zepto-prava-skill

SUSPICIOUS. The skill is purpose-aligned for Zepto checkout, but it gives the agent autonomous purchasing capability and handles tokenized payment credentials through external tooling and browser automation. No clear theft or covert exfiltration is shown, so this is not confirmed malware, but it is a high-risk financial-automation skill with nontrivial trust and credential-forwarding concerns.

No direct malicious payload is evident in the module’s own logic (no eval/dynamic code execution, no credential theft, no system modification). However, the module’s security posture is dominated by supply-chain/dynamic-execution risk: it spawns `npx --yes mcp-remote` at runtime and allows executable selection via PATH/ZEPTO_NPX_PATH, sending user-provided tool arguments to a fixed remote MCP endpoint. If the runtime environment or npm/npx resolution is not strictly controlled, this presents a meaningful risk that should be mitigated (pin/lock dependencies, avoid runtime `npx`, verify the resolved executable, and constrain environment influence).