Tccli Cvm

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 0.1.0

Overview

The skill is mostly a normal Tencent Cloud CVM helper, but it asks agents to persist instance login passwords in plaintext and includes broad remote command execution guidance.

Install only if you are comfortable with a skill that can manage billable Tencent Cloud resources and may guide the agent to run shell commands on instances. Do not save instance passwords in the defaults file; prefer SSH keys, environment variables, runtime entry, or a secrets manager, and use narrowly scoped Tencent Cloud permissions instead of broad TAT access where possible.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:38

Finding

Plaintext Persistence of Cloud Instance Login Passwords

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-72
Vulnerability Type: Plaintext credential storage
Risk Level: High

The Skill permits a cloud instance login password to be saved in the workspace-local .claude/tccli-cvm-defaults.json file.

json

{
  "imageId": "img-iws3975f",
  "imageName": "Debian 13.2 64-bit",
  "instanceType": "S5.MEDIUM2",
  "systemDisk": { "DiskType": "CLOUD_PREMIUM", "DiskSize": 30 },
  "instanceChargeType": "SPOTPAID",
  "internetAccessible": {
    "PublicIpAssigned": true,
    "InternetChargeType": "TRAFFIC_POSTPAID_BY_HOUR",
    "InternetMaxBandwidthOut": 20
  },
  "loginSettings": { "Password": "YOUR_STRONG_PASSWORD_HERE" }
}

text

When the user asks to save current parameters as defaults, create a default config file, set defaults, or "remember these settings":

1. Confirm the fields to save, usually `imageId`, `instanceType`, `systemDisk`, `instanceChargeType`, `internetAccessible`, and `loginSettings`.
2. If the configuration includes a password, explicitly tell the user that the password will be stored in plaintext in `.claude/tccli-cvm-defaults.json`, a local workspace file that should be ignored by Git.
3. Create `.claude/` under the workspace root if needed.
4. Write `.claude/tccli-cvm-defaults.json`.
5. Read it back and validate JSON format.
6. Tell the user the path, saved fields, and that future instance creation will reuse these defaults.

Security guidance:

- Prefer environment variables or runtime user input for passwords.
- Do not commit `.claude/tccli-cvm-defaults.json`.
- Delete the file to return to ask-every-time mode.

Technical Analysis

The password is deliberately written to an unencrypted JSON file and reused for future instance creation. Warning the user and recommending Git exclusion do not adequately secure the credential. The file can remain accessible to other local users or processes, workspace synchr ...[truncated 1736 chars]

Remediation

View remediation

Remediation Suggestions

• Remove loginSettings.Password from the supported persistent-default fields.
• Prefer SSH public-key authentication and disable password-based remote login where operationally possible.
• Obtain passwords only at runtime through a non-echoing prompt or an approved secrets manager.
• Store only a secret reference or identifier in the workspace configuration, never the secret value itself.
• If local secret storage is unavoidable, use an operating-system credential store or encrypted secrets file and enforce owner-only permissions.
• Add schema validation that rejects loginSettings.Password when saving defaults.
• Add .claude/tccli-cvm-defaults.json to .gitignore, but treat this only as defense in depth rather than the primary control.
• Document credential rotation and removal procedures for any passwords previously saved in this file.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:102

Finding

Cloud Instance Password Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:102-114
Vulnerability Type: Sensitive information exposure through process arguments and command history
Risk Level: Medium

The documented instance-creation command embeds the login password directly in a command-line argument.

bash

tccli cvm RunInstances \
  --region ap-guangzhou \
  --Placement '{"Zone":"ap-guangzhou-7"}' \
  --ImageId "img-iws3975f" \
  --InstanceType "S5.MEDIUM2" \
  --SystemDisk '{"DiskType":"CLOUD_PREMIUM","DiskSize":30}' \
  --InstanceChargeType "SPOTPAID" \
  --InternetAccessible '{"PublicIpAssigned":true,"InternetChargeType":"TRAFFIC_POSTPAID_BY_HOUR","InternetMaxBandwidthOut":20}' \
  --LoginSettings '{"Password":"YOUR_STRONG_PASSWORD_HERE"}' \
  --InstanceName "cvm-create-by-agent" \
  --InstanceCount 1

Technical Analysis

Supplying the password as part of --LoginSettings places the secret directly in the invoked command. Depending on the execution environment, commands may be retained in shell history, Agent execution logs, terminal recordings, audit telemetry, debugging output, or error reports. During execution, command arguments may also be visible through process-inspection interfaces to sufficiently privileged local users or monitoring software.

A placeholder is shown in the example, but normal use requires substituting the real password. The Skill is terminal-first and instructs the Agent to execute this command structure, so the exposure applies when the example is operationalized.

Attack Path

1. A user supplies a real instance password for CVM creation.
2. The Agent substitutes the password into the JSON value passed to --LoginSettings.
3. The complete command is executed or displayed in a terminal-first workflow.
4. The command is captured in shell history, Agent logs, terminal recordings, process telemetry, or process arguments.
5. An attacker or unauthorized operator with access to one ...[truncated 786 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer SSH key authentication so instance provisioning does not require a plaintext login password.
• Do not display, log, or persist commands containing credentials.
• Use a protected runtime input mechanism supported by the installed TCCLI version rather than interpolating secrets into command arguments.
• If a temporary request file is required, create it with owner-only permissions, prevent logging of its contents, and securely remove it immediately after use.
• Disable shell history for the sensitive operation and configure Agent or CI logging to redact password-bearing fields as defense in depth.
• Ensure errors and debug output cannot serialize LoginSettings.Password.
• Rotate any password that may already have appeared in command histories or execution logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly tells the agent to store passwords in plaintext in .claude/tccli-cvm-defaults.json and retain them for future reuse. Plaintext secret storage in the workspace is highly dangerous because other tools, plugins, logs, backups, or accidental commits can expose the credential, enabling unauthorized access to newly created instances.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill materially expands from CVM lifecycle management into post-provisioning remote command execution via TAT, which allows running shell commands on cloud instances. That creates a powerful execution path that can install software, alter systems, exfiltrate data, or establish persistence, and it is not constrained to narrowly scoped management actions in the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The TAT example shows how to Base64-encode and submit arbitrary shell commands for execution on target instances, effectively turning the skill into a remote shell launcher. This exceeds the stated purpose of managing CVM resources and introduces a direct mechanism for arbitrary code execution on customer infrastructure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent to read defaults, including loginSettings, from a workspace-local JSON file for reuse in future instance creation. Because the example and later instructions include passwords in loginSettings, this creates a mechanism for automated reuse of plaintext credentials from local storage, increasing the chance of accidental disclosure or misuse.

Content

No source excerpt is available for this finding.