Architecture Governance & Assessment

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:54 AM UTC
• Version: 1.4.0

Overview

This Tencent Cloud advisor skill is partly coherent, but it asks for durable cloud credentials and includes broad IAM, console-login, cleanup, and unsafe network behaviors that need careful review.

Install only if you are comfortable granting Tencent Cloud credentials to this skill. Use a tightly scoped sub-account or short-lived credentials, avoid storing AK/SK in shell startup files, review any CAM role and policy creation before approving it, do not share generated console login links, and avoid running cloud cleanup unless you have verified the target role is safe to delete.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:42

Finding

TLS Certificate Verification Is Silently Disabled

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:82

Finding

Generic API Client Sends Authentication Material to Caller-Controlled Hosts

Content

View full analysis

dict: ``` ```python req = Request( f"https://{host}", data=payload_str.encode("utf-8"), headers=headers, method="POST", ) ``` ```python def main(): """命令行入口""" args = sys.argv[1:] if len(args) < 4: print(_output_json(_make_error( "", "MissingParameter", "缺少必要参数。用法: python3 tcloud_api.py [payload] [region]" ))) sys.exit(1) service = args[0] host = args[1] action = args[2] version = args[3] payload_str = args[4] if len(args) > 4 else "{}" region = args[5] if len(args) > 5 else "ap-guangzhou" try: payload = json.loads(payload_str) except json.JSONDecodeError: payload = payload_str result = call_api(service, host, action, version, payload, region) ``` ### Technical Analysis The command-line caller controls both `service` and `host`. No exact-host allowlist, Tencent Cloud suffix check, hostname syntax validation, or service-to-host consistency check is performed. The resulting request carries an `Authorization` header containing the SecretId and request signature. If `TENCENTCLOUD_TOKEN` is configured, the request also carries the temporary security token in `X-TC-Token`. These values are then sent to the caller-selected HTTPS server. The behavior exceeds the declared functionality, which describes a fixed Advisor endpoint, and exceeds the metadata's intended Tencent Cloud network scope. ### Attack Path 1. An attacker influences an agent instru ...[truncated 1202 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create_role.py:35

Finding

Console Role Is Granted Permissions Beyond the Skill's Minimum Requirements

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:24

Finding

Instructions Require Persistent Plaintext Storage of Long-Term Cloud Credentials

Content

View full analysis

> ~/.bashrc echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc source ~/.bashrc ``` Windows PowerShell（写入用户级环境变量）： ```powershell [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User") [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User") ``` ``` ### Technical Analysis The Skill explicitly requires users to persist long-term Tencent Cloud SecretId and SecretKey values in shell startup files or user-level environment storage. Shell startup files are plaintext and are commonly readable by user-context processes, developer tools, backup systems, support utilities, and malicious extensions. This persistence is unnecessary for the declared cloud assessment functionality. Session-only credentials, protected provider profiles, operating-system credential stores, or short-lived STS credentials can provide the required authentication without placing durable keys in shell initialization files. The cleanup script does not automatically remove these lines from startup files. It only creates commands that clear the current process environment and tells the user to edit startup files manually. ### Attack Path 1. The user follows the mandatory setup instructions. 2. A durable SecretKey is appended to `.bashrc`, `.zshrc`, or user-level environment configuration. 3. The key remains available across future sessions and system restarts. 4. A malicious process, compromised extension, backup leak, support archive, or accidental disclosure exposes the startup file or environment. 5. The attacker uses the long-term key until it is revoked or rotated. ### Impact Assess ...[truncated 447 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: check_env.py:343

Finding

Mandatory Read-Only Environment Check Performs Writes and Assumes a Cloud Role

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/cleanup.py:272

Finding

Cloud Cleanup Can Delete an Unrelated Pre-Existing CAM Role

Content

View full analysis

bool: """删除云端 CAM 角色（可选）""" print(f"\n{bold('3. 云端 CAM 角色')}") secret_id = os.environ.get("TENCENTCLOUD_SECRET_ID", "") secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY", "") if not secret_id or not secret_key: print(f" {dim('[-]')} 未配置 AK/SK 环境变量，跳过云端角色清理") print(f" 如需删除云端角色，请设置 TENCENTCLOUD_SECRET_ID 和 TENCENTCLOUD_SECRET_KEY 后重试") return False try: from tcloud_api import call_api except ImportError: print(f" {red('[FAIL]')} 无法加载 tcloud_api 模块") return False print(f" 正在检查角色 {ROLE_NAME} ...") check_result = call_api( "cam", "cam.tencentcloudapi.com", "GetRole", "2019-01-16", {"RoleName": ROLE_NAME}, ) if not check_result.get("success"): err_code = check_result.get("error", {}).get("code", "") if "NotFound" in err_code or "not exist" in check_result.get("error", {}).get("message", "").lower(): print(f" {dim('[-]')} 角色 {ROLE_NAME} 不存在，无需删除") return False else: print(f" {red('[FAIL]')} 查询角色失败: {check_result.get('error', {}).get('message', '未知错误')}") return False role_data = check_result.get("data", {}) role_id = role_data.get("RoleId", "unknown") description = role_data.get("Description", "无描述") print(f" 检测到角色:") print(f" 名称: {ROLE_NAME}") print(f" ID: {role_id}") print(f" 描述: {description}") if interactive and not confirm(f"\n 确认删除云端角色 {ROLE_NAME} ? (此操作不可恢复)"): print(f" {yellow('[SKIP]')} 用户跳过") return False print(f" 正在删除角色 {ROLE_NAME} ...") delete_result = call_api( "cam", "cam.tencentcloudapi.com", "DeleteRole", "20 ...[truncated 2079 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (76)

Tainted flow: 'req' from os.environ.get (line 228, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/login_url.py (reported line 236)May include surrounding context.

python

)

    ctx = _get_ssl_context()
    with urlopen(req, context=ctx) as resp:
        result = json.loads(resp.read().decode("utf-8"))

    response_body = result.get("Response", {})

Tainted flow: 'req' from os.environ.get (line 186, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tcloud_api.py (reported line 195)May include surrounding context.

python

try:
        ctx = _get_ssl_context()
        with urlopen(req, context=ctx, timeout=30) as resp:
            response_body = resp.read().decode("utf-8")
    except HTTPError as e:
        try:

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This guide is materially inconsistent with the declared purpose of an architecture-governance assessment skill and instead documents bulk publication tactics, including pacing, batching, and anti-spam avoidance. In the context of a skill package, this can facilitate platform abuse or mass deployment of skills while normalizing behavior designed to work around defensive controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document explicitly recommends token rotation and content variation to avoid anti-spam checks, which are classic evasion techniques rather than legitimate operational guidance. For a skill unrelated to publishing automation, these instructions are especially dangerous because they enable circumvention of platform abuse protections and can support large-scale spam or supply-chain distribution activity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The security statement is internally inconsistent: AK/SK-authenticated API calls necessarily use secrets or secret-derived signatures in network requests, so claiming secrets are not transmitted over the network is misleading. Misstating secret-handling properties can cause users to underestimate the exposure model and make unsafe trust decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented generic API invocation pattern suggests the underlying helper can call arbitrary Tencent Cloud service/actions beyond the narrowly described architecture assessment use case. In context, a generic cloud API caller paired with account credentials materially increases misuse potential and weakens the safety boundary implied by the skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented generic API invocation pattern suggests the underlying helper can call arbitrary Tencent Cloud service/actions beyond the narrowly described architecture assessment use case. In context, a generic cloud API caller paired with account credentials materially increases misuse potential and weakens the safety boundary implied by the skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented generic API invocation pattern suggests the underlying helper can call arbitrary Tencent Cloud service/actions beyond the narrowly described architecture assessment use case. In context, a generic cloud API caller paired with account credentials materially increases misuse potential and weakens the safety boundary implied by the skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented generic API invocation pattern suggests the underlying helper can call arbitrary Tencent Cloud service/actions beyond the narrowly described architecture assessment use case. In context, a generic cloud API caller paired with account credentials materially increases misuse potential and weakens the safety boundary implied by the skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented generic API invocation pattern suggests the underlying helper can call arbitrary Tencent Cloud service/actions beyond the narrowly described architecture assessment use case. In context, a generic cloud API caller paired with account credentials materially increases misuse potential and weakens the safety boundary implied by the skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented generic API invocation pattern suggests the underlying helper can call arbitrary Tencent Cloud service/actions beyond the narrowly described architecture assessment use case. In context, a generic cloud API caller paired with account credentials materially increases misuse potential and weakens the safety boundary implied by the skill description.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

��变量配置密钥：

1.1 必填环境变量

• TENCENTCLOUD_SECRET_ID — 腾讯云 SecretId（必填）
• TENCENTCLOUD_SECRET_KEY — 腾讯云 SecretKey（必填）

密钥获取地址：https://console.cloud.tencent.com/cam/capi

环境变量必须永久写入 shell 配置文件，确保新会话中仍然生效：

Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）：

bash

echo 'export TENCENTCLOUD_SECRET_ID="your-secret-id"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell（写入用户级环境变量）：

powershell

[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")

1.2 角色配置（免密登录需要）

为生成控制台免密登录链接，需要配置 CAM 角色。角色配置分为 检测 和 创建 两个独立步骤，角色创

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md

- 插件必须包含 `SKILL.md` 文件，描述插件的功能、调用方式和输出格式

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file is functionally unrelated to the declared architecture-governance assessment skill and instead provides end-to-end Tencent Cloud API signing and request-construction guidance. In a skill context, that represents capability expansion into authenticated cloud API access, which increases the chance the agent can be repurposed to enumerate or interact with cloud resources outside its stated role.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · check_env.py (reported line 261)May include surrounding context.

python

nd("TENCENTCLOUD_SECRET_ID")
        if not secret_key:
            missing.append("TENCENTCLOUD_SECRET_KEY")
        log_fail(f"未配置以下环境变量: {', '.join(missing)}")
        log_info("")
        log_info("  请将腾讯云 API 密钥永久写入 shell 配置文件：")
        log_info("")
        log_info("  Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）:")
        log_info('    echo \'export TENCENTCLOUD_SECRET_ID="your-secret-id"\' >> ~/.bashrc')
        log_info('    echo \'export TENCENTCLOUD_SECRET_KEY="your-secret-key"\' >> ~/.bashrc')
        log_info("    source ~/.bashrc")
        log_info("")
        log_info("  Windows PowerShell（写入用户级环境变量）:")
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")')
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")')
        log_info("")
        log_info("  密钥获取地址: https:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file is a destructive cleanup utility that deletes local configuration, generates environment-variable removal scripts, and can optionally delete a remote Tencent Cloud CAM role. That behavior materially exceeds and conflicts with the stated purpose of an architecture governance/assessment skill, which should be read-only or minimally invasive. In this skill context, the mismatch increases risk because users may invoke the skill expecting assessment/reporting, not local and cloud-side deletion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script can delete a remote CAM role using available AK/SK credentials, which is a destructive cloud action unrelated to architecture assessment or reporting. If invoked in the wrong context or by a misled user, it can remove IAM functionality and disrupt dependent workloads or access patterns; the skill context makes this especially dangerous because users would not reasonably expect an assessment tool to perform remote deletion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This code creates a CAM role, enables console login, attaches broad policies, and writes persistent local configuration, which materially differs from the declared purpose of architecture assessment and report generation. That mismatch is dangerous because users or orchestrating agents may grant trust to a supposedly analytical tool that actually performs identity and access management changes, leading to unauthorized privilege establishment or persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

If certifi is unavailable, the fallback SSL context disables hostname verification and certificate validation entirely before sending signed cloud API requests. This permits man-in-the-middle interception or modification of STS traffic, potentially exposing secrets or returning attacker-controlled temporary credentials or responses.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script generates direct Tencent Cloud console SSO URLs from temporary credentials, enabling interactive console access rather than merely producing architecture findings. In the context of an assessment-only skill, this is dangerous because it creates a path to privileged console access that is out of scope and could be used to pivot into manual or automated account actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code reads long-lived cloud credentials from environment variables and uses them to assume IAM/CAM roles, despite the skill being presented as an assessment/reporting tool. This creates an unnecessary privileged execution path that could be abused by the skill or by downstream changes to access cloud resources beyond assessment scope.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/setup_role.py (reported line 44)May include surrounding context.

python

if platform.system() == "Windows":
        # Windows 10+ 的 cmd/PowerShell 支持 ANSI（需 VT100）
        try:
            os.system("")  # 激活 VT100 模式
            return True
        except Exception:
            return False

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This setup script goes beyond passive architecture assessment and actively creates a CAM role and attaches broad policies, materially changing the user's cloud IAM posture. Even with an interactive prompt, this is dangerous in a skill described as an assessment/reporting tool because users may not expect privileged identity modifications or understand the security consequences of granting QcloudTAGFullAccess and QcloudAdvisorFullAccess.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

When certifi is unavailable, the fallback SSL context disables hostname checking and certificate verification entirely, allowing man-in-the-middle interception of requests and responses. Because this script transmits signed cloud API requests and potentially sensitive response data, disabling TLS verification materially undermines confidentiality and integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction '请严格按照' is written in Chinese and directs contributors to follow contribution rules, effectively imposing a specific language/locale context without any opt-in or documented justification. The policy explicitly flags language or locale requirements when a skill forces a specific language without offering user choice.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法 v3.md:779

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法.md:484

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/login_url.py:86

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/tcloud_api.py:50