Security audit

zadig

Security checks for vulnerabilities and agentic risk

Overview

This is a real Zadig DevOps API client, but it exposes high-impact administration and credential risks that users should review carefully before installing.

Install only with a dedicated least-privilege Zadig token, keep the token out of version control, require HTTPS for ZADIG_API_URL, and avoid using this skill for production or admin actions unless you have reviewed the exported delete/update/user/cluster functions and added confirmation controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: index.js:1507
Finding: Shell Command Injection and Bearer Token Exposure in Log Retrieval
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:64
Finding: Bearer Credentials Can Be Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents the skill as an API client, but the detected behavior includes broad destructive administration, execution of workflows, sensitive system management, subprocess-based curl execution, and access to complete/streaming logs. This mismatch is dangerous because users may invoke the skill expecting limited read/API behavior while actually granting a powerful automation surface capable of changing infrastructure and exposing sensitive operational data.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 85% confidence
Finding: The skill explicitly requires read access to .env in order to obtain the Zadig API token, which is a sensitive credential. If the skill is over-privileged, compromised, or behaves unexpectedly, that token could be exposed or used to perform privileged DevOps actions against the Zadig platform.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
## 权限说明 - read:env - 读取 .env 文件获取 API 凭证 - network:https - 向 Zadig API 服务器发起请求 ## 核心功能

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill invokes a local shell command via execSync to run curl, interpolating API_BASE, pod name, container name, projectKey, envName, and the bearer token into a command string. This creates an unnecessary subprocess execution surface for a simple API client and introduces command-injection and credential-exposure risk if any interpolated value contains shell metacharacters or if process execution/logging is observed.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · package.json (reported line 23)May include surrounding context.
json
"ZADIG_DEFAULT_ENV" ] }, "description": "Zadig API Client - reads .env for credentials, makes HTTPS calls to Zadig server only." }, "features": [ "DevOps automation",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs users to place a long-lived API token in a local .env file and even labels it as a JWT token, but provides no warning about credential sensitivity, file permissions, accidental commits, or rotation. In a DevOps skill that can manage projects, environments, workflows, and clusters, exposure of this token could grant broad control over CI/CD and infrastructure operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README advertises destructive capabilities such as deleting projects and updating environments/images without any caution about production impact, approval requirements, or rollback planning. Because this skill targets a live DevOps platform, normalizing high-impact actions without warnings increases the chance of accidental misuse that could disrupt deployments, environments, or data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation lists sensitive capabilities such as reading environment credentials and making outbound network requests, but it does not declare a formal tool scope like permissions or allowed-tools. That gap reduces transparency and can let a caller underestimate what the skill can access or execute, especially if shell capability is also present in the implementation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description and all user-facing documentation are written in Chinese, with no indication that other languages are supported or that Chinese is a deliberate opt-in. This can violate a language/locale policy when skills must not force a specific language without user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code exports many irreversible or high-impact operations such as deleting projects, environments, clusters, users, roles, releases, and collaborations, as well as modifying deployments and production-related resources. Although the function names and comments describe what they do, there is no confirmation prompt, user-facing log, or explicit safety warning in the code for these actions, so a caller could invoke destructive operations without any disclosure at execution time.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest description is broad but minimal: it presents the skill as a Zadig DevOps platform API client requiring a URL and API key. The code goes beyond routine project/workflow operations and includes sensitive administrative capabilities such as creating/deleting clusters and registries, listing/deleting users, and managing roles and role bindings, which are high-impact platform administration functions not disclosed in the manifest text.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The shell-based log retrieval path handles a sensitive bearer token and assembles a curl command string without any safety barriers. Even aside from user disclosure concerns, this pattern increases the chance of token leakage through process inspection, crash output, or shell injection side effects, making the implementation materially unsafe.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The exported config object exposes the raw API_KEY to any caller that imports this module. That turns a helper client into a credential disclosure primitive, enabling downstream code or prompt-influenced consumers to read and exfiltrate the bearer token and then perform privileged Zadig actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language instructions and usage guidance are presented only in Chinese, which effectively forces a specific language for users of the skill. Under the stated policy, locale or language constraints should be opt-in or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Most human-facing comments and docstrings in this file are written only in Chinese, including function descriptions and returned-message annotations, with no indication of multilingual support or user language choice. That creates a language/locale constraint in the skill's natural-language interface without opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The shared request helpers send API requests with bearer authentication to the configured Zadig server and are reused by functions that fetch logs, workflow details, user lists, and other potentially sensitive platform data. While the header comments note required environment variables, there is no runtime disclosure, logging, or warning that user or system metadata will be transmitted over the network.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:1513