ZeeLin-report-publisher

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:24 AM UTC
• Version: 0.1.1

Overview

The skill is a mostly coherent report publisher, but it also performs persistent GitHub and SSH account setup and has a path-boundary bug that can write outside the target repository.

Install only if you are comfortable with an agent publishing to GitHub and changing persistent local/account state. Prefer running bootstrap with --skip-ssh and --skip-gh-login unless you intentionally want it to manage GitHub authentication, review --config-path carefully, use --dry-run first, and confirm the target repo/remotes before allowing push or PR creation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish_report.py:376

Finding

Repository Path Escape Allows Modification of Files Outside the Target Repository

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/bootstrap_github.sh:117

Finding

Bootstrap Performs Account-Wide Git and SSH Credential Provisioning by Default

Content

View full analysis

" ``` Unless the caller explicitly supplies `--skip-ssh`, it creates a default, unencrypted SSH identity and may upload its public key to the authenticated GitHub account: ```bash if [[ $SKIP_SSH -eq 0 ]]; then need_cmd ssh need_cmd ssh-keygen KEY_PATH="${HOME}/.ssh/id_ed25519" PUB_PATH="${KEY_PATH}.pub" if [[ ! -f "$KEY_PATH" ]]; then info "Generating SSH key: $KEY_PATH" mkdir -p "${HOME}/.ssh" chmod 700 "${HOME}/.ssh" ssh-keygen -t ed25519 -C "$GIT_EMAIL" -f "$KEY_PATH" -N "" else info "Existing SSH key found: $KEY_PATH" fi if [[ ! -f "$PUB_PATH" ]]; then die "Missing SSH public key: $PUB_PATH" fi if [[ $HAS_GH -eq 1 && $GH_AUTH_OK -eq 1 ]]; then PUB_KEY="$(cat "$PUB_PATH")" REMOTE_KEYS="$(gh api user/keys --jq '.[].key' 2>/dev/null || true)" if grep -Fxq "$PUB_KEY" <<< "$REMOTE_KEYS"; then info "SSH key already uploaded to GitHub." else KEY_TITLE="$(hostname)-$(date +%F)" info "Uploading SSH key to GitHub as: $KEY_TITLE" gh ssh-key add "$PUB_PATH" --title "$KEY_TITLE" fi else warn "Skip SSH key upload because gh is unavailable or unauthenticated." fi fi ``` ### Technical Analysis The declared workflow requires enough authorization to push a feature branch and create a pull request. It does not inherently require: - Replacing the user's global Git identity. - Creating the user's default SSH identity. - Creating a private key without a passphrase. - Registering that identity across the authenticated GitHub ...[truncated 2674 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is report publishing, but the documented workflow also performs global git identity changes, GitHub authentication, SSH key generation/upload, cloning, and remote configuration. This mismatch hides materially more sensitive behavior than users would reasonably expect, which can lead to credential changes, account linkage, or repository access modifications under the guise of a content-publishing task.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Referencing the user’s default ~/.ssh/id_ed25519 path is not inherently malicious, but in this script it is part of a workflow that creates, reads, and uploads authentication material tied to the user’s GitHub account. In a report-publishing skill, touching long-lived personal SSH credentials is overly invasive and increases the risk of unintended credential exposure, misuse, or account modification.

Content

Scanner excerpt · scripts/bootstrap_github.sh (reported line 150)May include surrounding context.

sh

if [[ $SKIP_SSH -eq 0 ]]; then
  need_cmd ssh
  need_cmd ssh-keygen
  KEY_PATH="${HOME}/.ssh/id_ed25519"
  PUB_PATH="${KEY_PATH}.pub"

  if [[ ! -f "$KEY_PATH" ]]; then

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands that can read/write files, access the network, and mutate git state, but it does not declare any explicit tool scope or permission boundaries. That makes the effective authority of the skill opaque to users and reviewers, increasing the chance of over-privileged execution or accidental sensitive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The bootstrap instructions trigger sensitive account and credential operations, including git identity setup, GitHub auth, SSH key upload, and permission validation, without an explicit warning that user account state will be changed. In context, this is more dangerous because the skill is framed as a report publisher, so users may not anticipate persistent auth or SSH modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The publish workflow copies files, edits repository configuration, creates branches, commits, pushes remotely, and may open a PR, but it does not present an explicit safety warning about local mutations and outbound network actions. That can cause unreviewed changes to be written and transmitted to remotes before the user fully understands the side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction 'Use one sentence in Chinese' imposes a specific language requirement. The file does not offer the user a language choice or explain why Chinese is mandatory for policy or region-specific reasons.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script’s documented behavior includes global Git identity configuration, GitHub CLI authentication, SSH key generation/upload, and remote permission probing, which materially exceed the narrow report-publishing purpose in the skill metadata. In an agent skill context, these account-level changes expand the trust boundary and can modify a user’s global development environment and GitHub access in ways unrelated to publishing a report.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section generates an SSH key under the user’s home directory, attempts GitHub CLI login, enumerates existing account keys, and uploads a new SSH key to the user’s GitHub account. Those are sensitive credential-management operations with persistent account impact, and they are not necessary for merely copying report assets or updating a config file, making them especially risky in an automation skill.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap_github.sh (reported line 156)May include surrounding context.

sh

if [[ ! -f "$KEY_PATH" ]]; then
    info "Generating SSH key: $KEY_PATH"
    mkdir -p "${HOME}/.ssh"
    chmod 700 "${HOME}/.ssh"
    ssh-keygen -t ed25519 -C "$GIT_EMAIL" -f "$KEY_PATH" -N ""
  else
    info "Existing SSH key found: $KEY_PATH"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish_report.py (reported line 35)May include surrounding context.

python

def run_cmd(cmd: list[str], cwd: Path, check: bool = True) -> subprocess.CompletedProcess[str]:
    result = subprocess.run(
        cmd,
        cwd=str(cwd),
        text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default abstract is hard-coded in Chinese, and the CLI description also targets a Chinese-language site, but the script does not offer any language selection or explicit opt-in for generated content language. This can violate language/locale policy when users expect locale-neutral behavior or need a different language.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The usage text frames cloning and verification as optional helper actions, but the script is fundamentally a GitHub environment bootstrap tool that alters global identity, SSH state, and account authentication. In a security review, this kind of scope mismatch is dangerous because it can mislead operators into authorizing broader system and account changes than the skill description suggests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.