cloudcc-cli-dev

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:54 AM UTC
• Version: 1.0.1

Overview

This CloudCC development skill is not malicious, but it needs Review because it can install an unpinned global CLI with elevated privileges and publish CRM assets using developer credentials.

Install only if you intentionally use CloudCC CRM development tooling. Avoid sudo npm installation where possible, pin and verify the cloudcc-cli package, use least-privileged CloudCC credentials, work in a dev or staging org first, and require a human diff/review before any pull or publish command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: INSTALL_AND_BOOTSTRAP.md:13

Finding

Unpinned npm Package Installation with Root Privileges

Content

View full analysis

Vulnerability Details

File Location: INSTALL_AND_BOOTSTRAP.md:13-16
Related Locations: SKILL.md:9, INSTALL_AND_BOOTSTRAP.md:36
Vulnerability Type: Unpinned third-party dependency installation and privileged npm execution
Risk Level: Medium

Vulnerable Code

bash

npm i -g cloudcc-cli
sudo npm i -g cloudcc-cli

The generated project dependencies are also installed without a documented lockfile-integrity requirement:

bash

npm i

In addition, SKILL.md:9 instructs the agent to install the global cloudcc-cli package whenever it is unavailable.

Technical Analysis

The documentation installs the current registry release of cloudcc-cli without specifying an audited version, integrity hash, trusted registry, package provenance, or verified publisher. The audited project does not include the package implementation, a package.json, a lockfile, a checksum, or signature information that would allow the downloaded artifact to be validated against the reviewed content.

npm packages and their transitive dependencies may execute lifecycle scripts during installation. If the package publisher, registry account, release process, or a transitive dependency is compromised, an attacker could introduce arbitrary executable code into a release after this Skill has been reviewed.

The suggested sudo npm i -g command substantially increases the consequence of such a supply-chain compromise because installation scripts may execute with root privileges. The unqualified npm i command used in a generated project can similarly resolve dependency versions not represented in this repository unless the generated project contains and enforces a trusted lockfile.

Attack Path

1. An attacker compromises the cloudcc-cli package, its publisher account, or one of its transitive dependencies.
2. The attacker publishes a malicious version containing an npm lifecycle script or malicious runtim ...[truncated 1695 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin cloudcc-cli to a specific, reviewed version rather than installing the latest registry release:

   bash

   npm install --global cloudcc-cli@<audited-version>
   

2. Verify the package name, npm publisher, source repository, release provenance, and registry before installation.

3. Record and verify the expected package integrity digest or use npm provenance and signature verification where supported.

4. Remove the recommendation to execute npm through sudo. Configure a user-owned global npm prefix, use an isolated development container, or invoke a locally pinned dependency instead.

5. Prefer a project-local development dependency with an exact version and execute it through a controlled package script.

6. Require a reviewed lockfile for generated projects and replace unrestricted npm i usage with:

   bash

   npm ci
   

7. Disable package lifecycle scripts during initial inspection where practical, then explicitly permit only scripts that have been reviewed.

8. Require explicit user confirmation before installing dependencies or publishing assets to a CloudCC environment.

9. Run the CLI under a least-privileged operating-system account and use CloudCC credentials limited to the minimum required development environment and permissions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow tells users/agents to pull and publish backend assets but, at the workflow step itself, does not reiterate that synchronization only affects the code between @SOURCE_CONTENT_START and @SOURCE_CONTENT_END and that pull can overwrite the synchronized fragment. In an automation-oriented CLI skill, this omission can lead to accidental loss of code or unintended deployment of backend logic, especially when an agent follows the checklist mechanically.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL_AND_BOOTSTRAP.md (reported line 16)May include surrounding context.

npm i -g cloudcc-cli

macOS（通常需要 sudo）

sudo npm i -g cloudcc-cli

text

### 验证版本

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs the AI on a required output structure entirely in Chinese and uses mandatory phrasing such as “AI 必须输出”, but it does not offer the user any language or locale choice. This creates a natural-language policy issue if the organization expects user language preference or opt-in rather than a forced locale.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description says user mentions of broad terms like CloudCC, cloudcc-cli, cc 命令, objects, fields, triggers, timers, or custom components should preferentially activate this skill. This can cause the skill to trigger in contexts where the user did not explicitly request it, increasing the chance of unintended tool use, project creation, package installation, or workspace modification in a development environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document instructs users to run a publish command that compiles, packages, and uploads a component to a server, but it does not explicitly warn that this performs remote transfer and deployment-side changes. In a CLI assistant context, that omission can cause unintended publication of proprietary code, test artifacts, or incomplete components to a shared or production environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

A natural-language policy issue applies across all file types when a skill forces a specific language without user opt-in. This file presents all instructions solely in Chinese and does not indicate that the skill is intentionally limited to Chinese-speaking users or provide an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file is written as a user-facing CLI cheat sheet, but the heading and surrounding instructional text are entirely in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a violation when no alternative language or locale justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown guidance forces a specific language/locale for all users through its natural-language instructions. The policy requires flagging cases where a skill mandates a language without user opt-in or a documented justification for the locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description is written entirely in Chinese and presents the skill behavior and invocation guidance in that language without indicating that users may choose another language. This can be a natural-language policy issue when a skill implicitly constrains interaction language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file presents all user-facing instructions in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. The policy requires avoiding forced language or locale constraints unless the choice is user-controlled or clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.