Security audit

Cloud Architecture Canvas

Security checks across malware telemetry and agentic risk

Overview

This skill is a real Tencent Cloud Advisor helper, but it asks for broad cloud authority and has under-scoped credential, IAM, and console-login behavior that users should review carefully before installing.

Install only if you are comfortable granting Tencent Cloud credentials to a skill that can create/delete IAM roles, attach broad policies, assume roles, and generate console login URLs. Use a least-privilege subaccount or temporary credentials, avoid storing long-lived AK/SK values in shell startup files, treat generated login URLs as sensitive access links, and review or patch the TLS fallback before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill description frames the capability mainly as querying Tencent Cloud Advisor data, but the body also instructs IAM role creation/deletion, local config persistence, environment-variable persistence, STS-based login URL generation, and cleanup actions. This behavioral expansion matters because users may invoke what appears to be a read-oriented cloud assistant while actually authorizing privileged IAM writes and long-lived credential persistence.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The README describes capabilities beyond the stated Smart Advisor API management scope, including passwordless console login, environment checks, and role-related operations. Scope expansion in an agent skill is dangerous because it can cause the agent to perform higher-risk actions than users or platform reviewers expect, especially when those actions touch authentication, IAM, or local configuration.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The documentation claims the skill centers on six Smart Advisor APIs, but elsewhere advertises non-API control-plane capabilities such as console login generation and setup actions. This mismatch can mislead users and reviewers about the real trust boundary of the skill, increasing the chance that privileged actions are approved under the guise of read-only advisory functionality.

Intent-Code Divergence

High

Confidence: 92% confidence
Finding: The security section states that AK/SK are not transmitted over the network, yet the skill's purpose is to authenticate Tencent Cloud API calls using those credentials. Even if the raw secret key is not sent verbatim, the statement is materially misleading because credential-derived authentication data necessarily traverses the network, which can cause operators to underestimate credential exposure and signing risks.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The role-creation instructions are internally inconsistent: one section says the role attaches only QcloudAdvisorFullAccess and even calls it read-only, while another later section says the same flow attaches both QcloudTAGFullAccess and QcloudAdvisorFullAccess. Conflicting IAM scope is dangerous because it can cause overprivileged role creation without the user understanding the actual access granted.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file claims to be read-only and not modify configuration, but save_config() writes persistent data under ~/.tencent-cloudq and changes filesystem permissions. That mismatch is dangerous because users and calling agents may grant trust based on the script's description, while it actually performs local state changes.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: A script presented as an environment checker for Tencent Cloud advisor also executes an external clawhub command, adding local command-execution and supply-chain/PATH-hijack exposure outside the stated purpose. In agent or automation contexts, hidden extra capabilities are risky because they may run in environments where local binaries are attacker-controlled.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The script launches another local script to validate role assumption, which exceeds pure environment inspection and introduces extra execution surface. In a hostile or tampered installation, login_url.py could be replaced or modified, turning a benign check into unintended code execution under the user's context.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation requires generating a passwordless console login link whenever architecture details are returned, which expands the skill from data retrieval into direct console-access enablement. That creates a sensitive capability escalation: an agent answering a read/query request could mint fresh authenticated access links to the Tencent Cloud console, increasing the chance of unauthorized console entry, link leakage, or phishing-style relay of privileged access.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The cleanup script can delete a cloud-side CAM role named "advisor", which is a destructive IAM action outside the skill's stated user-facing purpose of querying advisor data and enabling the service. Even though deletion is optional and gated by flags/confirmation, bundling IAM role deletion into a local cleanup utility expands the blast radius and can remove shared or still-needed access configuration if run with valid credentials.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The file implements broad local cleanup of configuration, cache, and Tencent Cloud credential-related environment variables, but the skill description does not disclose these destructive local actions. This mismatch is security-relevant because users or reviewers may authorize the skill for read/query operations while overlooking that it also includes credential and configuration removal behavior.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script's stated behavior includes creating a CAM role and attaching broad permissions, which is a privileged IAM write operation beyond simple advisor data retrieval. In an agent skill context, bundling identity-management changes into a helper script increases the chance of unexpected privilege changes and expands the blast radius if the skill is invoked or repurposed improperly.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code performs CreateRole and AttachRolePolicy operations, giving the skill direct ability to modify identity and access configuration. Because it creates a console-login-enabled role and attaches full-access policies, compromise or misuse of the skill could result in persistent overprivileged access rather than a transient read-only API call.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script adds a passwordless Tencent Cloud console login capability that is materially broader than the skill’s declared purpose of Advisor API interactions and service activation. In an agent context, generating delegated console login URLs can grant interactive console access and enable actions outside the narrowly described workflow, increasing the blast radius if invoked unexpectedly or by prompt manipulation.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code performs STS AssumeRole and generates console access callback URLs, effectively turning long-lived credentials into delegated browser sessions. That is a sensitive privilege-escalation/access-delegation workflow not justified by a read/query-oriented Advisor assistant and could be abused to obtain broad console access if the role is overprivileged.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script reads long-lived AK/SK from environment variables and role configuration from local files, then uses them to mint delegated sessions. While reading credentials is not inherently malicious, in this skill it supports a broader undocumented access path and increases the chance that highly sensitive secrets are repurposed for console access beyond the expected Advisor API scope.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The setup script does more than advisory/query operations: it can create CAM roles and attach policies, materially changing the user's cloud IAM configuration. In skill context, this is more dangerous because the advertised purpose is an advisor assistant, so automatic privilege and role management exceeds least surprise and increases blast radius if the skill is used with high-privilege credentials.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Granting `QcloudTAGFullAccess` is broader than the stated need of viewing Advisor information and generating console access for that service. In this context, overprivileged policy attachment is dangerous because compromise or misuse of the created role would extend access into unrelated resource-tagging capabilities across the account.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The function is a generic signed Tencent Cloud API client that accepts arbitrary service, host, action, and version values, while the skill is described as an Advisor-specific assistant. In an agent setting, this expands capability far beyond the declared scope and can let prompts or downstream code trigger authenticated calls against other Tencent Cloud services using the same credentials.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The top-level trigger description includes broad everyday phrases for architecture, risk, and advisory tasks, which can cause accidental invocation of a skill that handles cloud credentials and may lead into IAM-changing workflows. In this context, overbroad activation is more dangerous because the skill is not purely informational; it can reach sensitive cloud APIs and guide users into persistent credential setup.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The per-interface trigger words are too generic and lack context binding, increasing the chance that normal conversation terms trigger API-oriented actions. Because some flows can culminate in write operations like CreateAdvisorAuthorization or role setup, accidental activation can expose users to unintended privileged actions or confusing consent prompts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document instructs users to call an API that enables Advisor authorization and explicitly notes it will also enable report interpretation and cloud architecture collaboration permissions, but it does not present this as a privileged state-changing action requiring confirmation or warning. In an agent skill context, this omission is dangerous because an assistant may perform or recommend the action as if it were a harmless read-only query, causing unintended account-level capability changes.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document includes credential-bearing headers and parameters such as Authorization, SecretId, and Token in request examples without explicitly warning that these values are secrets and must never be logged, shared, or embedded in client-side contexts. In an agent skill that may be used to generate or display requests for users, this can normalize unsafe handling of cloud credentials and increase the chance of accidental credential leakage through logs, transcripts, screenshots, or copied examples.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The v1 examples show SecretId and Signature directly in the URL query string and POST body without warning that query parameters are commonly captured by browser history, reverse proxies, web server logs, analytics tooling, and intermediaries. Although this reflects the legacy API style, documenting it without prominent leakage warnings in a cloud-management skill increases the risk that users will copy insecure patterns into production workflows and expose credential material or replayable request metadata.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The `--all` flag disables per-item confirmation and proceeds with destructive deletion of local state, increasing the risk of accidental loss of configuration and cached data. While this is a CLI usability/safety issue rather than covert compromise, it still creates unsafe behavior because a single mistyped or automated invocation can trigger irreversible cleanup without a final warning barrier.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: advisor-2020-07-21/调用方式/签名方法 v3.md:779

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: advisor-2020-07-21/调用方式/签名方法.md:484

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/login_url.py:86

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/tcloud_api.py:50