Security audit

Zilliz Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its Zilliz management purpose, but it needs review because it handles real cloud resources and includes unsafe credential and payment-card command examples.

Review this skill before installing it for production use. Use least-privilege Zilliz credentials, confirm every delete/drop/RBAC/billing action explicitly, avoid entering real passwords or card details directly in shell commands, and prefer a pinned or isolated zilliz-cli installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

Location: references/setup.md:6
Finding: Unpinned Automatic Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/user-role.md:9
Finding: Database Passwords Passed Directly Through Command-Line Arguments
Content: View full analysis
--password ``` ```bash #### Update Password zilliz user update-password \ --user \ --password \ --new-password ``` ### Technical Analysis The documented commands place current and new database passwords directly in the command-line argument vector. If users replace the placeholders with literal values, the credentials may be retained in shell history, terminal transcripts, command auditing systems, diagnostic logs, or automation logs. Depending on the operating system and process configuration, command arguments may also be observable through process-monitoring interfaces while the command is running. The general instruction not to expose credentials in chat does not mitigate disclosure through local command history or process arguments. Unlike the payment-card command, this reference also lacks a specific warning to run password operations only through a protected interactive mechanism. ### Attack Path 1. A user follows the documented example and substitutes a real current or new password into the command. 2. The shell records the command in its history, or local monitoring and terminal tooling captures the process arguments. 3. A local user, support process, telemetry collector, backup reader, or later account compromise obtains the recorded command. 4. The exposed password is used to authenticate as the affected Zilliz database user. 5. The attacker exercises every database or collection privilege assigned to that user until the password is rotated or access is revoked. ### Impact Assessment The attainable privileges are those assigned to the compromised Zilliz user. D ...[truncated 333 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/billing.md:47
Finding: Payment Card Data Passed Directly Through Command-Line Arguments
Content: View full analysis
\ --exp-month \ --exp-year \ --cvc ``` The file provides the following partial safeguard: ```text - The `bind-card` command handles sensitive card data -- always instruct the user to run it in their own terminal, never inside Claude Code. ``` ### Technical Analysis Although the Skill correctly prevents execution inside the agent environment, it still demonstrates supplying the card number and CVC as literal command-line arguments. Running the command in the user's terminal does not prevent the shell from saving it in history and does not prevent terminal logging, endpoint telemetry, process inspection, or command-auditing systems from capturing the values. Payment card numbers and verification codes are highly sensitive data. The terminal-only safeguard reduces disclosure to the agent but does not address the primary local exposure channels introduced by the command format. ### Attack Path 1. A user follows the example in a local terminal and substitutes real payment-card values. 2. The command is retained in shell history or captured by process, terminal, endpoint, or audit logging. 3. A party with access to the user's account, history files, backups, support bundles, or telemetry retrieves the card number, expiration information, and CVC. 4. The exposed payment information is used for attempted payment fraud or disclosed to additional unauthorized parties. ### Impact Assessment The issue may expose complete payment-card details, including the CVC. This can enable attempted unauthorized transactions and creates substantial confidentiality and compliance risk. It does n ...[truncated 136 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/setup.md:64
Finding: Persistent Plaintext API Key Recommended in Shell Profile
Content: View full analysis
``` ### Technical Analysis The Skill recommends adding a Zilliz API key to a persistent shell initialization file. Shell profiles are plaintext files that may be read by local processes operating under the same account and may be included in home-directory backups, configuration repositories, support archives, or accidental disclosures. Exporting the variable from a profile also causes every descendant process launched from the shell to inherit the API key, regardless of whether that process needs Zilliz access. This violates least-exposure principles and increases the number of processes from which the credential may be extracted. The separate instruction never to paste API keys into chat is appropriate but does not address persistent local storage or unnecessary process inheritance. ### Attack Path 1. A user places a real Zilliz API key in `.zshrc` or `.bashrc` as instructed. 2. The profile persists the key across future sessions and exports it to child processes. 3. An unrelated, compromised, or overly verbose child process reads or logs the environment, or an attacker later gains read access to the profile or its backups. 4. The attacker extracts `ZILLIZ_API_KEY`. 5. The key is used to invoke Zilliz APIs within the permissions and organizational scope assigned to that key. ### Impact Assessment The attacker can obtain the cloud and database privileges granted to the exposed API key. Depending on its scope, this may include reading or modifying collections, performing vector operations, managing databases, or accessing control-plane resources. The exact impact is constrained by the key's con ...[truncated 71 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises destructive actions such as deleting clusters, dropping collections/databases, and changing RBAC privileges without any adjacent warning, confirmation guidance, or note about production impact. In an agent skill context, this omission can normalize high-risk operations and increase the chance that an AI agent or user invokes irreversible or privilege-changing commands without sufficient caution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown includes a zilliz index drop command, which performs a destructive operation, but the surrounding documentation provides no warning about impact, reversibility, or need for caution. Under the markdown-specific warning rule, destructive actions affecting system integrity should be accompanied by a user-facing warning.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/setup.md (reported line 166)May include surrounding context.
md
- Always check prerequisites before executing any command. - If a prerequisite fails, fix it before proceeding — do not skip ahead. - NEVER run `zilliz login`, `zilliz configure`, or `zilliz auth switch` (without arguments) inside Claude Code — they require interactive input. Always instruct the user to run these in their own terminal. - NEVER ask the user to paste API keys into the chat — this is a security risk. Guide them to configure credentials in their own terminal instead. - After the user reports login is complete, verify with `zilliz auth status`. - After setting context, verify with `zilliz context current`. - For data-plane commands in other skills, always verify context is set first.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file documents zilliz vector delete as a normal reference command but does not include any warning that it removes data from the target collection. For markdown files, destructive behaviors that could affect user data should be accompanied by an explicit warning about impact or irreversibility.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.