Architecture SLA Tracker by CloudQ

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:02 AM UTC
• Version: 1.0.0

Overview

This skill is a real Tencent Cloud Advisor helper, but it asks for powerful cloud credentials and includes broad IAM, login-link, and network behaviors that need careful review before installation.

Install only if you are comfortable giving the skill Tencent Cloud credentials and potential IAM write authority. Use a dedicated least-privilege sub-account or short-lived credentials, avoid putting long-lived AK/SK values in shell startup files, review any role creation before approving it, and treat generated console login links as sensitive temporary credentials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:43

Finding

TLS Certificate Verification Is Disabled When certifi Is Unavailable

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:82

Finding

Caller-Controlled API Host and Operation Can Receive Ambient Authentication Material

Content

View full analysis

dict: ``` Those values are used to build authenticated headers and the destination: ```python headers = { "Authorization": authorization, "Content-Type": "application/json; charset=utf-8", "Host": host, "X-TC-Action": action, "X-TC-Timestamp": str(timestamp), "X-TC-Version": version, "X-TC-Region": region, } if token: headers["X-TC-Token"] = token req = Request( f"https://{host}", data=payload_str.encode("utf-8"), headers=headers, method="POST", ) ``` The command-line interface passes untrusted positional arguments directly into that function: ```python service = args[0] host = args[1] action = args[2] version = args[3] payload_str = args[4] if len(args) > 4 else "{}" region = args[5] if len(args) > 5 else "ap-guangzhou" try: payload = json.loads(payload_str) except json.JSONDecodeError: payload = payload_str result = call_api(service, host, action, version, payload, region) ``` ### Technical Analysis The script automatically reads ambient Tencent Cloud credentials from environment variables, calculates a signature, and optionally includes `TENCENTCLOUD_TOKEN`. It does not validate that the supplied host belongs to Tencent Cloud or that the service/action pair is one of the operations declared by the Skill. Consequently, an invocation can direct the authent ...[truncated 1789 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create_role.py:36

Finding

Role Creation Attaches Full Tag and Advisor Access Beyond the Minimum Required Scope

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Documentation Instructs Users to Persist Long-Lived Cloud Keys in Plaintext Shell Profiles

Content

View full analysis

> ~/.bashrc echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc source ~/.bashrc ``` The Skill further states that environment variables must be permanently written to shell configuration files to survive new sessions. ### Technical Analysis Shell startup files are plaintext and are routinely included in home-directory backups, support bundles, workstation migrations, dotfile repositories, and accidental file sharing. They are also readable by any local process operating with the user's privileges. Persisting a long-lived SecretKey in these files increases both the exposure period and the number of locations in which the credential may be copied. This conflicts with the Skill's own recommendation to use temporary STS credentials in production and is not necessary for the declared functionality. The cleanup script does not remove credentials from shell profiles. It only generates commands that unset variables in the current shell and instructs the user to manually edit persistent configuration files. ### Attack Path 1. The user follows the mandatory setup instructions. 2. The SecretId and SecretKey are appended in plaintext to `.bashrc`, `.zshrc`, or an equivalent profile. 3. The profile is copied into a backup, synchronized dotfile repository, diagnostics archive, or another accessible location. 4. An attacker or unauthorized local process reads the plaintext SecretKey. 5. The attacker authenticates directly to Tencent Cloud using the stolen long-lived credentials. 6. Access persists until the user detects the compromise and rotates or disables the key. ### Impact Assessment Compromise grants the permissions of the Tencent Cloud identity ...[truncated 345 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: check_env.py:382

Finding

Read-Only Environment Check Writes Configuration and Generates a Live Login Session

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (52)

Tainted flow: 'req' from os.environ.get (line 228, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/login_url.py (reported line 236)May include surrounding context.

python

)

    ctx = _get_ssl_context()
    with urlopen(req, context=ctx) as resp:
        result = json.loads(resp.read().decode("utf-8"))

    response_body = result.get("Response", {})

Tainted flow: 'req' from os.environ.get (line 186, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tcloud_api.py (reported line 195)May include surrounding context.

python

try:
        ctx = _get_ssl_context()
        with urlopen(req, context=ctx, timeout=30) as resp:
            response_body = resp.read().decode("utf-8")
    except HTTPError as e:
        try:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented project structure includes write-capable utilities such as role creation, role setup, login URL generation, and cleanup, while the skill metadata frames the skill primarily as a read/query assistant. This mismatch can hide materially more powerful local and cloud actions than users or reviewers expect, which is especially dangerous in an agent skill that may be invoked through natural-language requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The security note claims AK/SK are never transmitted over the network, but authenticated Tencent Cloud API calls necessarily use those credentials or derived signatures in remote requests. Misrepresenting credential handling can mislead users into weaker trust decisions and prevent proper risk assessment around secrets exposure and request signing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill's effective scope includes identity discovery, role enumeration, role creation, policy attachment, local configuration writes, and login testing, which exceeds the expectation set by a cloud-advisor query tool. This broadens blast radius and can enable privilege changes in the tenant when users think they are only running read-oriented architecture queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's effective scope includes identity discovery, role enumeration, role creation, policy attachment, local configuration writes, and login testing, which exceeds the expectation set by a cloud-advisor query tool. This broadens blast radius and can enable privilege changes in the tenant when users think they are only running read-oriented architecture queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill's effective scope includes identity discovery, role enumeration, role creation, policy attachment, local configuration writes, and login testing, which exceeds the expectation set by a cloud-advisor query tool. This broadens blast radius and can enable privilege changes in the tenant when users think they are only running read-oriented architecture queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's effective scope includes identity discovery, role enumeration, role creation, policy attachment, local configuration writes, and login testing, which exceeds the expectation set by a cloud-advisor query tool. This broadens blast radius and can enable privilege changes in the tenant when users think they are only running read-oriented architecture queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill's effective scope includes identity discovery, role enumeration, role creation, policy attachment, local configuration writes, and login testing, which exceeds the expectation set by a cloud-advisor query tool. This broadens blast radius and can enable privilege changes in the tenant when users think they are only running read-oriented architecture queries.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 86% confidence

Finding

The skill instructs users to persist long-lived cloud secrets by appending them to shell startup files or user-level environment storage. While not malware/backdoor behavior, this is still dangerous because it increases credential exposure to local compromise, accidental disclosure, inherited subprocesses, and forensic persistence beyond the intended session.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

��变量配置密钥：

1.1 必填环境变量

• TENCENTCLOUD_SECRET_ID — 腾讯云 SecretId（必填）
• TENCENTCLOUD_SECRET_KEY — 腾讯云 SecretKey（必填）

密钥获取地址：https://console.cloud.tencent.com/cam/capi

环境变量必须永久写入 shell 配置文件，确保新会话中仍然生效：

Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）：

bash

echo 'export TENCENTCLOUD_SECRET_ID="your-secret-id"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell（写入用户级环境变量）：

powershell

[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")

1.2 角色配置（免密登录需要）

为生成控制台免密登录链接，需要配置 CAM 角色。角色配置分为 检测 和 创建 两个独立步骤，角色创

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md

- 插件必须包含 `SKILL.md` 文件，描述插件的功能、调用方式和输出格式

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · check_env.py (reported line 261)May include surrounding context.

python

nd("TENCENTCLOUD_SECRET_ID")
        if not secret_key:
            missing.append("TENCENTCLOUD_SECRET_KEY")
        log_fail(f"未配置以下环境变量: {', '.join(missing)}")
        log_info("")
        log_info("  请将腾讯云 API 密钥永久写入 shell 配置文件：")
        log_info("")
        log_info("  Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）:")
        log_info('    echo \'export TENCENTCLOUD_SECRET_ID="your-secret-id"\' >> ~/.bashrc')
        log_info('    echo \'export TENCENTCLOUD_SECRET_KEY="your-secret-key"\' >> ~/.bashrc')
        log_info("    source ~/.bashrc")
        log_info("")
        log_info("  Windows PowerShell（写入用户级环境变量）:")
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")')
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")')
        log_info("")
        log_info("  密钥获取地址: https:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script performs privileged IAM write actions by creating a CAM role and attaching policies, which is materially broader than the skill's stated purpose of querying advisor, architecture, and risk-assessment data. In an agent-skill context, bundling identity-management changes into a data-query tool creates a dangerous privilege-escalation path if the script is triggered with valid AK/SK, even though the code comments say it should only run with explicit consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script creates a role with ConsoleLogin enabled and attaches broad managed policies, which exceeds what is justified for a user-facing advisor-query capability. This expands the blast radius from simple API reads to broad account capabilities, and in a skill ecosystem could let a compromised or misused workflow persist privileged access beyond the immediate task.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

When certifi is unavailable, the fallback SSL context disables hostname checking and certificate validation entirely. That allows a machine-in-the-middle attacker to intercept or modify the outbound STS request and response, potentially exposing temporary credentials or causing the script to trust forged responses during authentication-sensitive operations.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/setup_role.py (reported line 44)May include surrounding context.

python

if platform.system() == "Windows":
        # Windows 10+ 的 cmd/PowerShell 支持 ANSI（需 VT100）
        try:
            os.system("")  # 激活 VT100 模式
            return True
        except Exception:
            return False

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

If certifi is unavailable, the code disables hostname checking and certificate verification entirely before sending signed API requests. In this skill, the request carries cloud authentication material and privileged management actions, so a man-in-the-middle attacker could intercept or redirect traffic, capture sensitive request metadata, and tamper with API responses.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises capabilities beyond the stated skill scope, including passwordless console login link generation and environment/role management. Scope expansion in skill documentation is risky because it can cause the agent or user to rely on undocumented privileged behaviors, increasing the chance of unexpected account access or configuration changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Generating passwordless console login links grants direct account access and is highly sensitive, yet the README does not prominently warn about the account-access implications or required authorization controls. In the context of a cloud-management skill, such a feature materially increases the blast radius if invoked accidentally, socially engineered, or exposed to the wrong user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to append long-lived cloud credentials to a shell startup file, creating persistent local exposure without warning about shared accounts, backups, shell history, or filesystem compromise. This is an insecure operational practice for privileged cloud secrets and can lead to credential theft or misuse beyond the skill itself.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README says users can 'directly chat' and then lists trigger-style examples such as '帮我检查一下...' and '查看我的云架构目录' without defining a constrained invocation pattern, scope, or exclusion conditions. For a markdown file, this creates an ambiguous activation surface because these are ordinary conversational requests rather than narrowly scoped command phrases.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README states that E2E tests automatically save every prompt and output, which can include secrets, internal architecture details, account identifiers, or other sensitive cloud data. Persisting conversational inputs and outputs by default increases the risk of local data leakage, unintended retention, and secondary exposure through logs or shared workspaces.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill’s natural-language content is entirely written as Chinese-only user-facing guidance and response templates, with no indication that the user may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document gives inconsistent statements about the role's attached permissions: one section describes a limited/readonly advisor role, while another says it will attach broader TAG and Advisor FullAccess policies. Such contradictions undermine informed consent and can cause the agent to provision more privilege than the user was led to expect.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法 v3.md:779

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法.md:484

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/login_url.py:86

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/tcloud_api.py:50