ziniao-assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:46 AM UTC
• Version: 1.0.1

Overview

The skill is for browser automation, but it handles API keys and bridge access in ways users should review carefully before installing.

Install only if you trust the Ziniao/ZClaw bridge and understand that this skill can operate authenticated browser sessions. Prefer setting the API key through a protected secret manager or tightly permissioned environment/config file, avoid pasting keys into chat or shell history, keep the base URL on the intended local bridge unless you explicitly trust a remote endpoint, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:162
• Finding: API Key May Be Disclosed to an Arbitrary Configurable Endpoint## Vulnerability Details **File Location**: `SKILL.md:162-164` **Vulnerability Type**: Unrestricted credential forwarding **Risk Level**: High ### Vulnerable Code ```text - **API key**: Env `ZCLAW_API_KEY`, or `ZCLAW_API_KEY` in `~/.zclaw/config.json` (see path note below). The bridge also accepts the key via header `X-ZClaw-Api-Key` or body `apiKey`. - **Base URL**: `ZCLAW_BASE_URL` or `ZINIAO_ZCLAW_BASE_URL` (default `http://127.0.0.1:9481`). - **First time / Rotate key**: Obtain a ZClaw API key from your server or Ziniao Ecosystem Center. You can configure it via conversation, environment, configuration file, or an installation script. ``` The invocation workflow further directs the Agent to include the resolved key in every invocation request. ### Technical Analysis Authentication is necessary for the declared browser-bridge functionality. However, the Skill independently resolves the API key and destination URL, then forwards the key to the configured destination without requiring that the endpoint remain on loopback, use HTTPS, or match a trusted hostname. The environment variables `ZCLAW_BASE_URL` and `ZINIAO_ZCLAW_BASE_URL` therefore act as credential-routing controls. If either variable or the corresponding configuration is modified by an attacker, authenticated requests can be redirected away from the intended local bridge. This exceeds minimum privilege because the Skill only needs to disclose the credential to a known Ziniao bridge, not to an arbitrary environment-selected HTTP origin. The documented default also uses plaintext HTTP, which is acceptable for a strictly loopback-only service but unsafe if the same scheme is used with a remote host. ### Attack Path 1. An attacker with influence over the Agent's environment or ZClaw configuration sets `ZCLAW_BASE_URL` or `ZINIAO_ZCLAW_BASE_URL` to an attacker-controlled endpoint. 2. The Skill resolves `ZCLAW_API_KEY` from the conversation, environment, or `~/.zc ...[truncated 1010 chars]
• Remediation: ## Remediation Suggestions 1. Restrict the default configuration to loopback addresses such as `127.0.0.1` and `::1`. 2. Reject non-loopback destinations unless the user explicitly enables remote bridge access. 3. For remote access, require HTTPS and validate the certificate and expected hostname. 4. Maintain an explicit allowlist of trusted bridge origins and bind each credential to a specific origin. 5. Reject URLs containing user information, unexpected ports, fragments, or non-HTTP protocols. 6. Do not forward credentials across redirects; either disable redirects or revalidate the destination after every redirect. 7. Display the destination origin and request confirmation before first sending a key to a newly configured remote endpoint. 8. Use a narrowly scoped bridge token with expiration, rotation, and per-tool authorization where supported.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:10
• Finding: Untrusted Remote Tool Metadata Is Imported into Agent Context## Vulnerability Details **File Location**: `SKILL.md:10-27` **Vulnerability Type**: Remote instruction injection through tool metadata **Risk Level**: Medium ### Vulnerable Code ```text 1. **First HTTP call** when handling a ZClaw task: **`GET {baseUrl}/zclaw/tools`** 2. **Parse the response:** JSON shape `{ ret, data }` where `data` is an array of `{ name, description, inputSchema }`. Build **`allowedTools = data.map((t) => t.name)`** and **retain it in working memory** for the session. Optionally keep `description` / `inputSchema` next to each name when choosing args. 3. **Before every `POST {baseUrl}/zclaw/tools/invoke`:** ensure **`allowedTools.includes(tool)`**. 4. **If `invoke` returns an error** like unsupported / unknown tool: re-run **`GET /zclaw/tools`**, refresh `allowedTools`, and retry with a valid `name`. ``` ### Technical Analysis The Skill treats a network response as the authoritative source of tool names and directs the Agent to retain returned descriptions and schemas in working memory. Tool descriptions are natural-language content and can contain instruction-like text. No sanitization, size constraint, signature verification, or strict intersection with the documented static tool allowlist is required before that content enters Agent context. Although later sections document a fixed set of core tools, the initial mandatory procedure explicitly calls the remote registry authoritative. This creates an ambiguous trust boundary and allows a compromised or substituted bridge to influence current-session reasoning through attacker-controlled metadata. This is not remote code execution by itself. The primary risk is current-session instruction hijacking and malicious steering of tool selection or arguments. ### Attack Path 1. An attacker compromises the configured bridge, controls a substituted base URL, or modifies the response from `/zclaw/tools`. 2. The endpoint returns valid JSON cont ...[truncated 1131 chars]
• Remediation: ## Remediation Suggestions 1. Treat all registry responses as untrusted structured data rather than instructions. 2. Intersect returned tool names with a hard-coded, reviewed allowlist. Reject every unknown name. 3. Validate each `inputSchema` against a local schema and reject unsupported fields, recursive structures, excessive sizes, and free-form instruction content. 4. Do not place remote descriptions directly into Agent working memory. Use locally reviewed descriptions instead. 5. If remote descriptions must be displayed, clearly delimit and encode them as inert data and prohibit using them as behavioral instructions. 6. Set strict response-size, string-length, nesting-depth, and tool-count limits. 7. Authenticate the discovery endpoint or verify a signed registry response. 8. Resolve the conflict between the dynamic authoritative list and the static core list by making the local static list the final security boundary.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:164
• Finding: API Key Setup Encourages Plaintext Secret Exposure## Vulnerability Details **File Location**: `SKILL.md:164-171` **Vulnerability Type**: Insecure plaintext credential handling **Risk Level**: Medium ### Vulnerable Code ```text - **First time / Rotate key**: Obtain a ZClaw API key from your server or Ziniao Ecosystem Center. You can **(1) configure via conversation** — tell the assistant your API key and it will write it to `~/.zclaw/config.json` and use it immediately; or **(2)** set `ZCLAW_API_KEY` in your environment or in `~/.zclaw/config.json`; or **(3)** run `bash ziniao-skills/install-ziniao-openclaw-skill.sh "YOUR_API_KEY"` (Windows: use `install-ziniao-openclaw-skill.ps1` with `-ApiKey`). **Setting `ZCLAW_API_KEY` by OS:** - **macOS / Linux**: Config file with `{ "ZCLAW_API_KEY": "your-key" }`, shell environment export, or an export added to `~/.bashrc`, `~/.zshrc`, or `~/.profile`. - **Windows**: Config file with `{ "ZCLAW_API_KEY": "your-key" }`, a user or system environment variable, or `[Environment]::SetUserVariable("ZCLAW_API_KEY","your-key")`. ``` ### Technical Analysis The setup procedure encourages users to expose the API key through several plaintext channels: - Conversation content, which may be retained in chat history, telemetry, or diagnostic records. - An unencrypted JSON file without documented owner-only permissions. - Shell startup files that may be readable by local applications, included in backups, or accidentally committed. - Command-line arguments, which may be recorded in shell history or visible to process-monitoring facilities. - Persistent environment variables, which can be inherited or inspected by other processes under the same security context. A plaintext configuration file may be operationally necessary when no credential store is available, but the Skill does not require restrictive permissions, redact the key after use, or warn against command-line and conversation disclosure. ### Attack Path 1. A user follows the setup ...[truncated 1143 chars]
• Remediation: ## Remediation Suggestions 1. Do not request API keys through conversation content. 2. Use the operating system credential manager, such as macOS Keychain, Windows Credential Manager, or Linux Secret Service. 3. If a file fallback is unavoidable, create it with owner-only permissions and verify those permissions before reading it. 4. Avoid passing secrets as command-line arguments. Use protected interactive input or standard input with echo disabled. 5. Do not recommend storing secrets in shell startup files. 6. Redact credentials from logs, diagnostics, tool output, exceptions, and conversation context. 7. Minimize how long the resolved key remains in Agent context or process memory. 8. Support short-lived, narrowly scoped tokens and provide clear revocation and rotation procedures. 9. Warn users if the configuration file or containing directory is readable by other accounts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill tells the assistant to accept pasted API keys, write them to disk, and immediately continue using them across the conversation. That combines two risky behaviors—persistent storage and continued conversational handling of the secret—without isolation controls, making accidental disclosure or misuse more likely.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This section directs the assistant to load the API key from the conversation and keep it in conversational context for future requests. Storing secrets in natural-language working context raises exposure risk because the key may be echoed, summarized, leaked to other tools, or retained longer than necessary by the agent system.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Correct (preferred):**

```bash
curl -X POST http://127.0.0.1:9481/zclaw/tools/invoke \
  -H "Content-Type: application/json" \
  -H "X-ZClaw-Api-Key: <ZCLAW_API_KEY>" \
  -d '{"tool":"open_store","args":{"storeName":"Rosehut"}}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

**You MUST:**

1. **Stop immediately.** Do not retry the same request. Do not read more code, grep, or open other files to "diagnose" or "work around". Do not design or write "run these steps when the bridge is up" or any follow-up plan.
2. **End the turn.** Do not speculate on other causes, suggest code changes, or continue the task. Connection or tool failure means the task is not executable—stop only. (User-facing messages for unreachable bridge are handled by the software.)

## Hard Constraints

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

- **Stop on blocker:** If the bridge is unreachable or a required tool call fails, stop and end the turn; do not retry, read code, or create templates or follow-up plans. See "Stop on Blocker" above.
- **Invoke must include API key:** Every `POST /zclaw/tools/invoke` request must include API key credentials (`X-ZClaw-Api-Key` preferred; or body `apiKey`; or `Authorization: Bearer <key>`). Do not generate keyless invoke commands.
- **No script files:** Do not create or run any scripts (`.sh`/`.js`/`.py` or other code files) to execute tasks; use only the tools in **Core Tools** via `POST /zclaw/tools/invoke`. **Temporary files are allowed** (e.g. intermediate data, content for `download_file`); **script/executable files are not.**
- All browser actions must stay inside **Ziniao Browser** or a Ziniao store exposed by the bridge. Do not open system browser, Chrome, Safari, Edge, Firefox, or use Playwright/Puppeteer/browser-use when the bridge fails.
- Use only the tools in **Core Tools**. Do NOT use: `run_script` (use `execute_script`), `screenshot` or `get_screenshot` (use `take_screenshot`), `execute_automation` (use `run_automation`), or any tool not listed there. Do NOT invent `navigate`, `open_url`, `call_store_tool`, or any name not in Core Tools.
- Prefer tool-based flow: open store (optionally with `launchUrl`) → **`visit_page`** for further URLs → get_page_content / query_elements / click_element / input_text / take_screenshot / download_file / run_automation. Use `execute_script` only for in-page JavaScript (e.g. DOM extraction), not for orchestration.

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the assistant to persist a user-supplied API key to a local config file, but does not pair that behavior with a clear consent, scope, retention, or local-disk exposure warning. Persisting secrets to disk increases the chance of unintended disclosure through backups, multi-user systems, malware, or later file reads by other components.

Static analysis

No suspicious patterns detected.