CloudQ

• Outcome: Review
• Latest audit: Aug 11, 2026 · 2:29 AM UTC
• Version: 1.9.0

Overview

CloudQ is a coherent cloud-operations assistant, but it stores cloud credentials locally and includes IAM role creation, policy attachment, STS login, and role deletion capabilities that merit Review before installation.

Install only if you are comfortable letting this skill use Tencent Cloud credentials for CloudQ operations. Prefer a dedicated least-privilege subaccount, review any request to create, attach policies to, assume, or delete CAM roles, and periodically remove ~/.tencent-cloudq/credential.json when you no longer need the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The public description frames the skill as cloud advisory and AIOps assistance, but the instructions also authorize sensitive identity and control-plane actions such as OAuth token handling, local credential persistence, CAM role creation/deletion, STS role assumption, and passwordless login URL generation. This mismatch can cause users or orchestrators to invoke the skill without realizing it can manipulate IAM state and handle high-value credentials, increasing the chance of unsafe delegation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The cleanup script performs destructive remote IAM management by deleting a CAM role in Tencent Cloud, which goes beyond purely local cleanup and the skill’s stated advisory/operations scope. Even though deletion is optional and requires confirmation plus AK/SK credentials, this still introduces cloud-side destructive capability that could remove legitimate access infrastructure if run by mistake or under misleading guidance.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script reads AK/SK credentials from environment variables and uses them to invoke remote CAM APIs, enabling IAM deletion operations not clearly justified by the described CloudQ assistant functionality. In skill ecosystems, unnecessary access to privileged credentials materially increases risk because any compromise, misuse, or user confusion can turn a local cleanup action into remote account-impacting changes.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script performs privileged CAM write operations by creating a role and attaching broad policies, which goes beyond a purely advisory/read-only CloudOps capability. In an agent skill context, this is dangerous because invoking the skill can materially change IAM state and expand access, increasing the blast radius if the agent is misused, prompted unexpectedly, or run with high-privilege credentials.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The wrapper intentionally permits generic CAM and STS API calls when AK/SK credentials are present, which expands the skill from advisory/ops use into identity and access management operations. In an agent skill context, this creates unnecessary capability to query or manipulate authentication-related cloud resources and increases the blast radius if the skill is prompted or misused beyond its stated purpose.

Vague Triggers

Medium

• Confidence: 73% confidence
• Finding: The local-routing trigger phrases include generic conversational inputs such as help, thanks, cancel, restart, and identity questions. Overbroad phrase matching can let unrelated user messages be intercepted and handled by this skill unexpectedly, creating prompt-scope confusion and potentially causing the skill to run its cloud workflow in contexts where the user did not intend to invoke it.

Vague Triggers

High

• Confidence: 84% confidence
• Finding: The primary description is extremely broad, covering many cloud, multi-cloud, advisory, inspection, cost, security, and operations scenarios. Ambiguous invocation scope raises the likelihood that the skill will be selected for requests beyond what the user expected, which is more dangerous here because the skill has Bash, file write, network, and IAM-related capabilities.

Credential Access

High

• Category: Privilege Escalation

Content

description_en: "Multi-cloud management & smart advisor with architecture visualization, risk assessment & AI-powered O&M"
version: 1.9.0
allowed-tools: Read,Write,Bash,Grep
metadata: {"openclaw": {"emoji": "☁️", "requires": {"bins": ["python3"]}, "permissions": ["network:https://*.tencentcloudapi.com", "network:https://cloud.tencent.com", "network:https://clawhub.ai", "network:https://cloudq.cloud.tencent.com", "fs:~/.tencent-cloudq/"], "security": {"iam_operations": ["cam:GetRole", "cam:CreateRole", "cam:AttachRolePolicy", "cam:DeleteRole", "cam:DescribeRoleList", "sts:AssumeRole", "sts:GetCallerIdentity", "advisor:CreateAdvisorAuthorization", "advisor:DescribeUserAuthorizationStatus"], "iam_note": "角色创建/删除为独立步骤，需用户明确同意后执行：create_role.py 创建角色（可选，仅影响免密登录），cleanup.py --cloud 删除角色；check_env.py 做环境检测（含智能顾问开通状态检测），--enable-advisor 参数开通智能顾问（需用户明确同意，必须开通才能使用 CloudQ）；DescribeUserAuthorizationStatus 和 CreateAdvisorAuthorization 已集成到 check_env.py 中", "data_handling": "凭证保存在 ~/.tencent-cloudq/credential.json（权限600），OAuth 凭证自动刷新、Connector 凭证由 Agent 侧通过 MCP Tool 获取后写入；AK/SK 通过环境变量配置；配置文件仅保存角色 ARN，不保存长期密钥"}}}
---

# ☁️ CloudQ — 多云 AIOps 专家

• Confidence: 90% confidence
• Finding: The skill is designed to access, store, and refresh OAuth and connector credentials in `~/.tencent-cloudq/credential.json`, and to use environment AK/SK values for cloud API access. Even if intended, local credential handling is high risk because compromise of the agent environment, logs, or file permissions could expose tokens or secrets that enable cloud access.

Credential Access

High

• Category: Privilege Escalation

Content

### 2.3 Connector 临时密钥 — OneId 方案（CloudQ 托管环境，自动）

在支持 Connector 的 Agent 环境中，通过 MCP Tool `CloudQConnector_get_available_tmp_secret` 获取临时密钥，写入 `credential.json`（`type: "connector"`）。
连接成功后，Agent 无需在本地配置 OAuth 或 AK/SK。

首次使用请在 [CloudQ 控制台](https://console.cloud.tencent.com/advisor/cloudq) 的「拓展」→「Channels 集成」→「OneID」完成配置，并将返回的 MCP 配置粘贴到 WorkBuddy「连接器」→「自定义连接器」→「配置 MCP」，保存后点击「连接」。

• Confidence: 95% confidence
• Finding: This section instructs the agent to obtain temporary secrets and write `secretId`, `secretKey`, `token`, and `auditJwt` directly into a local JSON file via an inline Python command. Embedding live credentials in shell command text is dangerous because they may be exposed through process inspection, shell history, agent traces, or error logs, and the file itself becomes a sensitive target.

Credential Access

High

• Category: Privilege Escalation

Content

| `sts:AssumeRole` | `login_url.py`（内部） | 敏感 |
| `cam:CreateRole` / `cam:AttachRolePolicy` / `cam:DeleteRole` | `create_role.py` / `cleanup.py` | 写入（需同意） |

- 凭证文件 `~/.tencent-cloudq/credential.json`（权限 600），存储 OAuth 或 Connector 凭证
- 网络仅连接 `*.tencentcloudapi.com`、`cloud.tencent.com`、`cloudq.cloud.tencent.com`、`clawhub.ai`
- 清理：`python3 {baseDir}/scripts/cleanup.py --all`（需 `--all` 参数）

• Confidence: 87% confidence
• Finding: The skill explicitly documents a local credential file containing OAuth or connector credentials and combines that with sensitive capabilities like STS assume-role and CAM role management. In a cloud-operations skill, credential material is especially dangerous because it can lead directly to control-plane access across tenant resources if the workstation or agent runtime is compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/tcloud_async_task.py:84

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/tcloud_sse_api.py:216