Security audit

Architecture SLA Tracker by CloudQ

Security checks across malware telemetry and agentic risk

Overview

This is a real Tencent Cloud Advisor helper, but it needs Review because it can use powerful cloud credentials, change cloud IAM roles, generate console login links, and includes unsafe or under-scoped security behavior.

Install only if you trust the publisher and are comfortable granting Tencent Cloud account-level authority. Use a least-privilege subaccount or short-lived credentials, review any CAM role and policy changes before running setup/create_role, avoid storing long-lived AK/SK values in shell startup files, do not run cleanup with cloud deletion flags unless you intend to remove the role, and treat generated console login links as sensitive session-bearing URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The README presents the skill primarily as a Smart Advisor assistant, but its documented codebase includes additional privileged capabilities such as console passwordless login generation, CAM role creation/setup, and cleanup operations. This scope expansion increases the chance that users or orchestration systems invoke actions with materially different security consequences than expected, especially in an agent setting where documentation influences trust and tool selection.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The security claim is internally inconsistent: AK/SK-based authentication necessarily uses secrets to compute request signatures that are then sent with API requests. Even if the raw secret key is not transmitted verbatim, stating that secrets are not involved in network transmission can mislead users about the trust boundary and reduce scrutiny around request handling, logging, and destination validation.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The documentation inconsistently describes which policies are attached to the created role and whether they are read-only or broader full-access permissions. This inconsistency can mislead users into approving a role creation flow under false assumptions, resulting in over-privileged access being granted in the cloud account.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims credentials are not persisted, yet it instructs users to permanently store SecretId and SecretKey in shell startup files or user-level environment variables. Persisting long-lived cloud secrets on disk increases the risk of credential theft via local compromise, shell-history leakage, backups, or other processes reading user environment configuration.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The module advertises itself as read-only and non-modifying, but later writes a configuration file when it detects an existing role. Misrepresenting side effects is dangerous in security-sensitive tooling because operators may run it under incorrect assumptions, causing unreviewed persistence of account and role metadata on disk.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The environment check persists role configuration to ~/.tencent-cloudq/config.json during what is presented as a detection-only flow. In a privileged automation context, any unexpected write can create state, influence later executions, and violate least surprise, which is a legitimate security concern even if the data is not highly sensitive.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The file is a destructive cleanup utility that deletes local configuration, cache, environment-variable state via generated shell scripts, and optionally a cloud CAM role. That behavior materially exceeds the skill's stated advisor querying/management scope and creates a risky side-effect surface, especially because it can remove cloud IAM resources when invoked with --cloud.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script can delete a CAM role named advisor using available AK/SK credentials, which is an IAM-destructive action unrelated to normal advisor read/query operations. In an agent-skill context, bundling identity-resource deletion increases blast radius: accidental execution or abuse could break access paths or trust relationships in the cloud account.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: This script performs privileged CAM write operations (CreateRole, AttachRolePolicy) and writes persistent local configuration, which materially expands capability beyond a read-oriented advisor/query skill. In an agent context, hidden or loosely gated IAM mutation is dangerous because it can create durable access paths and alter account security posture with the user's existing cloud credentials.

Description-Behavior Mismatch

High

Confidence: 88% confidence
Finding: The script attaches broad managed policies, including full TAG and Advisor access, which may exceed what is necessary for viewing architecture and risk evaluation data. Overbroad role grants violate least privilege and can expose additional cloud metadata or management capabilities if the created role is later assumed or misused.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The script’s documented purpose is to generate Tencent Cloud console passwordless login URLs using STS temporary credentials, which materially expands capability beyond the skill metadata’s stated advisor-management and assessment API operations. This creates an undocumented privilege-bearing access path into the cloud console, increasing the chance of misuse, overreach, or user surprise in a security-sensitive cloud environment.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: This code actively performs STS AssumeRole and constructs a Tencent Cloud console login link, enabling interactive console access rather than just advisor data retrieval. In the context of a cloud-management skill, this is dangerous because it can grant a user or downstream process broad console access under a role, potentially far exceeding the least-privilege scope implied by the skill description.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The setup script can create a new CAM role and attach broad managed policies, which changes account IAM state rather than merely querying advisor data. While it asks for confirmation, this expands privileges and modifies cloud access configuration beyond a read/query-only expectation, increasing the blast radius if the tool is misused or the attached policies are overly broad.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The helper is implemented as a generic Tencent Cloud API signer/invoker that accepts arbitrary service, host, action, and version parameters, which exceeds the declared skill scope of an Advisor-only assistant. In an agent setting, this creates a privilege-expansion path where the skill can be repurposed to access unrelated Tencent Cloud APIs using the same credentials, potentially enabling unauthorized read or write operations far beyond architecture/risk assessment.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The CLI exposes the generic API caller directly to runtime arguments, allowing anyone invoking the script through the agent to target arbitrary Tencent Cloud APIs unrelated to the skill's stated purpose. In the context of an agent skill, this materially increases risk because the agent may hold broad cloud credentials, so a nominally read-oriented Advisor tool becomes a general cloud control plane primitive.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The invocation examples are broad, natural-language requests without clear trigger boundaries, exclusions, or confirmation rules. In an agent ecosystem, ambiguous activation can cause the skill to be selected for loosely related prompts and may lead to unintended access to cloud metadata, evaluations, login-link generation, or other sensitive operations under the user's configured credentials.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The document states that enabling the service will also enable additional capabilities ('报告解读和云架构协作权限') but does not clearly warn that this is a state-changing authorization action or advise the caller to confirm scope and consent before execution. In an agent skill context, this is more dangerous than ordinary API documentation because an automated agent could invoke the action directly, causing unintended privilege expansion or service enablement without explicit user approval.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document includes realistic authentication examples showing Authorization headers and SecretId-like values, but it does not explicitly warn users not to expose these materials in logs, screenshots, shared docs, or client-side code. Even if the values are masked/example values, this normalizes handling sensitive signing material in ways that can lead to credential disclosure in downstream implementations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The v1 examples place Signature and SecretId in the request URL/body, and the GET example specifically puts them in the query string without any warning about leakage through browser history, proxy logs, analytics tools, referrers, or server access logs. In a skill that helps users call Tencent Cloud APIs with AK/SK, this is more dangerous because users may directly copy these patterns into production integrations and unintentionally expose credentials or signing artifacts.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document mandates generating and presenting passwordless console login links whenever architecture data is returned, but provides no security warning, authorization check guidance, scope limitation, or handling requirements for these session-bearing URLs. In a cloud-admin context, such links can grant direct access to sensitive console resources; exposing them in chat output or generating them automatically increases the risk of account misuse, session leakage, and unauthorized access.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The fallback SSL context disables hostname verification and certificate validation, which allows a man-in-the-middle attacker to intercept or tamper with requests to Tencent Cloud APIs. Because this script transmits highly sensitive authentication material and retrieves temporary credentials, disabling TLS verification can directly expose secrets and enable forged responses.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: advisor-2020-07-21/调用方式/签名方法 v3.md:779

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: advisor-2020-07-21/调用方式/签名方法.md:484

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/login_url.py:86

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/tcloud_api.py:50