0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:04 PM UTC
• Version: 1.0.0

Overview

The skill is a broad “zero” reference, but it can steer agents toward reset, wipe, clean, and tight-loop commands without enough scoping or confirmation.

Review this skill carefully before installing. It does not ship executable code, but its broad trigger and examples can lead an agent to suggest or run destructive reset, wipe, clean, repository, or tight-loop commands. Only use it in contexts where the agent must ask for explicit confirmation, show exact targets, prefer dry runs, and avoid production or shared environments for any reset or wipe operation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31

Finding

Destructive Reset and Data-Wiping Operations Lack Safety Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-45 and 178-187
Vulnerability Type: Unscoped destructive operations
Risk Level: High

The Skill recommends commands that reset state, remove generated files, wipe databases, recreate environments, clear user data, and reinitialize repositories:

bash

0 init                # Create a blank project
0 new project_name    # Start a new project from zero
0 reset               # Reset all state to its initial point
0 clean               # Clear caches, temporary files, and build artifacts
0 scaffold            # Generate a standard directory structure

0 env --fresh         # Recreate the virtual environment
0 db --wipe           # Wipe the database
0 cache --clear       # Clear all caches
0 config --default    # Restore default configuration

Additional destructive commands appear later in the file:

bash

0 dayplan --clear      # Clear the previous day's plan
0 journal --new        # Create a new journal
0 habits --reset       # Restart habit tracking

0 repo --fresh-start   # Reinitialize Git while retaining code
0 deps --reinstall     # Reinstall all dependencies

Technical Analysis

These operations are presented without mandatory confirmation, target validation, backup checks, dry-run behavior, or path and environment scoping. The project contains only SKILL.md; it does not define or document an implementation of the 0 executable. Consequently, the precise effects, trustworthiness, and safety properties of these commands cannot be verified from the audited artifact.

A natural-language request such as “reset the project” or “start from zero” could cause an Agent to select a command with effects broader than the user intended. In particular, 0 db --wipe, 0 reset, 0 clean, and 0 repo --fresh-start imply irreversible or disruptive state changes.

Attack Path

1. A user or untrusted instruction asks the Agen ...[truncated 1015 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user confirmation immediately before every destructive operation.
• Display the fully resolved target path, database identifier, environment, and affected resources before execution.
• Implement a dry-run mode that enumerates all planned changes without modifying state.
• Reject empty, implicit, root-level, production, or out-of-scope targets.
• Verify that a recent, restorable backup exists before database wipes, repository resets, or configuration replacement.
• Prefer reversible operations, such as moving files to a quarantine directory, over permanent deletion.
• Require additional confirmation for production environments and prohibit destructive operations by default.
• Document the trusted source, implementation, version, and exact semantics of the 0 executable.
• Run operations with least privilege and restrict access to only the specific project resources requested by the user.
• Record an audit log containing the confirmed target, requesting user, executed operation, and result.

other

Warning

• Location: SKILL.md:77

Finding

Unbounded Zero-Delay Loop Can Exhaust System Resources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77-91
Vulnerability Type: Uncontrolled resource consumption
Risk Level: Medium

The Skill includes the following infinite-loop guidance:

bash

# Infinite loop with exit on a nonzero condition
while true; do
  process
  [ $? -eq 0 ] || break
done

# Zero-second delay, running as fast as possible
while :; do task; done

# Continue until a zero state
until [ $(check_status) -eq 0 ]; do
  sleep 1
done

Technical Analysis

The command while :; do task; done is an unconditional tight loop with no delay, timeout, retry limit, signal handling, or termination condition. It can continuously consume CPU and repeatedly invoke task at the maximum rate permitted by the host.

The consequences depend on what task performs. A computational task can saturate CPU, while a task involving file creation, logging, process creation, database access, or network requests can exhaust storage, process limits, database capacity, API quotas, or downstream service resources.

Attack Path

1. A user asks for an infinite loop, continuous polling, or a task with no delay.
2. The Agent follows the documented zero-delay example.
3. The shell enters the unconditional while : loop.
4. task is invoked repeatedly without throttling or a bounded retry count.
5. The process consumes local resources or overwhelms a downstream service until it is externally terminated or the affected resource is exhausted.

Impact Assessment

The loop can cause denial of service, CPU saturation, excessive power consumption, log or disk exhaustion, API quota depletion, or overload of databases and remote services. It does not grant additional privileges; effects are constrained by the executing account's permissions and by the behavior of task. Availability impact can nevertheless extend to other users when run on a shared host or against shared infrastructure.

Remediation

View remediation

Remediation Suggestions

• Replace unconditional loops with an explicit maximum iteration or retry count.
• Add a delay and exponential backoff between attempts.
• Apply an overall execution timeout.
• Define a reliable success, failure, and cancellation condition.
• Add signal traps so the loop terminates cleanly on interruption or shutdown.
• Prevent overlapping task executions and ensure each iteration completes before another begins.
• Apply CPU, memory, process, storage, and network resource limits.
• Rate-limit calls to databases, APIs, and other downstream services.
• Emit bounded and rotated logs rather than unrestricted output.
• Document that zero-delay loops must not be used in production or shared environments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: 0
description: Zero represents the origin, the blank slate, the reset button. This skill handles initialization, zero-state operations, default values, infinite loops, and the power of nothingness. Use when starting fresh, resetting systems, or working with mathematical zero concepts.
---

# 0（Zero/Origin 简写）

这是一个哲学与技术结合的 Skill，用数字 **0** 触发。0 不只是数字，它代表：

- **原点**：一切开始的地方
- **空集**：无限可能的容器
- **重置**：清洗状态，重新开始
- **无穷**：循环的起点与终点
- **默认值**：未

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Using the single character "0" as a trigger is dangerously over-broad because it is common in ordinary conversation, code snippets, numeric input, logs, and examples. In an agent environment, this can cause accidental invocation of reset/clean/wipe behaviors when the user did not intend to activate the skill, especially given the skill's destructive themes.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill presents destructive commands such as reset, clean, and database wipe in a cookbook style, with only minimal and inconsistent warning language. In an agent setting, concise examples can be operationalized directly, creating a real risk of data loss, environment destruction, or irreversible state reset if the commands are suggested or run automatically.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

The skill explicitly demonstrates hiding content with a zero-width space, which is a classic obfuscation technique. In agent or review workflows, invisible characters can be used to conceal malicious instructions, alter identifiers, evade human review, or create deceptive differences between displayed and actual text.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

bash

# 文件中隐藏数据
echo "secret" | cat -A  # 可见
echo "sec​ret" | cat -A  # U+200b 零宽空格隐藏

零字节文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

bash

# 默认拒绝，显式允许
# 无配置时，零权限
chmod 000 secret.txt   # 完全禁止
chmod 644 file.txt     # 最小权限原则

# 零知识证明（概念）

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description defines a very broad activation scope spanning initialization, resets, default values, infinite loops, and mathematical zero concepts. That ambiguity increases the chance that the skill will match benign user requests or code discussion and then propose or execute unsafe operations outside the user's actual intent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md

# 默认拒绝，显式允许
# 无配置时，零权限
chmod 000 secret.txt   # 完全禁止
chmod 644 file.txt     # 最小权限原则

# 零知识证明（概念）
# 不传递秘密，只证明知道

Static analysis

No suspicious patterns detected.