T08 · Insecure Dependencies
Warning
- Location
SKILL.md:32- Finding
Unpinned zx Package Installation and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
zx
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only zx shell-scripting skill that explains powerful command-running features but does not hide behavior or include an executable payload.
Install only if you want help writing or reviewing zx scripts. Treat generated zx commands as real shell code: pin package versions when possible, avoid running remote or Markdown scripts from untrusted sources, and keep secrets out of environment files passed to commands that may call external services.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Warning
- Location
references/cli.md:139- Finding
Execution of a Mutable Remote Script Without Integrity Verification
- Content
View full analysis
⚠️ Make sure you trust the remote source. ``` ### Technical Analysis The documented command instructs zx to download and immediately execute JavaScript from an external URL. The URL references the mutable `main` branch rather than an immutable commit. Consequently, the script executed in the future may differ from the script reviewed when this Skill was audited. The source is Google zx's official GitHub repository, and the documentation includes a warning to trust the remote source. These factors reduce the likelihood of abuse but do not provide integrity guarantees. Trust in a repository owner does not protect against repository compromise, account compromise, malicious upstream changes, DNS or infrastructure compromise, or unexpected branch modifications. Because retrieval and execution occur as one operation, the user has no mandatory review or hash-verification step between downloading the content and running it. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the infrastructure serving the remote content. 2. The attacker modifies the script reachable through the `main` branch URL. 3. A user runs the documented `zx https://...` command. 4. zx downloads the current remote content without validating a documented cryptographic digest or signature. 5. zx immediately executes the modified script. 6. The remote payload runs with the invoking user's local permissions and access to the process environment. ### Impact Assessment A malicious remote script could execute arbitrary shell commands and JavaScript with the invokin ...[truncated 505 chars]- Remediation
View remediation
/examples/hello.mjs' # Inspect hello.mjs before execution. zx hello.mjs ``` 3. Pin remote content to a full Git commit SHA rather than a branch or tag. 4. Publish an expected SHA-256 digest and require verification before execution: ```bash echo ' hello.mjs' | sha256sum --check - ``` 5. Where available, verify a signed release or signed commit and document the expected signer. 6. Explicitly warn that remote scripts receive the invoking user's permissions and may inherit sensitive environment variables. 7. Recommend executing untrusted scripts in an isolated container or sandbox with a minimal environment, restricted filesystem mounts, and limited network access. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
zx --env=/path/to/.env script.mjs
Relative to cwd:
zx --cwd='/foo/bar' --env='../.env' # => /foo/.env
text ### `--ext`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
zx --env=/path/to/.env script.mjs
Relative to cwd:
zx --cwd='/foo/bar' --env='../.env' # => /foo/.env
text ### `--ext`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
zx --env=/path/to/.env script.mjs
Relative to cwd:
zx --cwd='/foo/bar' --env='../.env' # => /foo/.env
text ### `--ext`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
zx --env=/path/to/.env script.mjs
Relative to cwd:
zx --cwd='/foo/bar' --env='../.env' # => /foo/.env
text ### `--ext`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
zx --env=/path/to/.env script.mjs
Relative to cwd:
zx --cwd='/foo/bar' --env='../.env' # => /foo/.env
text ### `--ext`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
zx --env=/path/to/.env script.mjs
Relative to cwd:
zx --cwd='/foo/bar' --env='../.env' # => /foo/.env
text ### `--ext`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Environment variables map. Defaults to
process.env.js $.env = { ...process.env, NODE_ENV: 'production' }$.cwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Environment variables map. Defaults to
process.env.js $.env = { ...process.env, NODE_ENV: 'production' }$.cwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Environment variables map. Defaults to
process.env.js $.env = { ...process.env, NODE_ENV: 'production' }$.cwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Environment variables map. Defaults to
process.env.js $.env = { ...process.env, NODE_ENV: 'production' }$.cwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Environment variables map. Defaults to
process.env.js $.env = { ...process.env, NODE_ENV: 'production' }$.cwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Environment variables map. Defaults to
process.env.js $.env = { ...process.env, NODE_ENV: 'production' }$.cwd
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill explicitly says it should trigger for 'executing remote scripts' and also documents HTTP requests via
fetch(), but provides no warning about remote code execution, trust boundaries, or verification of downloaded content. In a shell-scripting skill, that omission increases the chance that users will execute untrusted code or pipe remote content into commands without scrutiny.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file describes executing shell commands as a core API feature, and later includes changing directories and killing processes, all of which can affect system state. The document provides usage examples but does not include any warning about command execution risks, destructive effects, or the need for caution when running commands.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The documentation recommends
npx zx script.mjswithout pinning a version, which can pull the latest package at execution time and expose users to supply-chain drift or a compromised upstream release. In a CLI/execution-focused skill, that guidance directly influences how users run code, making the risk practical rather than theoretical.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
--installauto-installs missing dependencies before running, which can trigger execution of unreviewed packages and their lifecycle scripts. The document presents this as a convenience feature without any warning about package trust, registry integrity, or supply-chain risk.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation states that zx executes
js,ts, and shell code blocks embedded in Markdown files, but does not prominently warn that opening or running an untrusted.mdfile can lead to arbitrary code execution. Because Markdown is commonly perceived as inert documentation, this behavior materially increases the chance of accidental execution.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 44% confidence
- Finding
This line establishes bash as the default environment, but the file also documents alternatives such as PowerShell and manual shell override. Because the skill presents other options and does not force a human language or locale, this is at most a weak policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The
fetch()section shows making network requests, and thedotenvsection later demonstrates loading environment variables into command execution context, but the documentation does not warn that requests may transmit user or system data or that environment values may contain secrets. For markdown files, omission of such warnings is in scope when behaviors can affect privacy or system integrity.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file includes examples piping process output to '/tmp/output.txt' and creating a writable file stream, which are filesystem write operations. The surrounding documentation does not include any warning that these examples modify local files or may overwrite existing data.
- Content
Static analysis
No suspicious patterns detected.