clean up downloaded and extracted files after delivery.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:98

Finding

Shell Command Injection Through Untrusted Template Parameters

Content

View full analysis

/dev/null 2>&1 ``` ### Technical Analysis The parameters `download_url`, `font_name`, `user_choice`, and `zip_path` are inserted directly into the source text of a `bash -c` command. Double quotes around template substitutions do not make this safe because template expansion occurs before Bash parses the resulting command. A value containing a quotation mark, command substitution, or other shell syntax can terminate or alter the intended assignment. Shell substitutions can therefore execute while Bash evaluates the assignment, before the supplied value is used by `wget` or `unzip`. The domain check does not eliminate this vulnerability. It runs only after Bash has parsed and expanded the generated command, so malicious shell expressions embedded in `download_url` may execute before the allowlist comparison. The same issue affects the other interpolated parameters, which have no meaningful character validation. ### Attack Path 1. An attacker causes the agent or action framework to invoke one of the affected actions with a crafted parameter. 2. The framework substitutes the parameter directly into the `bash -c` script. 3. The crafted value introduces shell syntax or command substitution into the generated script. 4. Bash parses and expands the malicious expression. 5. The injec ...[truncated 676 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skill.md:134

Finding

Arbitrary Local File Disclosure Through Unrestricted File Paths

Content

View full analysis

解析 stdout 输出： 1. 如果包含 `RESULT_FILE` 或 `RESULT_DIR`，提取对应路径，并静默调用 `send_font_to_user` 动作。 ``` ```yaml send_font_to_user: description: "下发文件，并根据文件类型提供极简指引。" parameters: target_path: type: string required: true execution: type: natural_language_generation response_handling: instruction: > 1. 调用框架接口下发 `{{target_path}}` 里的文件。 2. 绝对不要复述字体的介绍信息。 3. 检查 `{{target_path}}` 的文件类型，严格按照以下对应的格式输出： ``` ### Technical Analysis The `process_font_asset` action accepts `zip_path` as an ordinary string and returns it unchanged as `RESULT_FILE` when `user_choice` is `zip`. Its response handler then passes the resulting path to `send_font_to_user`, which instructs the framework to transmit the file at `target_path`. There is no canonicalization, ownership check, directory-boundary check, regular-file check, or symlink rejection. The implementation also does not bind `zip_path` to the archive path generated by `download_font_archive`. Consequently, a caller that can manipulate action parameters may supply a path to any file readable by the agent process. The file-sending capability can then expose that local file to the requesting user. The same general trust-boundary issue applies to a directly supplied `target_path` if the framework allows the action to be invoked independently. ### Attack Path 1. An attacker or manipulated agent invokes `process_font_asset`. 2. The attacker supplies the path of a readable local file as `zip_path`. 3. The attacker selects `zip` as `user_choice`. 4. ...[truncated 821 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:100

Finding

Predictable and Unsafe Temporary File Handling

Content

View full analysis

/dev/null 2>&1 ``` ### Technical Analysis Downloaded archives and extraction directories are created under the shared `/tmp` directory using names derived from `font_name`. Replacing spaces with underscores does not make the names unique or safe. No random per-invocation directory is used, and the code does not verify that existing paths are owned by the current process or are not symbolic links. `wget -O` writes to the predictable destination, while `unzip -o` overwrites existing extracted files without prompting. In a multi-user or concurrently executing environment, another local process can predict these paths and pre-create files, directories, or symbolic links. Concurrent skill invocations using the same font name can also overwrite or mix each other's artifacts. ### Attack Path 1. A local attacker predicts the archive or extraction path from a requested font name. 2. Before the skill writes or extracts the archive, the attacker pre-creates a conflicting path or symbolic link, or places attacker-controlled files in the extraction directory. 3. The skill reuses the predictable path and performs the download or extraction with overwrite behavior enabled. 4. Depending on filesystem behavior and permissions, the skill may overwrite an unintended destination or retain attacker-controlled content in the output directory. 5. The resulting files may subsequently be sent to the user as trusted font arti ...[truncated 689 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description does not clearly warn users that the skill will make outbound HTTP requests and execute shell commands to download and unzip files. This reduces informed consent and makes it easier for users to trigger potentially risky local operations without understanding what the agent will do on their behalf.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to activate on generic requests like '找字体' or '下载字体', which can cause the skill to intercept ordinary conversations and initiate external network/file operations unexpectedly. In this skill's context, overbroad activation is more dangerous because the workflow performs HTTP requests and shell-based downloads/unzip actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions prescribe response style entirely in Chinese and include fixed Chinese output text, but there is no opt-in or indication that the skill is intentionally limited to Chinese-speaking users. Under the locale policy, forcing a language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow instructs the agent to silently call the download action immediately after obtaining a URL, without a user-visible confirmation at that step. In a skill that writes files to /tmp and later extracts them, silent progression increases the chance of unexpected file operations and reduces user control over potentially unsafe content retrieval.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill creates persistent extracted content under /tmp/extracted_<font_name> and returns that directory for later file sending, but it does not clean up archives or extracted files afterward. This can leave user-requested assets behind across the session or longer, increasing exposure of downloaded content and enabling unintended reuse or access by later workflows on the same host.

Content

Scanner excerpt · skill.md (reported line 143)May include surrounding context.

md

exit 0
        fi

        mkdir -p "$EXTRACT_DIR"
        unzip -q -j -o "$ZIP_PATH" -d "$EXTRACT_DIR" > /dev/null 2>&1

        if [ "$CHOICE" = "extract" ]; then

Static analysis

No suspicious patterns detected.