xCloud Agent Skills

• Outcome: Review
• Latest audit: Aug 5, 2026 · 11:06 AM UTC
• Version: 4.0.1

Overview

This skill is for managing xCloud hosting and is not deceptive, but it exposes powerful server, WordPress, and account actions with some sensitive operations not clearly gated.

Install only if you want an agent to operate your xCloud hosting account. Prefer the MCP OAuth connector with read-only access until write access is needed, use narrowly scoped tokens for the REST fallback, and require explicit confirmation before firewall, PHP runtime, site deletion, token revocation, SSH, sudo-user, certificate deletion, or magic-login actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill advertises shell-based operational capability via a shared bash/curl wrapper, but the manifest does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: an agent platform or reviewer may underestimate the skill's ability to execute shell commands or write files, increasing the chance of overbroad execution in sensitive environments.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The skill mandates vendor-branded phrasing for every progress and action line, overriding normal assistant response style and reducing transparency about when the model is following tool-author instructions versus user preferences. While not directly enabling code execution or data exfiltration, this can manipulate user perception and constrain honest, neutral communication in a way that weakens trust boundaries.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This documentation exposes security-sensitive and potentially disruptive firewall, fail2ban, and IP whitelisting operations without any caution about lockout, traffic interruption, or service exposure. In an agent skill context, presenting destructive network-control actions as routine examples increases the chance an agent or user applies them without understanding the connectivity impact.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document exposes destructive and state-changing server operations such as uninstalling PHP versions, changing the default runtime, toggling OPcache, and patching without any explicit warning about service impact, compatibility risk, or rollback considerations. In an agent-skill context, this increases the chance an automated agent or inattentive user will invoke disruptive actions on production infrastructure without informed confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation includes a concrete example that performs a state-changing backup creation request immediately, without any surrounding warning that it consumes resources or should only be run with explicit user intent. In an agent-skill context, examples are often copied or invoked directly, so a write operation presented like a read-only reference increases the risk of unintended actions against production sites.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs agents to generate one-time admin magic-login URLs, which are highly sensitive because possession of the URL can grant privileged account access without normal authentication. Although the file notes the URLs are single-use and short-lived and says not to log them, it does not require explicit user confirmation, authorization checks, or a strong warning before performing the action, increasing the risk of unintended privileged access exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

cat >&2 <<'EOF'
error: XCLOUD_API_TOKEN is not set.

Step 1 — Create an API token in xCloud:
  xCloud dashboard -> Profile -> API Tokens -> Generate New Token
  -> choose the scopes you need (e.g. read:servers) -> copy it (shown only once).

• Confidence: 74% confidence
• Finding: Create an API token in xCloud: xCloud dashboard -> Profile -> API Tokens -> Generate New Token -> choose the scopes you need (e.g. read:servers) -> copy it (shown only once). Step 2 — Store it pe

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: requests==2.28.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: plugins/xcloud/reference/conventions.md:67