Cloud Architecture Canvas

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:00 AM UTC
• Version: 1.4.0

Overview

This appears to be a real Tencent Cloud Smart Advisor helper, but it should be reviewed carefully because it handles cloud credentials, creates broad console-enabled roles, and has unsafe transport and scoping gaps.

Install only if you are comfortable giving this skill Tencent Cloud API credentials and allowing it to create or use a console-login CAM role. Prefer a dedicated least-privilege subaccount or temporary credentials, avoid storing long-term AK/SK values in shell profiles, review the role policies before creation, and do not use it in environments where certifi may be missing until the TLS fallback and host allowlisting issues are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:45

Finding

TLS Certificate Validation Is Disabled When certifi Is Unavailable

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:82

Finding

Generic API Client Sends Authentication Material to a Caller-Controlled Host

Content

View full analysis

dict: ``` ```python headers = { "Authorization": authorization, "Content-Type": "application/json; charset=utf-8", "Host": host, "X-TC-Action": action, "X-TC-Timestamp": str(timestamp), "X-TC-Version": version, "X-TC-Region": region, } if token: headers["X-TC-Token"] = token req = Request( f"https://{host}", data=payload_str.encode("utf-8"), headers=headers, method="POST", ) ``` ```python args = sys.argv[1:] if len(args) < 4: print(_output_json(_make_error( "", "MissingParameter", "Missing required parameters. Usage: python3 tcloud_api.py " " [payload] [region]" ))) sys.exit(1) service = args[0] host = args[1] action = args[2] version = args[3] payload_str = args[4] if len(args) > 4 else "{}" region = args[5] if len(args) > 5 else "ap-guangzhou" ``` ### Technical Analysis The command-line interface accepts `service`, `host`, `action`, and `version` directly from the caller. No allowlist, hostname syntax validation, service-to-host binding, or IP-literal rejection is applied before an authenticated request is sent. The generated request can contain: - The Tencent Cloud SecretId in the `Authorization` credential scope. - A request signature derived from the SecretKey. - The complete `X-TC-Token` when temporary credentials are in use. - Caller-provided payload data. The long-term SecretKey is not directly transmitted. Nevertheless, sending the temporary token and credential-bea ...[truncated 1307 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Long-Term Cloud Credentials Are Persisted in Plaintext Shell Profiles

Content

View full analysis

> ~/.bashrc echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc source ~/.bashrc ``` Windows PowerShell: ```powershell [Environment]::SetEnvironmentVariable( "TENCENTCLOUD_SECRET_ID", "your-secret-id", "User" ) [Environment]::SetEnvironmentVariable( "TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User" ) ``` ``` ### Technical Analysis The Skill instructs users to persist long-term Tencent Cloud credentials as plaintext in shell startup files or user-level environment-variable storage. It further presents persistence as mandatory rather than optional. Shell profiles are not purpose-built secret stores. Their contents may be exposed through: - Local processes operating under the same user account. - Backup and synchronization systems. - Diagnostic or support bundles. - Accidental source-control commits. - Shell configuration sharing. - Malware or malicious local extensions. - Overly permissive profile-file permissions. Although the scripts do not themselves write the SecretKey to these files, the Skill’s required setup procedure causes the user to do so. ### Attack Path 1. A user follows the mandatory setup instructions. 2. The long-term SecretId and SecretKey are stored in plaintext in a startup file or user environment. 3. A local process, compromised extension, backup recipient, or unintended repository reader obtains the file. 4. The attacker extracts the credentials. 5. The attacker authenticates to Tencent Cloud with all perm ...[truncated 517 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create_role.py:42

Finding

Created Console Role Receives Excessive Full-Access Policies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: check_env.py:346

Finding

Mandatory “Read-Only” Environment Check Performs Persistent Writes and Role Assumption

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (60)

Tainted flow: 'req' from os.environ.get (line 228, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/login_url.py (reported line 236)May include surrounding context.

python

)

    ctx = _get_ssl_context()
    with urlopen(req, context=ctx) as resp:
        result = json.loads(resp.read().decode("utf-8"))

    response_body = result.get("Response", {})

Tainted flow: 'req' from os.environ.get (line 186, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tcloud_api.py (reported line 195)May include surrounding context.

python

try:
        ctx = _get_ssl_context()
        with urlopen(req, context=ctx, timeout=30) as resp:
            response_body = resp.read().decode("utf-8")
    except HTTPError as e:
        try:

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The security claim is materially misleading: AK/SK-authenticated API calls necessarily send signed request material over the network, even if the raw secret key is not directly logged or persisted. Incorrect assurances about secret handling can cause operators to underestimate exposure, deploy the skill in inappropriate environments, and miss needed controls around network egress and credential use.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明描述强调的是“智能顾问”业务能力本身，即查询架构目录、架构详情、评估结果、风险评估项，以及开通服务等面向用户的腾讯云智能顾问 API 操作。而实际代码块并未实现这些业务查询或开通功能；它的主要用途是环境自检与配置验证。虽然代码确实调用了腾讯云相关 API（如 DescribeArchList、GetCallerIdentity、GetRole），但这些调用仅用于鉴权与环境探测，不是为了提供声明中的核心功能。此外，代码还执行了描述中未提及的本地配置保存、版本更新检查、角色配置探测、以及调用 login_url.py 验证免密登录等能力。这些属于与声明主功能 materially different 的行为，因此应判定为描述与代码行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose is a Tencent Cloud Intelligent Advisor assistant for querying and managing cloud architecture and risk assessment data via authenticated API calls. The actual code instead packages the skill into several zip files with altered metadata/branding. It does not implement any cloud architecture queries, risk assessment retrieval, service enablement, AK/SK auth, network access, or Tencent Cloud API usage. Its primary purpose is build/release packaging, which is unrelated to the declared runtime assistant behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是“腾讯云智能顾问助手”的业务操作能力，重点在于查询云架构目录、架构详情、评估结果、风险评估项，以及开通服务；而实际代码块的主要目的完全不同，是“配置清理/卸载”工具。它访问和修改的是本地文件系统、环境变量，并可对云端 CAM 角色执行删除操作，这些都未在声明中体现。尤其删除云端角色属于高影响管理能力，与声明中的只读查询/服务开通场景明显不一致。因此该代码与声明存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的核心能力是“智能顾问业务数据查询/管理”，如云架构图、评估结果、风险项和服务开通；而这段代码并未调用任何智能顾问相关 API，也没有执行架构图或风险评估查询。相反，它执行的是账号与权限初始化相关的 CAM 角色创建和授权操作，属于高敏感 IAM 写入能力。虽然“支持开通智能顾问服务”可能与前置授权存在一定关联，但当前代码的主要目的和实际行为明显偏向权限配置而非智能顾问数据操作，且这一 IAM 写入能力未在描述中被明确表达，因此构成明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述聚焦于“腾讯云智能顾问 API”的业务能力，例如查询云架构目录、架构详情、评估结果和风险评估项，并支持开通服务。但实际代码的核心功能完全不同：它是登录辅助工具，用于基于 AK/SK 和 CAM 角色生成腾讯云控制台免密登录链接。代码中没有任何 Advisor 相关 API 调用、没有云架构/风险评估数据处理逻辑，也没有开通智能顾问服务的实现。相反，它访问的是 STS 与登录回调相关资源，并依赖角色配置、临时凭证和签名算法来构造 SSO URL。这属于与声明主目的 materially different 的行为，且包含未声明的能力，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 94% confidence

Finding

The skill instructs users to persist long-lived cloud credentials by appending them to shell startup files or user-level environment settings. Persisting AK/SK in ~/.bashrc, ~/.zshrc, or user-wide environment storage increases credential exposure to local compromise, accidental disclosure, shell-history mishandling, backups, and downstream tools that inherit the environment.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

��变量配置密钥：

1.1 必填环境变量

• TENCENTCLOUD_SECRET_ID — 腾讯云 SecretId（必填）
• TENCENTCLOUD_SECRET_KEY — 腾讯云 SecretKey（必填）

密钥获取地址：https://console.cloud.tencent.com/cam/capi

环境变量必须永久写入 shell 配置文件，确保新会话中仍然生效：

Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）：

bash

echo 'export TENCENTCLOUD_SECRET_ID="your-secret-id"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell（写入用户级环境变量）：

powershell

[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")

1.2 角色配置（免密登录需要）

为生成控制台免密登录链接，需要配置 CAM 角色。角色配置分为 检测 和 创建 两个独立步骤，角色创

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md

- 插件必须包含 `SKILL.md` 文件，描述插件的功能、调用方式和输出格式

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The statement that keys 'will not be transmitted over the network' is inaccurate because authenticated API requests necessarily use those credentials, or derived signatures from them, in remote requests. This is dangerous because it gives users a false sense of secret-handling safety when the skill performs network-authenticated cloud operations.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · check_env.py (reported line 261)May include surrounding context.

python

nd("TENCENTCLOUD_SECRET_ID")
        if not secret_key:
            missing.append("TENCENTCLOUD_SECRET_KEY")
        log_fail(f"未配置以下环境变量: {', '.join(missing)}")
        log_info("")
        log_info("  请将腾讯云 API 密钥永久写入 shell 配置文件：")
        log_info("")
        log_info("  Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）:")
        log_info('    echo \'export TENCENTCLOUD_SECRET_ID="your-secret-id"\' >> ~/.bashrc')
        log_info('    echo \'export TENCENTCLOUD_SECRET_KEY="your-secret-key"\' >> ~/.bashrc')
        log_info("    source ~/.bashrc")
        log_info("")
        log_info("  Windows PowerShell（写入用户级环境变量）:")
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")')
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")')
        log_info("")
        log_info("  密钥获取地址: https:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script performs privileged IAM/CAM write operations by creating a role and attaching policies, which exceeds the skill’s stated architecture/risk query focus. In an agent setting, bundling identity-management changes into a helper skill increases the chance of unauthorized privilege changes or surprise side effects if invoked by the model or user without strong approval controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script attaches broad managed policies (QcloudTAGFullAccess and QcloudAdvisorFullAccess) to the created role, granting more access than a read/query-oriented advisor skill should typically need. Overly broad permissions expand blast radius if the role is misused, compromised, or assumed unexpectedly, especially in a cloud environment where tagging and advisor permissions may expose or alter security-relevant resources and metadata.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script generates passwordless Tencent Cloud console login URLs, which is materially more powerful than the skill's declared advisor-query and architecture/risk-management functionality. This creates an undocumented access-enablement capability that can be abused to pivot from API usage into interactive console access, expanding privileges and attack surface beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

When certifi is unavailable, the code disables certificate and hostname verification entirely, allowing man-in-the-middle interception of STS requests. Because those requests carry signed authentication material and receive temporary credentials, an active network attacker could tamper with responses or redirect sensitive traffic.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/setup_role.py (reported line 44)May include surrounding context.

python

if platform.system() == "Windows":
        # Windows 10+ 的 cmd/PowerShell 支持 ANSI（需 VT100）
        try:
            os.system("")  # 激活 VT100 模式
            return True
        except Exception:
            return False

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

If certifi is unavailable, the code disables both certificate validation and hostname verification, allowing man-in-the-middle interception of signed Tencent Cloud API requests. Because this script handles cloud API credentials and management actions, an attacker on the network path could impersonate the API endpoint and capture sensitive request data or manipulate responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Disabling TLS certificate and hostname verification removes core transport authentication and makes HTTPS susceptible to interception and spoofing. Since this code sends authenticated cloud-management requests, exploitation could lead to response tampering, request capture, and misuse of sensitive cloud operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction is written entirely in Chinese and mandates strict compliance, which effectively imposes a specific language/locale on contributors without offering any language choice or opt-in. This matches the policy category for language or locale constraints expressed in natural language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README advertises capabilities beyond the stated skill scope, including passwordless console login generation and role/environment management. Scope expansion in an agent skill is security-relevant because users and reviewers may grant broader trust than intended, and these features can enable account access or IAM changes if invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Documenting passwordless console login link generation without a strong warning understates the account-access implications of the feature. Such links can grant direct console access or facilitate access transfer, so presenting them as a convenience feature without prominent consent and risk language is dangerous in an agent setting.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example trigger phrases are broad enough to overlap with ordinary cloud-assistant conversations, increasing the chance the skill is invoked in contexts the user did not explicitly intend. In a skill that can query architecture data, generate console login links, or assist with role-related setup, ambiguous activation expands the attack surface and may lead to unintended privileged actions or disclosure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description and invocation guidance are written as mandatory Chinese-language operating instructions and do not indicate that the user may choose another language. Under the policy for natural-language violations, forcing a specific language without opt-in is reportable unless a justified region-specific constraint is documented.

Content

No source excerpt is available for this finding.