Security audit

Zilliz Cloud

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about managing Zilliz Cloud, but it documents sensitive password and payment-card values in terminal commands and covers destructive cloud/database actions that need careful review.

Install only if you are comfortable letting an agent operate your Zilliz Cloud resources. Prefer browser or interactive flows for passwords and payment cards, do not paste API keys or card details into chat, and explicitly confirm destructive, RBAC, billing, and data-deletion actions before they run. Consider installing the CLI in an isolated environment and using a reviewed or pinned version where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:74
Finding: Unpinned Third-Party CLI Installation Enables Supply-Chain Substitution
Content: View full analysis
Remediation: View remediation
' ``` 2. Maintain a dependency lock file containing hashes and install with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 3. Pin and review relevant transitive dependencies where feasible. 4. Remove the instruction to perform an unconditional upgrade before every use. 5. Upgrade only through a deliberate review process that validates release provenance, package signatures where available, changelogs, and dependency changes. 6. Prefer an isolated virtual environment or `pipx` installation rather than modifying the user's global Python environment. 7. Use a trusted, explicitly configured package index and prevent fallback to untrusted indexes. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:563
Finding: Sensitive Password and Payment Data Passed Through Command-Line Arguments
Content: View full analysis
--password zilliz user describe --user zilliz user update-password --user --password --new-password ``` ```bash zilliz billing bind-card --card-number --exp-month <1-12> --exp-year --cvc ``` ### Technical Analysis The documented commands require users to substitute database passwords, card numbers, and CVC values directly into command-line arguments. Sensitive arguments can be exposed through several local channels: - Shell history files. - Process command-line inspection while the command is running. - Terminal session recording. - Endpoint monitoring and process audit logs. - Wrapper scripts or automation logs. - Diagnostic output that records the invoked command. The instruction to execute the payment command in the user's own terminal prevents disclosure to the AI conversation, but it does not protect the values from local process metadata, shell history, or logging systems. The password-update example is particularly sensitive because it places both the old and new passwords in the same command. Exposure of the new password may allow continued account access after the password change. Payment-card details and CVC values are also highly sensitive and should not be supplied through persistently observable command arguments. ### Attack Path 1. A user replaces the placeholders with real passwords or payment-card information. 2. The user runs the documented command in a shell. 3. The shell, operating system, terminal recorder, or endpoint monitoring product records the complete command line. 4. A local user, malware process, administrator, support operator, or log consumer gains access to the stored history or telemetry. 5. T ...[truncated 1158 chars]
Remediation: View remediation
``` The CLI should then securely prompt for the password. 6. Redesign `update-password` so both passwords are collected through masked prompts rather than `--password` and `--new-password` arguments. 7. Redirect payment-card binding to a secure browser-hosted payment flow or tokenization mechanism. Card numbers and CVC values should not appear in shell commands. 8. Explicitly warn users not to place sensitive values in shell history, scripts, chat messages, or automation logs. 9. Treat shell-history suppression as defense in depth only; it does not protect against process inspection or endpoint telemetry. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents a command that accepts full payment card data on the command line, which is sensitive because command-line arguments can be exposed through shell history, process listings, logging, or agent telemetry. Although the skill does add a brief note to run it in the user's own terminal, the warning is not prominent enough relative to the risk of handling PAN/CVC directly via CLI flags.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 797)May include surrounding context.
md
- Always check prerequisites (CLI installed, logged in, context set) before executing commands. - NEVER run `zilliz login`, `zilliz configure`, or `zilliz auth switch` inside the AI agent — they require interactive input. - NEVER ask the user to paste API keys into the chat — guide them to configure credentials in their own terminal. - Before any destructive operation (delete cluster, drop collection, drop database, delete backup), always confirm with the user. - Use `--output json` when parsing results programmatically, then format into readable summaries. - When a command fails with permissions error, check the cluster type first.

Static analysis

No suspicious patterns detected.