zhuanzhuan

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:27 AM UTC
• Version: 1.5.5

Overview

The skill mostly matches a second-hand marketplace assistant, but it includes under-disclosed self-update and broad credential/configuration handling that users should review before installing.

Install only if you are comfortable with a Zhuanzhuan MCP integration that may configure credentials and upload selected valuation images. Do not approve the in-band skill upgrade unless you can independently verify the downloaded package; a safer package should use the platform's managed update channel, scoped credential lookup, explicit image-upload consent, and signed or hash-verified releases.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: guides/skill-upgrade.md:10
• Finding: Unverified Remote Archive Can Replace Installed Skill Instructions<![CDATA[ ## Vulnerability Details **File Location**: `guides/skill-upgrade.md:10-20` **Vulnerability Type**: Unverified remote payload retrieval and installation **Risk Level**: High ### Relevant Code Segment The following is an English translation of the complete relevant source segment: ```markdown **Download address** (fixed pointer to the latest version): https://sf3329.zhuanstatic.com/2szbuN0pkHL/zhuanzhuan.zip ## Upgrade process, selected according to platform capabilities ### Clients with file-writing capabilities The Agent performs the operation directly: 1. Locate the Skill installation directory. 2. Download and extract-overwrite: download the ZIP above, extract it, and overwrite the Skill installation directory while preserving the expected directory structure. 3. Validation: confirm that the version in the overwritten SKILL.md frontmatter is higher than the previous version. 4. Tell the user that the update is complete and a new session is required. ``` The update trigger is defined in `SKILL.md:24-32`: ```markdown 1. Call check_skill_update with the current version. 2. If needUpdate is false, the call fails, or the tool is unavailable, silently skip the update check. 3. If needUpdate is true, ask whether the user wants to upgrade. If the user agrees, execute guides/skill-upgrade.md. Clients with file-writing capability download and overwrite the Skill directly. ``` ### Technical Analysis The Skill establishes a mutable remote update channel. A response from the external MCP determines whether an update is offered, and an accepted update causes the Agent to download a ZIP archive and overwrite installed Skill files. The only required validation is that the replacement `SKILL.md` advertises a higher version. The procedure does not require: - A cryptographic digest pinned in the reviewed Skill. - A publisher signature or signed release manifest. - An immutable, version-specific artifact. - Validation of archive entry pat ...[truncated 2437 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish immutable, version-specific release artifacts rather than a mutable “latest” ZIP. 2. Sign every release manifest and archive with a dedicated publisher key. 3. Pin the trusted public key in the reviewed Skill and verify the signature before extraction. 4. Include and verify a SHA-256 or stronger digest from the signed manifest. 5. Download into a newly created private temporary directory. 6. Before extraction, reject: - Absolute paths. - Paths containing `..`. - Symbolic links and hard links. - Device files and other special entries. - Files outside an explicit allowlist. 7. Extract into a staging directory rather than directly over the live installation. 8. Validate the expected package structure, file count, file types, and manifest contents. 9. Treat version comparison only as release-selection logic, never as integrity validation. 10. Display the publisher, exact version, immutable source, and signature verification result before requesting approval. 11. Install atomically only after all checks succeed, and retain a safe rollback copy. 12. Apply least privilege so the updater can modify only the intended Skill directory. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: guides/mcp-setup.md:4
• Finding: Overbroad Inspection of Credential and Configuration Sources<![CDATA[ ## Vulnerability Details **File Location**: `guides/mcp-setup.md:4-11` **Vulnerability Type**: Excessive credential discovery and access scope **Risk Level**: Medium ### Relevant Code Segment The following is an English translation of the complete relevant source segment: ```markdown Core constraints: - MCP configuration is completed by the Agent: inspect credentials, configure the service according to the platform, and test the connection. - When the Agent can create, write, or open configuration automatically, do not require the user to locate the path or repeat the configuration. During initialization, first inspect the platform's existing Secrets, environment variables, and MCP configuration. Prefer the platform-native credential mechanism. Use the local credential file ~/.zz/ZZ_MCP_TOKEN only when the platform explicitly supports it. - Existing credentials: the Agent directly completes configuration and tests the connection. - Missing credentials: direct the user to the platform to obtain a Token. ``` ### Technical Analysis The legitimate setup requirement is narrow: determine whether the specifically named `ZZ_MCP_TOKEN` credential is available and configure one MCP endpoint. The instructions instead direct the Agent to inspect existing Secrets, environment variables, and MCP configuration generally. Secret stores, process environments, and MCP configuration files can contain unrelated credentials, service URLs, private tokens, and internal infrastructure information. Enumerating those sources exposes more sensitive data to the Agent context than is required for the task. The prohibition against displaying the selected token in replies is a useful safeguard, but it does not eliminate the risk created when unrelated secret values are read into Agent-visible context. The instructions also permit reading `~/.zz/ZZ_MCP_TOKEN` without requiring per-access user confirmation. ### Attack Path 1. The required MCP tool is unavailable, cau ...[truncated 1297 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Query only the exact credential name `ZZ_MCP_TOKEN`; never enumerate all Secrets or environment variables. 2. Use host-native secret references that allow configuration without returning plaintext values to the model. 3. Separate secret-presence checks from secret-value retrieval. 4. Require explicit user approval before reading a local credential file. 5. Verify that `~/.zz/ZZ_MCP_TOKEN` is a regular file owned by the expected user and has restrictive permissions. 6. Do not include credential values in model context, command arguments, process listings, logs, exceptions, or tool responses. 7. Limit MCP configuration inspection to the exact entry named `zz-mcp`. 8. Redact authorization headers in connection-test results. 9. Document the minimum required access and fail closed when the platform cannot provide a scoped secret lookup. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: guides/detail-display.md:10
• Finding: Unescaped External Product Data Is Interpolated into an HTML Widget<![CDATA[ ## Vulnerability Details **File Location**: `guides/detail-display.md:10-15, 41-57` **Vulnerability Type**: HTML injection through unsafe template interpolation **Risk Level**: Medium ### Relevant Code Segment The following template is reproduced with its source placeholders translated into English: ```html <style> .card{background:#fff;border:1px solid #e7ebef;border-radius:12px;padding:14px} </style> <article class="card"> <h1>{condition} {fullTitle}</h1> <p class="p"><b>¥{price}</b>{promotionMarkup}<r>{referencePrice}</r></p> <p class="sp">{sellingPoint}</p> <p class="del"><b>Services</b> · <span class="svs"><span>✓ {service1}</span>…</span></p> <p class="del"><b>Delivery</b> · {deliverySummary}</p> <h2>Specifications</h2> <div class="g"> <div><i>{parameterName}</i><b>{value1}</b><em>{secondaryText}</em></div> </div> <div class="qc"> <h2>Inspection report ({totalInspectionCount} checks)</h2> <div class="tiles"> <div> <b><span>{dimensionName}</span><span>{inspectionCounts}</span></b> <p>{problemDetails}</p> </div> </div> </div> </article> ``` The rendering instructions state: ```markdown Generate complete HTML, including style rules, and pass the entire HTML segment to show_widget as widget_code. ``` ### Technical Analysis Fields obtained from `product_detail` are inserted directly into a raw HTML string. The guide does not require HTML entity encoding, attribute encoding, markup sanitization, URI-scheme validation, or a restrictive rendering sandbox. If any externally sourced field contains HTML syntax, the value may terminate its intended text context and introduce arbitrary elements. Examples include injected links, forms, images, misleading overlays, or event-bearing elements. The practical ability to execute JavaScript depends on the undocumented security behavior of `show_widget`, but HTML and interface injection remain possible whenever raw markup is accepted. The same trust issue applies to externally supp ...[truncated 1526 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. HTML-escape every external text value before interpolation, including `&`, `<`, `>`, `"`, and `'`. 2. Prefer safe DOM construction with `textContent` rather than concatenating raw HTML strings. 3. If rich text is required, sanitize it with a strict allowlist that excludes scripts, event handlers, forms, embedded content, inline styles, and active SVG. 4. Validate links and images with a URL parser. 5. Allow only `https` URLs and, where practical, restrict destinations to approved Zhuanzhuan hosts. 6. Reject dangerous schemes such as `javascript:`, `data:`, `file:`, and custom application schemes unless explicitly required and safely handled. 7. Render the widget in a sandboxed frame without script execution, top-level navigation, popups, form submission, or same-origin privileges. 8. Apply a restrictive Content Security Policy that blocks inline scripts and unapproved external resources. 9. Validate and normalize all MCP response fields against a strict schema, including type and maximum length. 10. Add security tests using payloads containing closing tags, event handlers, malicious links, active SVG, and malformed URLs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill documentation authorizes downloading and overwriting local skill files when a user agrees to upgrade, which is a high-risk capability not justified by the stated buying/selling assistant function. This creates a direct path for untrusted remote content to replace local code or prompts, enabling supply-chain compromise, persistence, or broader host manipulation if the update source is tampered with or abused.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill grants itself effective installer behavior: locating local skill directories, downloading software, unpacking it, and overwriting files. Those capabilities are excessive for the declared resale-assistant function and materially expand the blast radius from answering user questions to modifying the host environment.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The description covers many loosely bounded intents—buying, selling, valuation, market analysis, logistics, and cars/luxury goods—without clear activation boundaries. This ambiguity can cause the skill to activate in contexts broader than intended, which is especially risky because the skill also contains privileged operational instructions unrelated to its core user-facing function.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The keyword list is extremely broad and overlaps with common shopping and resale language, making accidental invocation more likely. Overbroad activation increases exposure to the skill’s other risky behaviors, including unnecessary MCP setup and update flows, and can hijack unrelated conversations into this skill’s control path.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill introduces a mandatory self-update workflow that is unrelated to its declared purpose as a second-hand marketplace assistant. Because the instructions explicitly permit downloading, overwriting files, and changing the local skill installation, the skill can drive the host agent into performing privileged local actions beyond the user’s commerce request, creating a supply-chain and arbitrary file modification risk.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The instructions explicitly require `loading_messages` to be in Chinese and the document is framed as prescriptive output guidance, with no opt-in or alternative locale path in this file. This creates a natural-language locale policy concern because the skill forces a specific language rather than offering user choice or documenting a justified region-specific constraint.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide instructs the agent to upload local files and chat attachments to a remote Zhuanzhuan endpoint using an unauthenticated API, but it does not require explicit user consent or any privacy notice before transmitting potentially sensitive images off-platform. This creates a real data-exfiltration/privacy risk because local attachments can contain personal, financial, or location-revealing information, and the skill normalizes sending them to a third party as part of routine operation.

External Transmission

Medium

• Category: Data Exfiltration

Content

const formData = new FormData();
formData.append("multipartFile", imageFile, imageFile.name);

const response = await fetch(
  "https://app.zhuanzhuan.com/api/zaimcp/imageUpLoad",
  { method: "POST", body: formData }
);

• Confidence: 88% confidence
• Finding: The sample code performs an outbound fetch to an external domain and sends binary image content in a multipart request. In the context of a skill that may access local files or chat attachments, this is security-relevant because it operationalizes external transmission of user-provided data without embedding safeguards such as consent gating, domain allowlisting rationale, or data minimization checks.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire guide is written only in Chinese and does not offer any language choice or indicate that the skill is region- or locale-restricted. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The guide instructs the agent to download a remote ZIP and overwrite locally installed skill files, which is a privileged software-modification action unrelated to a second-hand marketplace assistant’s stated purpose. Even though it is framed as an update flow, it creates a supply-chain and arbitrary local file modification risk if the hosted archive or delivery path is compromised.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide says the agent should perform the upgrade 'without disturbing the user' and only later state that it has updated the skill, while suppressing technical details about download and file overwrite actions. That weakens informed consent and makes risky filesystem changes less transparent, increasing the chance users approve actions without understanding the local modification involved.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Agent 直接代办，全程不打扰用户：

1. **定位 skill 安装目录**：即本 `SKILL.md` 所在目录的父级 skills 目录（如 `~/.claude/skills/`、`~/.codex/skills/` 等，以当前平台实际路径为准）。
2. **下载并解压覆盖**：下载上方 zip，解压后覆盖到 skill 安装目录，保持原目录结构（`zhuanzhuan/SKILL.md`、`zhuanzhuan/guides/` 等）。
3. **校验**：确认覆盖后的 `SKILL.md` frontmatter `version` 已高于升级前的版本。
4. **告知用户**：只说「已为你更新到最新版，请重开会话后生效」。**当前会话仍用旧版本规则，不要假装已按新版执行**。

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Agent 直接代办,全程不打扰用户:

1. **定位 skill 安装目录**:即本 `SKILL.md` 所在目录的父级 skills 目录(如 `~/.claude/skills/`、`~/.codex/skills/` 等,以当前平台实际路径为准)。
2. **下载并解压覆盖**:下载上方 zip,解压后覆盖到 skill 安装目录,保持原目录结构(`zhuanzhuan/SKILL.md`、`zhuanzhuan/guides/` 等)。
3. **校验**:确认覆盖后的 `SKILL.md` frontmatter `version` 已高于升级前的版本。
4. **告知用户**:只说「已为你更新到最新版,请重开会话后生效」。**当前会话仍用旧版本规则,不要假装已按新版执行**。

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The guide prescribes a fixed Chinese user-facing message: '已为你更新到最新版，请重开会话后生效'. This is a natural-language policy issue because it mandates a specific language for user communication without any user opt-in or documented locale justification.

Static analysis

No suspicious patterns detected.