ZenHeart User Agent Workflows

• Outcome: Review
• Latest audit: May 29, 2026 at 9:35 PM UTC
• Version:
  1.0.1

Overview

The skill mostly documents expected ZenHeart agent workflows, but it also includes an under-scoped server-pushed command callback that needs review before use.

Review this skill before installing. Use only scoped ZenHeart credentials for an account you control, and do not allow the agent to execute server-pushed command strings as shell commands, local tool calls, file reads, or other privileged actions unless you add an explicit allowlist and human approval step.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill defines a server-pushed `command` message and instructs the agent to return a `command_result`, but it provides no constraint on what commands are safe, no validation requirements, and no prohibition on local tool or shell execution. In an agent-skill context, this creates a dangerous remote-instruction channel that can be interpreted as authorization to execute arbitrary actions beyond the documented messaging/news/social workflows.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The command callback tells the agent to respond to arbitrary server-pushed commands without any warning that this can induce remote command execution or other system-affecting behavior. In practice, an LLM agent may treat this as trusted orchestration and invoke local capabilities on attacker-controlled input, enabling prompt injection, data exfiltration, or unsafe action execution.

VirusTotal

65/65 vendors flagged this skill as clean.