Security audit

zeelin-text-analysis

Security checks for vulnerabilities and agentic risk

Overview

This text-analysis skill is understandable, but it uploads documents and an App-Key to an unencrypted raw-IP service with unclear privacy and retention controls.

Install only if you trust the Zeelin service and are comfortable sending selected documents and your App-Key to that endpoint. Avoid confidential or regulated files, use a restricted or easily rotated key if available, verify whether an HTTPS endpoint and privacy policy exist, and remember that generated Markdown results may remain on disk.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest presents the skill as local text analysis, but the documented behavior sends uploaded user files and requests to external Zeelin and OSS services. This mismatch is security-relevant because users and calling systems may reasonably expect local-only handling and instead exfiltrate potentially sensitive documents to third parties.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill requires external account registration, credential configuration, and paid remote service usage that are not clearly justified by the simple stated purpose of text analysis. This expands trust boundaries and introduces credential exposure, billing abuse, and third-party data handling risks without adequate upfront disclosure.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is described as analyzing locally uploaded text files, but its configuration sends requests to a remote HTTP endpoint. This creates a clear trust-boundary mismatch: users may expect local-only processing while their uploaded document contents are transmitted over the network, and HTTP adds interception/tampering risk because traffic is not encrypted.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: A skill marketed as local text-file analysis has no obvious need to contact an external server, yet it is configured with a remote network endpoint. That unjustified egress path can expose sensitive uploaded document contents to third parties and expands the attack surface to include server compromise, traffic interception, and unauthorized data collection.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases are broad enough that the skill may activate for generic requests like analyzing a document, causing unintentional invocation of a workflow that uploads local files and uses paid external services. Because activation leads to external transmission and credential use, accidental triggering materially increases privacy and billing risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation tells the agent to upload local files and send an App-Key to external services without a clear privacy notice, retention policy, or data-handling warning. This is dangerous because users may unknowingly transmit sensitive documents and credentials to third-party infrastructure, including OSS storage, over network endpoints outside their control.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description advertises broad, automatic text-analysis behavior for uploaded local files without clearly constraining when the skill should activate or what content types are in scope. In an agent environment, vague triggers can cause unintended invocation on sensitive user documents, increasing the chance of over-collection or processing beyond user intent.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: templates/config.json:4