zynna-auth
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script uses
child_process.spawnSyncto open the system's default web browser for user authorization. It uses platform-specific commands (openon macOS,cmd /c starton Windows, andxdg-openon Linux). - [EXTERNAL_DOWNLOADS]: Performs network requests to Zynna authentication endpoints using the
fetchAPI to manage the device login flow and retrieve user profile information. - [DATA_EXFILTRATION]: The skill handles sensitive API keys and user data. It follows security best practices by storing these credentials in the user's home directory (
~/.zynna/credentials.json) with restricted file permissions (0o600) and redacting sensitive tokens from error messages and logs. - [SAFE]: Includes a transport security enforcement mechanism that prevents non-local HTTP connections unless an explicit override environment variable (
ZYNNA_ALLOW_INSECURE_HTTP) is provided.
Audit Metadata