ClawHub
Back to skill

Security audit

ZenVFX CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ZenVFX CLI guide, but users should understand it installs a global CLI, stores/uses a ZenVFX token, and can change or delete ZenVFX project assets.

Install only if you trust the Tencent ZenVFX CLI package and registry. Prefer a pinned version, avoid entering tokens where shell history or logs capture them, use least-privilege/rotatable tokens, and require explicit confirmation before running file:rm or other delete commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:33
Finding

Mutable Global npm Dependencies Installed from a Custom Registry

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:33-37, SKILL.md:67-70, and SKILL.md:697-705
Vulnerability Type: Supply-chain exposure through globally installed, mutable dependencies
Risk Level: Medium

Vulnerable Code

bash
# First installation or upgrade to the latest registry release
npm install -g @tencent/zenvfx-cli@latest --registry https://mirrors.tencent.com/npm/

# Upgrade to a specified version
npm install -g @tencent/zenvfx-cli@0.9.1 --registry https://mirrors.tencent.com/npm/

The recommended installation procedure repeats the mutable installation:

bash
npm install -g @tencent/zenvfx-cli@latest --registry https://mirrors.tencent.com/npm/

The documented daemon workaround also installs a non-exact dependency directly into the global CLI package:

bash
# Locate the global installation directory
npm root -g

# Install React into the CLI package
cd "$(npm root -g)/@tencent/zenvfx-cli"
npm install react@18 --no-save --registry=https://mirrors.tencent.com/npm/

# Restart the daemon
zenvfx daemon:stop
zenvfx daemon:status

Technical Analysis

The primary installation path uses the mutable @latest tag. The effective package contents can therefore change after this skill has been reviewed. The React workaround similarly uses the broad react@18 range rather than an exact, integrity-verified artifact.

Both packages are obtained from a custom npm registry, and the instructions do not require package-integrity verification, provenance validation, a lockfile, or lifecycle-script restrictions. npm packages can define installation lifecycle scripts. Consequently, a compromised publisher account, registry, package artifact, or dependency could cause code to execute during installation.

The use of -g increases the affected scope because it places executable packages in the user's global npm prefix. The workaround also modifies the installed global CLI pac ...[truncated 1622 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest and react@18 with exact, reviewed versions.
  2. Verify package integrity using trusted checksums, npm integrity metadata, signed provenance, or an internally maintained allowlist.
  3. Prefer a project-local, containerized, or otherwise isolated installation over a global installation.
  4. Generate and enforce a lockfile for the CLI and all transitive dependencies where deployment architecture permits.
  5. Use --ignore-scripts during installation unless lifecycle scripts have been reviewed and are strictly required.
  6. Document the trust boundary and security controls of the custom registry.
  7. Avoid modifying a global package in place to add React. Publish a corrected CLI package with an exact dependency or replace the React-dependent import with the appropriate non-React implementation.
  8. Run the CLI under a dedicated, least-privileged account and never install it with administrative privileges unless strictly necessary.
  9. Restart the daemon only after verifying that its executable and dependency versions match the approved artifacts.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:67
Finding

ZenVFX Authentication Token Passed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:67-74
Vulnerability Type: Credential exposure through process arguments and command history
Risk Level: Low

Vulnerable Code

bash
# Installation
npm install -g @tencent/zenvfx-cli@latest --registry https://mirrors.tencent.com/npm/

# Authentication, automatically saving configuration
zenvfx auth:login <token>          # Optional: --host <host-url>

# Validate the token without changing the default project/workspace
zenvfx auth:verify <token>

Technical Analysis

The skill instructs users to place the ZenVFX MCP token directly in the command-line argument vector. Depending on the operating system, shell configuration, process-inspection permissions, terminal capture, and automation environment, command arguments may be exposed through:

  • Shell history files
  • Process-listing or process-inspection interfaces
  • CI/CD and orchestration logs
  • Terminal session recording
  • Diagnostic or support bundles
  • Wrapper scripts that log executed commands

This is not a hardcoded credential—the document contains only a placeholder—but the recommended handling method can expose a real token when followed.

Attack Path

  1. A user substitutes a valid MCP token into zenvfx auth:login or zenvfx auth:verify.
  2. The shell, process manager, terminal recorder, CI runner, or command wrapper records or exposes the command arguments.
  3. Another local principal or a user with access to the relevant logs or history retrieves the token.
  4. The attacker uses the token with ZenVFX APIs or the CLI.
  5. The attacker gains access up to the projects, workspaces, canvases, files, and operations authorized to that token.

Exploitability depends on local process-isolation controls and whether command history or execution logs are accessible to an attacker.

Impact Assessment

The exposed credential could allow unauthorized use of the ...[truncated 367 chars]

Remediation
View remediation

Remediation Suggestions

  1. Change the CLI authentication interface to read tokens from a non-echoing interactive prompt or standard input.
  2. Support protected environment variables or an operating-system credential store without printing their values.
  3. Avoid including secrets in command arguments, shell history, examples, CI logs, or daemon logs.
  4. If an environment variable is used, inject it through a secret manager and prevent environment dumps from appearing in logs.
  5. Store persisted credentials with restrictive file permissions and document the exact storage location.
  6. Redact tokens from errors, diagnostic output, process telemetry, and support bundles.
  7. Provide token revocation, rotation, expiration, and least-privilege scopes.
  8. Advise users who previously entered tokens on the command line to remove affected shell-history entries and rotate tokens if exposure is suspected.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 655)May include surrounding context.

bash
zenvfx daemon:stop
kill $(cat ~/.config/zenvfx/daemon.pid) 2>/dev/null
rm -f ~/.config/zenvfx/daemon.sock ~/.config/zenvfx/daemon.pid

调试运行节点的请求体（对照网页协议时常用）：

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger scope is broad enough to activate this skill for generic requests about files, canvases, or videos, causing an agent to select a powerful CLI skill in contexts where it may not be appropriate. In this skill, that matters because the CLI includes destructive filesystem actions, credential handling, project switching, and task execution against a remote platform.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation claims auth:verify only validates a token, but elsewhere states it writes mcpToken into persistent config. That mismatch can cause an operator or downstream agent to persist secrets unexpectedly when they intended a non-mutating check, increasing risk of credential leakage or accidental account/context switching.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill documents destructive deletion commands such as file:rm without explicit confirmation, safety checks, or warning language. In an agent setting, that lowers friction for irreversible data loss, especially because the paths reference project/workspace storage and the skill is designed for direct operational use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

Earlier guidance explicitly says JSON for --data / --value-json must be written bare and that single-quoting causes JSON parse failure because the parser splits on spaces without quote escaping. Later, the table gives --data '[{...},{...}]' as the usage form, which directly conflicts with the prior instruction and could cause users or agents to invoke commands incorrectly.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:504