zion-baas

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to ask for usernames/passwords, to run commands like npm run auth:email <email> <password>, and to persist JWTs and admin/user tokens verbatim in a plaintext .zion/credentials.yaml (and use them in API calls), which requires the LLM to handle and output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime path includes subscribing to Zion GraphQL subscriptions (e.g., scripts/subscribe.ts / fz_zai_listen_conversation_result) and printing the returned data/reasoningContent fields, which are free-form text originating from Zion/its AI agent outputs and can contain attacker-controlled prompt-injection content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's scripts and README perform runtime requests to the Meta API (https://zionbackend.functorz.com/api/graphql) to fetch project schema including zAiConfigs (prompt templates), and to the runtime GraphQL and WebSocket endpoints (https://zion-app.functorz.com/zero/{projectExId}/api/graphql-v2 and wss://zion-app.functorz.com/zero/{projectExId}/api/graphql-subscription) to invoke AI agents and actionflows (remote execution); additionally the README instructs installing remote code via npx/git from https://github.com/functorz-tech/zion-baas-skill — together these are runtime external dependencies that supply prompts/configs and execute remote code, and are required for the skill to function.