ZMT Matrix Browser

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.16

Overview

This is a small disclosed skill for controlling a browser-profile matrix tool, with a dependency-hygiene note but no evidence of hidden or malicious behavior.

Install in a virtual environment, prefer pinned dependency versions, and only connect it to browser accounts you intend the matrix tool to control because those profiles may contain active sessions, cookies, and account state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 24
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Requirements

- Python 3.8+
- Install: pip install requests pyyaml
- Matrix tool: https://zmt.scys6688.com/

Technical Analysis

The documented installation command installs requests and pyyaml without version constraints, integrity hashes, a lockfile, or an explicitly trusted package index. Consequently, dependency resolution is mutable and depends on the package index and configuration available when the command is run.

If a future package release or configured package index is compromised, the installation may retrieve unreviewed or malicious code. The absence of hashes also prevents pip from verifying that downloaded artifacts match versions reviewed by the project maintainers.

Attack Path

1. A user follows the installation instruction in SKILL.md.
2. pip resolves the latest matching distributions from the user's configured package index or mirror.
3. An attacker compromises a dependency release, package-index account, mirror, or dependency-resolution path.
4. The user downloads and installs the attacker-controlled distribution because no reviewed version or artifact hash is enforced.
5. Malicious package behavior can execute during installation or when the dependency is imported by downstream code.

This path is conditional on compromise or substitution within the dependency supply chain; the audited repository itself contains no malicious package implementation.

Impact Assessment

Malicious dependency code would ordinarily execute with the privileges of the user or service account running pip or importing the package. Potential impact includes access to that account's files, environment variables, application credentials, network access, and any browser-account data available to the consu ...[truncated 274 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to a reviewed version rather than resolving unrestricted latest releases.
2. Generate and commit a lockfile or requirements file containing transitive dependency versions.
3. Require cryptographic hashes, for example through a hash-locked requirements file and pip install --require-hashes.
4. Explicitly configure a trusted package index and avoid untrusted or ambiguously configured mirrors.
5. Use automated dependency scanning and update pinned versions through a controlled review process.
6. Perform installation in an isolated virtual environment under a non-privileged account.
7. Replace the current instruction with a reproducible command referencing the reviewed dependency file, such as:

bash

python -m pip install --require-hashes -r requirements.txt

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.