腾讯云 COS 原生操作技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.1.0

Overview

This Tencent COS skill is mostly coherent for cloud storage management, but it can permanently delete or expose cloud objects without code-enforced safeguards.

Install only if you are comfortable giving the agent COS credentials that can upload, delete, move, rename, list, and share objects. Use least-privileged COS keys, avoid production buckets unless necessary, enable bucket versioning or retention where possible, and manually verify deletion scope and signed URL expiration before running destructive or sharing operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/manage_objects.js:18

Finding

Destructive COS Operations Lack Confirmation and Scope Safeguards

Content

View full analysis

({ Key })), }); return print({ success: true, action: 'delete_multiple', total: input.object_keys.length, data }); } ``` `scripts/delete_folder.js:21-39` ```js async function main() { const input = readJsonArg(2, 'input'); if (!input.folder_path) throw new Error('folder_path is required'); const cos = createCos(); const { bucket, region } = getBucketConfig(); const folderKey = input.folder_path.endsWith('/') ? input.folder_path : `${input.folder_path}/`; if (input.recursive) { const files = await listAll(cos, bucket, region, folderKey); const keys = files.map((item) => ({ Key: item.Key })); if (keys.length) { await call(cos, 'deleteMultipleObject', { Bucket: bucket, Region: region, Delete: { Objects: keys, Quiet: false }, }); } ``` ### Technical Analysis The scripts execute single-object, bulk-object, and recursive-prefix deletion immediately after parsing one caller-supplied JSON argument. They do not implement any of the following safeguards: - An explicit ...[truncated 1744 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/delete_folder.js:12

Finding

Recursive Folder Deletion Ignores Pagination and Falsely Reports Completion

Content

View full analysis

({ Key: item.Key })); if (keys.length) { await call(cos, 'deleteMultipleObject', { Bucket: bucket, Region: region, Delete: { Objects: keys, Quiet: false }, }); } else { await call(cos, 'deleteObject', { Bucket: bucket, Region: region, Key: folderKey }).catch(() => null); } return print({ success: true, action: 'delete_folder', folder_path: folderKey, recursive: true, deleted_count: keys.length }); } ``` ### Technical Analysis The function named `listAll` makes only one COS `getBucket` request with `MaxKeys: 1000`. It does not inspect `IsTruncated` and does not request subsequent pages using the continuation mechanism supported by COS. When a prefix contains more than 1,000 objects, the script deletes only the first returned page. It then unconditionally prints `success: true`, which implies that the entire recursive operation completed successfully. The implementation also does not inspect individual errors that may be present in a bulk-delete response. Therefore, even within the first page, partial deletion failures may not be acc ...[truncated 1357 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_signed_url.js:5

Finding

Signed URL Expiration Is Not Validated or Bounded

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- `scripts/manage_objects.js` - 删除、批量删除、复制、移动、重命名、创建文件夹

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

- `scripts/delete_folder.js` - 删除文件夹，支持递归删除

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

- `scripts/get_folder_stats.js` - 统计目录文件数量、总体积和类型分布

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown states that results are returned as structured JSON or concise Chinese, which imposes a specific language choice. The file does not offer the user a language option or document a justified locale restriction, so this conflicts with the language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script performs irreversible deletion of a folder marker or all objects under a prefix when recursive is set, with no built-in confirmation, dry-run mode, or secondary safety check. In an agent skill context, that increases the risk of accidental or mis-scoped deletions caused by user error, prompt confusion, or automation mistakes, especially because folder_path is taken directly from input and applied against the configured bucket.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script performs irreversible deletion actions via deleteObject and deleteMultipleObject, but there is no confirmation prompt, warning comment, or other user-facing disclosure before those operations run. Although it prints a success result afterward, that does not warn the user in advance about destructive behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes native COS operations around browsing, upload/sync, object management, and bucket-configuration troubleshooting, which implies acting on the configured COS bucket. This code accepts input.target_bucket and uses it to build CopySource, enabling copy/move/rename from a different bucket than the configured one, which expands behavior beyond the stated single-bucket management scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

For move and rename, the script copies the target object and then deletes the source object, making the operation destructive if the deletion succeeds. The code does not provide any advance warning, confirmation, or inline disclosure that these actions remove the original object.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code performs a network operation that transmits a local file to remote object storage via cos.sliceUploadFile, but there is no confirmation prompt, warning comment/docstring, or user-facing log indicating that file contents will be uploaded. Because the operation moves user data off the local system, it should include some explicit disclosure unless clearly warned elsewhere in markdown documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This code invokes cos.getBucket, which performs a remote API request and retrieves object listings from cloud storage. While the script prints results and errors, it does not include any user-facing comment, prompt, or disclosure that it will contact a remote service and enumerate bucket contents, which is a safety-relevant operation for code files under the warning rule.

Content

No source excerpt is available for this finding.