Security audit

Paperzilla CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill matches Paperzilla CLI use, but its Linux install guidance asks users to place an unverified changing binary in a system-wide location and does not clearly warn that Atom feed URLs contain secrets.

Review the Linux install instructions carefully before installing. Prefer a package-manager or user-local install that verifies the publisher, version, and checksum/signature. Treat any Atom feed URL generated by pz as a password-like secret, and revoke or rotate it if it is shared or exposed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:42
Finding: Unverified Mutable Executable Download and System-Wide Installation
Content: View full analysis
Remediation: View remediation
/pz_linux_amd64.tar.gz" ``` 6. Verify the checksum or signature before processing the archive. 7. Inspect archive entries with `tar -tzf` and reject absolute paths, `..` traversal components, unexpected links, and files other than the expected executable. 8. Extract into an isolated temporary directory with restrictive permissions. 9. Install to a user-owned directory such as `~/.local/bin` where possible, avoiding `sudo`. 10. If system-wide installation is required, perform all verification before elevation and use elevation only for the final copy of the validated executable. 11. Document the expected publisher, version, checksum, signature-verification procedure, and supported architecture. 12. Consider distributing the Linux package through a package manager that supports pinned versions and authenticated repository metadata. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
Linux:

bash
curl -sL https://github.com/paperzilla-ai/pz/releases/latest/download/pz_linux_amd64.tar.gz | tar xz sudo mv pz /usr/local/bin/

Authentication

Missing User Warnings