cloudcc-cli-dev

• Analyzed: May 15, 2026, 8:00 AM
• Findings: 1
• Version: 1.0.1
• Hash: 04659ee9aaa4b37c9bd151ae7f863431e9079edd74be572bc1797261ba61bd4e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a development toolkit for CloudCC CRM but contains patterns that pose significant security risks. Specifically, BACKEND_CODE.md and CLI_CHEATSHEET.md instruct the AI agent to construct complex shell commands using nested subshells and 'node -e' execution, which are highly susceptible to shell injection if the agent incorporates unsanitized user input. Additionally, INSTALL_AND_BOOTSTRAP.md encourages high-privilege operations by recommending global npm installations via 'sudo'. While the skill includes beneficial security boundaries (e.g., explicitly forbidding the leakage of 'CloudCCDev' keys or 'secretKey' in SKILL.md), the underlying execution patterns are inherently vulnerable.