Security audit

ZenStudio CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ZenStudio command-line integration, but users should handle its API token and remote write commands carefully.

Install only if you trust the ZenStudio npm package and need this platform integration. Use interactive login or a protected secret mechanism instead of putting the API key directly in a command, keep the config file private, and confirm project, asset, material, and canvas IDs before running write, delete, overwrite, upload, download, or generic tools-call commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:40
Finding: Unverified Global npm Package Installation and Self-Update
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:44
Finding: Bearer Token Exposed Through Command-Line Arguments
Content: View full analysis
``` ### Technical Analysis The Skill recommends supplying the ZenStudio bearer token directly as a command-line argument. Command arguments are not an appropriate secret transport mechanism because they may be retained or exposed through: - Shell history files - Process-list and process-inspection interfaces - Terminal session recording - CI/CD logs - Agent execution logs and telemetry - Debugging and operating-system audit facilities Access to process arguments depends on the operating system and local permissions, but shell history and automation logs can preserve the token long after the process exits. Because the value is a bearer token, possession may be sufficient to authenticate without additional proof of identity. ### Attack Path 1. A user follows the documented authentication example and places the API key after `--token`. 2. The shell, process-monitoring system, CI runner, terminal recorder, or agent telemetry captures the complete command. 3. Another local user, administrator, log reader, or attacker with access to the captured records retrieves the token. 4. The attacker uses the token to authenticate to the configured ZenStudio endpoint. 5. The attacker performs operations allowed by the API key until the credential expires or is revoked. ### Impact Assessment The attacker could obtain the API privileges assigned to the exposed token. Depending on its server-side scope, this may include access to projects, generated content, media assets, materials, canvases, uploads, downloads, and generation tasks. This issue does not directly grant operating-system privilege escalation. Its scope is primarily the affected API account and any local or remote resources authorized by the beare ...[truncated 93 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill advertises upload/download, project management, asset management, and live canvas mutation capabilities, including overwrite behavior and immediate visibility to other users, but does not prominently require explicit user confirmation before modifying remote resources. In an agent setting, this raises the risk of unintended writes, overwrites, or disclosure of remote user data if the model acts on ambiguous prompts or defaults to destructive operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The natural-language content of the skill, including the primary description and most operational guidance, is predominantly in Chinese, and the file does not offer any language/locale choice or explain that the skill is intentionally restricted to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in can be a locale policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.