Zyt credentials guard

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 0.5.0

Overview

This documentation-only skill is coherent, but it asks agents to handle long-lived Chanjing credentials in a predictable plaintext file without enough access-control guidance.

Review before installing. Use this only if you are comfortable with a local plaintext Chanjing credential file, create the directory and credentials file with restrictive permissions, keep it out of backups/repos/chat, and rotate Chanjing keys if the file or chat history may have exposed them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:36

Finding

Credential File Is Stored Without Mandatory Access-Control Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-48
Vulnerability Type: Plaintext sensitive-data storage with unspecified file permissions
Risk Level: Medium

Vulnerable Code Snippet

markdown

## Credential Storage

AK/SK and Token are read from the same local config file.

- **Path**: `~/.chanjing/credentials.json` (overridable by env `CHANJING_CONFIG_DIR`)
- **Format**:
```json
{
  "app_id": "Your Access Key",
  "secret_key": "Your Secret Key",
  "access_token": "Optional, auto-generated",
  "expire_in": 1721289220
}

text

Related instructions at `SKILL.md:97-103` direct users to populate and subsequently reopen this file:

```markdown
3. **Ask user to configure local file** `~/.chanjing/credentials.json` (or `$CHANJING_CONFIG_DIR/credentials.json`) with `app_id` and `secret_key`.
4. **Secret handling rule**:
   - Do not ask user to paste AK/SK in chat.
   - If user shares secret in chat anyway, remind them to rotate keys and continue with local-command-only flow.
5. **After setting**:
   - Re-open the local file to confirm non-empty `app_id` and `secret_key`.
   - Then proceed to target Chanjing action.

Technical Analysis

The Skill directs users or an implementing agent to store a long-lived Chanjing Secret Key and an access token in a plaintext JSON file. This storage is consistent with the Skill's declared credential-management purpose, but the instructions do not require the containing directory or file to have restrictive permissions.

The resulting permissions depend on the user's umask, the editor or command used to create the file, and whether the path already exists. A permissive configuration could make the credential file readable by other local users or processes. The instructions also do not require ownership validation, symbolic-link rejection, or atomic replacement when updating the token. Consequently, an attacker with local filesystem acce ...[truncated 1912 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the credential directory to be owned by the current user and have mode 0700.

2. Require credentials.json to be a regular file owned by the current user with mode 0600.

3. Provide safe local setup commands that use a restrictive umask, for example:

   sh

   umask 077
   mkdir -p "${CHANJING_CONFIG_DIR:-$HOME/.chanjing}"
   chmod 700 "${CHANJING_CONFIG_DIR:-$HOME/.chanjing}"
   

4. Before every read or write, reject symbolic links, unexpected file types, incorrect ownership, and paths outside the intended configuration directory.

5. Write refreshed tokens to a securely created temporary file in the same directory, set mode 0600, flush it, and atomically rename it over the credential file.

6. Avoid logging the request body, Secret Key, or access token. Ensure errors and summaries redact all credential values.

7. Prefer an operating-system credential store or secret manager for the Secret Key where supported. If JSON compatibility is required, retain only the minimum necessary fields.

8. Document credential rotation and revocation procedures for cases where unsafe permissions or accidental disclosure are detected.

9. Validate that CHANJING_CONFIG_DIR resolves to a user-approved local directory before accessing it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The skill directs storage of long-lived secrets and access tokens together in a plaintext JSON file under the user's home directory, with an overridable path via environment variable. While common, this creates credential exposure risk if local file permissions are weak, the host is multi-user, or another process can read the file or influence the config directory.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

AK/SK and Token are read from the same local config file.

• Path: ~/.chanjing/credentials.json (overridable by env CHANJING_CONFIG_DIR)
• Format:

json

{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

The skill instructs the agent to read the local credentials file to check for non-empty app_id and secret_key. Accessing credential material, even for validation, increases exposure risk if the agent later logs values, summarizes file contents, or if the file path can be manipulated via environment settings.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

### Step 1: Check if already configured

Check if local AK/SK already exists (read `~/.chanjing/credentials.json` for non-empty `app_id` and `secret_key`).

### Step 2: Branch on result

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference.md (reported line 5)May include surrounding context.

md

## API (chanjing-openapi.yaml)

### Get Access Token

| Item | Value |
|------|--------|

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

AK/SK are read from a config file. Path and format follow scripts/chanjing-config (see CONFIG_DIR, CONFIG_FILE, and read_config() in that script).

File path: ~/.chanjing/credentials.json (default; override with env CHANJING_CONFIG_DIR)

json

{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

AK/SK are read from a config file. Path and format follow scripts/chanjing-config (see CONFIG_DIR, CONFIG_FILE, and read_config() in that script).

File path: ~/.chanjing/credentials.json (default; override with env CHANJING_CONFIG_DIR)

json

{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference.md (reported line 42)May include surrounding context.

AK/SK are read from a config file. Path and format follow scripts/chanjing-config (see CONFIG_DIR, CONFIG_FILE, and read_config() in that script).

File path: ~/.chanjing/credentials.json (default; override with env CHANJING_CONFIG_DIR)

json

{

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

2. **Require local setup** after the user obtains keys:
   - User updates local `credentials.json` file.
3. **Do not request secrets in chat**:
   - Never ask user to paste AK/SK in conversation.
   - Never echo or store AK/SK in chat summaries.
4. **After setting**:
   - Ask user to run status check and then proceed to target action.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

### Step 2: Branch on result

- **If already configured**: ask whether user wants to overwrite local config.
  - If yes, run guide steps.
  - If no, stop.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

- Existing users may be redirected to the console; tell them to open the left-side **API 密钥** page to view or reset keys.
3. **Ask user to configure local file** `~/.chanjing/credentials.json` (or `$CHANJING_CONFIG_DIR/credentials.json`) with `app_id` and `secret_key`.
4. **Secret handling rule**:
   - Do not ask user to paste AK/SK in chat.
   - If user shares secret in chat anyway, remind them to rotate keys and continue with local-command-only flow.
5. **After setting**:
   - Re-open the local file to confirm non-empty `app_id` and `secret_key`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

- This skill only handles **local credential guidance**.
- It does not require install hooks or elevated/system-wide privileges.
- It should not automatically execute unrelated skills.
- It should not accept AK/SK via chat content.

## Packaging Note

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs users to store long-lived sensitive credentials (AK/SK) and optional access tokens in a local JSON file but does not warn that the file is plaintext or recommend restrictive file permissions. This can lead to credential disclosure through local compromise, backups, shared home directories, or accidental inclusion in logs/repos, especially because the path is fixed and predictable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.