ZFONT-CLI

• Analyzed: May 11, 2026, 6:40 AM
• Findings: 1
• Version: 1.5.3
• Hash: 05d528ff21bc27aca20259eb4a9b037be4b18f158a7e52313de9f9039b88fa0b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates font searching and downloading from zfont.cn but contains shell injection vulnerabilities in the `download_font_archive` and `process_font_asset` actions within `skill.md`. It uses `bash -c` to execute `wget` and `unzip` commands using variables (`download_url`, `font_name`) fetched directly from a remote API without adequate shell sanitization. While the code includes a domain whitelist check for `https://files.zfont.cn/*`, the implementation remains vulnerable to RCE if the remote API returns crafted payloads.