Security audit

zenn

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Zenn publishing workflow, with a dependency-pinning caution but no evidence of hidden or malicious behavior.

Before installing, use this only in the intended Zenn repository, review article content for secrets before publishing, and consider pinning zenn-cli to a reviewed exact version instead of using an unpinned or latest install.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:43
Finding: Unpinned Third-Party npm Package Installation and Execution
Content: View full analysis
Remediation: View remediation
``` 2. Generate, review, and commit `package-lock.json` so direct and transitive dependency versions are reproducible. 3. Use deterministic installation in established repositories: ```bash npm ci ``` 4. Remove the `npm install zenn-cli@latest` recommendation. Replace it with a controlled upgrade procedure that: - Selects an explicit version. - Reviews release notes and dependency changes. - Verifies package identity and provenance. - Runs vulnerability and integrity checks. - Tests the upgrade in an isolated environment before adoption. 5. Where supported, verify npm package provenance and registry integrity metadata before installation. 6. Run dependency installation and preview commands in a restricted container or sandbox without production secrets, unnecessary credentials, or broad host filesystem access. 7. Avoid running npm as an administrator or root user, and expose only the repository directories required for the Zenn workflow. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The template includes Japanese-only example content such as "記事タイトル", "背景", and "学び", which implicitly steers output to a specific language. The file does not state that the skill is Japan-specific or offer users a choice of language, so this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.