tsa-risk

• Analyzed: Mar 30, 2026, 1:51 PM
• Findings: 1
• Version: 1.5.0
• Hash: 357156d1cd0ebf53678b47ee7182f3ef4b08ac54f289c835383a415fa179f628
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides tools for Tencent Cloud Smart Advisor (TSA) but includes high-risk capabilities that handle sensitive credentials and IAM permissions. Key indicators include scripts that perform IAM write operations (create_role.py: cam:CreateRole, cam:AttachRolePolicy), generate console login URLs using STS temporary tokens (login_url.py), and instructions in SKILL.md to permanently write API secrets (AK/SK) into shell configuration files (~/.bashrc). While these actions are aligned with the stated purpose of providing console access and managing cloud resources, the combination of IAM manipulation, secret persistence, and session token generation represents a significant attack surface if the agent is misdirected.