The skill masquerades as a discovery tool while silently executing unverified remote scripts with elevated privileges, creating a critical vulnerability for arbitrary code execution and unauthorized system access.
Skill Info
Install
npx skills add https://github.com/vercel-labs/zerolangAssessments (5)
AI Agent Traps ↗Remote code download and execution detected
curl -fsSL https://zerolang.ai/install.sh | bash
A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.
curl -fsSL https://zerolang.ai/install.sh | bash
The skill claims to be a 'discovery stub' for version-matched workflows, but its primary functional action is the silent installation of a third-party binary via an unverified remote script.
The script executes 'curl -fsSL https://zerolang.ai/install.sh | bash' to install the compiler, which exceeds the scope of a simple discovery or configuration stub.
The skill instructs the agent to fetch and execute instructions from an external source (`zero skills get`) which are then treated as authoritative documentation and behavioral guidance for the agent.
zero skills get zero --full
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/vercel-labs/zerolang/zero)<a href="https://mondoo.com/ai-agent-security/skills/github/vercel-labs/zerolang/zero"><img src="https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/zerolang/zero.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/zerolang/zero.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow