Zhipu Tools Coding Plan

• Outcome: Review
• Latest audit: Jul 5, 2026 · 11:34 PM UTC
• Version: 3.2.0

Overview

This is a real Zhipu integration, but it needs Review because it can send local files or media to Zhipu and has inconsistent cost, fallback, and credential-scope disclosures.

Install only if you are comfortable sending searches, URLs, GitHub repo names, and any selected local documents, screenshots, images, or videos to Zhipu/Z.AI services. Do not use it on confidential files unless you explicitly intend to upload them, keep the Zhipu API key scoped, and be cautious with the shell wrappers because some documented paths can fall back to Legacy account-billed APIs despite the safer Python path saying it will not.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents direct use of shell commands, environment variables, and outbound network access but does not declare permissions or clearly scope those capabilities. That weakens sandboxing and user awareness, increasing the chance an agent invokes networked or credential-backed actions without appropriate policy enforcement.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation gives conflicting statements about whether vision and file parsing are free under Coding Plan or consume Legacy/account-billed usage. This can mislead an agent or user into triggering paid or differently scoped APIs under false assumptions, creating financial and trust risk.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The skill says it will not automatically fall back to Legacy, but elsewhere presents fallback priority that can be interpreted as switching to alternate tools when MCP is unavailable. Conflicting failure-handling guidance can cause unsafe autonomous behavior, especially where Legacy mode changes billing, data paths, or security assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script automatically reads and exports every key/value from a nearby .env file into the process environment before invoking downstream Python tooling. This grants the tool access to any colocated secrets beyond the stated API key and does so without user disclosure, increasing the risk of unintended credential exposure to child processes, logs, or future code paths.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script automatically loads arbitrary key-value pairs from local .env files into the process environment, which expands the trust boundary beyond the declared tool purpose. In a skill context, this can unintentionally ingest unrelated secrets or configuration and make them available to later code paths or future modifications, increasing the blast radius of compromise or misuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README advertises web search, web reading, repository search, and file parsing features but does not clearly warn that user-supplied URLs, search queries, repository identifiers, and possibly file contents are transmitted to third-party Zhipu services. In an agent-skill context, this can cause users or downstream agents to unknowingly send sensitive internal data to an external provider, creating privacy, confidentiality, and compliance risks.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The invocation mapping treats broad everyday phrases like 'search/check/look at' as triggers for tool execution. Overbroad activation rules can cause unintended network requests, repository access, or file/media submission without sufficient confirmation, especially when requests are ambiguous.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script transmits whatever local file path the user supplies to a third-party remote API using multipart upload, but it does not clearly warn the user at execution time that file contents will leave the local environment. In a coding/automation skill context, this can lead to accidental exfiltration of sensitive documents, credentials, source code, or internal data if users assume parsing happens locally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Loading all variables from a nearby .env file without warning creates hidden behavior that expands the script's access to local secrets and configuration unrelated to the advertised functionality. Because exported variables are inherited by child processes, this can expose credentials to the Python tool or any libraries it uses, even when users only expect search or reader operations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The vision command reads local image/video files, base64-encodes them, and uploads the full content to a remote API without an explicit runtime warning or confirmation. In an agent skill, users may assume local analysis, so this can cause unintended disclosure of sensitive screenshots, documents, or videos to a third party.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file parser command uploads arbitrary local files to a remote API and lacks an explicit execution-time notice or consent step. Because users may pass confidential documents for parsing, this creates a realistic risk of accidental external disclosure in the normal course of tool use.

External Transmission

Medium

• Category: Data Exfiltration

Content

"temperature": 0.7,
        }

        resp = requests.post(
            f"{cls.LEGACY_BASE}/chat/completions",
            headers=headers,
            json=body,

• Confidence: 93% confidence
• Finding: requests.post( f"{cls.LEGACY_BASE}/chat/completions", headers=headers, json=

Credential Access

High

• Category: Privilege Escalation

Content

def _load_dotenv():
    """自动加载脚本同目录或 SKILL 根目录下的 .env 文件"""
    script_dir = Path(__file__).resolve().parent
    skill_dir = script_dir.parent
    for env_path in [skill_dir / ".env", script_dir / ".env"]:

• Confidence: 88% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"""自动加载脚本同目录或 SKILL 根目录下的 .env 文件"""
    script_dir = Path(__file__).resolve().parent
    skill_dir = script_dir.parent
    for env_path in [skill_dir / ".env", script_dir / ".env"]:
        if env_path.exists():
            with open(env_path, encoding="utf-8") as f:
                for line in f:

• Confidence: 88% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

"""自动加载脚本同目录或 SKILL 根目录下的 .env 文件"""
    script_dir = Path(__file__).resolve().parent
    skill_dir = script_dir.parent
    for env_path in [skill_dir / ".env", script_dir / ".env"]:
        if env_path.exists():
            with open(env_path, encoding="utf-8") as f:
                for line in f:

• Confidence: 88% confidence
• Finding: .env"

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.