xCloud Agent Skills

• Outcome: Review
• Latest audit: Sep 24, 2026 · 10:52 PM UTC
• Version: 4.4.2

Overview

This skill is not malicious, but it needs review because it can control real xCloud infrastructure and its docs contain confusing REST-vs-MCP instructions for sensitive changes.

Install only if you intend to let an agent manage your xCloud account. Prefer the MCP OAuth flow or a least-privilege read-only token, review any requested write/billing scope, and require explicit confirmation for deployments, deletions, server changes, token revocation or payments. Treat non-GET `$XC` examples as documentation only; mutations should go through confirmed MCP tools or the xCloud dashboard.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (123)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 388)May include surrounding context.

md

`mcp__xcloud__*` tools when connected; fall back to `scripts/xcloud.sh`
  otherwise.** Verified live: 110 MCP tools = full parity with the live API's
  110 authenticated operations.
- **Site deletion** (`DELETE /sites/{uuid}`) in `xcloud:sites` — granular
  `delete_*` flags (files, database, user, local backups, DNS record), async,
  documented with a hard confirm-first guardrail.
- **Git-deployed site provisioning** (`POST /servers/{uuid}/sites/git`) in

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 414)May include surrounding context.

md

### Notes

- API-token management (`GET /user/tokens`, `DELETE /user/tokens/{tokenUuid}`)
  and `GET /health` are intentionally REST-only; `xcloud:account` keeps using
  the bundled wrapper for them.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 478)May include surrounding context.

md

### Fixed

- **`xcloud:account` token revocation now matches the live API.** The skill
  documented `DELETE /user/tokens/{tokenId}` as a numeric id, but the API keys
  revocation by the token's `uuid` (live OpenAPI: `DELETE
  /user/tokens/{tokenUuid}`, `string`/`uuid`) and `GET /user/tokens` returns
  `uuid`. Corrected the endpoint, made the list example surface `uuid` (so the

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 479)May include surrounding context.

md

- **`xcloud:account` token revocation now matches the live API.** The skill
  documented `DELETE /user/tokens/{tokenId}` as a numeric id, but the API keys
  revocation by the token's `uuid` (live OpenAPI: `DELETE
  /user/tokens/{tokenUuid}`, `string`/`uuid`) and `GET /user/tokens` returns
  `uuid`. Corrected the endpoint, made the list example surface `uuid` (so the
  revoke flow is completable from list output), and fixed the matching note in

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 72)May include surrounding context.

md

## Deployment and billing risks

- Git deployment can run repository build/start scripts and replace the site checkout (`git reset --hard` / `git clean -df`). Inspect the target, source and impact first.
- Private repositories need authorized access; never bypass failed detection by forcing an app type.
- Server-wide runtime changes can affect other sites. Disclose this scope.
- Preview/dry run, then obtain approval for concrete creates, retries, redeploys, destructive changes and charges.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 29)May include surrounding context.

md

## Deployment and billing risks

- Git deployment can run repository build/start scripts and replace the site checkout (`git reset --hard` / `git clean -df`). Inspect the target, source and impact first.
- Private repositories need authorized access; never bypass failed detection by forcing an app type.
- Server-wide runtime changes can affect other sites. Disclose this scope.
- Preview/dry run, then obtain approval for concrete creates, retries, redeploys, destructive changes and charges.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · plugins/xcloud/skills/deploy/SKILL.md (reported line 145)May include surrounding context.

md

## Deployment and billing risks

- Git deployment can run repository build/start scripts and replace the site checkout (`git reset --hard` / `git clean -df`). Inspect the target, source and impact first.
- Private repositories need authorized access; never bypass failed detection by forcing an app type.
- Server-wide runtime changes can affect other sites. Disclose this scope.
- Preview/dry run, then obtain approval for concrete creates, retries, redeploys, destructive changes and charges.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

> **Packaged REST boundary (v4.4.2):** `xcloud.sh` enforces GET-only requests with no body and has no write override. Non-GET examples below describe upstream A

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

stom API-host risks, process visibility and destructive operations. [Changelog](CHANGELOG.md) records upstream changes. `SHA256SUMS.txt` verifies package bytes;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · plugins/xcloud/reference/auth.md (reported line 19)May include surrounding context.

md

**before** falling back to a raw API token.
2. **REST API token (fallback).** For agents without MCP support, and for the
   REST-only operations (`/health`, API-token list/revoke). The Public API
   authenticates via [Sanctum personal access tokens](https://laravel.com/docs/sanctum)
   (Bearer auth) — everything below covers this path.

## Environment variables

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · plugins/xcloud/reference/auth.md (reported line 95)May include surrounding context.

Recommended — ~/.claude/settings.json (loads on every session):

1. Open the file (exact path ~/.claude/settings.json, i.e. /Users/<you>/.claude/settings.json). For example:

   bash

   nano ~/.claude/settings.json
   

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · plugins/xcloud/reference/mcp.md (reported line 100)May include surrounding context.

md

> do not shell out to `scripts/xcloud.sh` for operations the MCP covers.**
> Fall back to the REST wrapper only when (a) the MCP server is not connected,
> or (b) the operation is REST-only (`/health`, `GET /user/tokens`,
> `DELETE /user/tokens/{tokenUuid}`).

Why MCP first: typed parameters, contract validation before the call, a
built-in confirm-before-destructive gate, team-scoped OAuth instead of a raw

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · plugins/xcloud/reference/mcp.md (reported line 122)May include surrounding context.

md

| `GET /sites/{uuid}/deploy-diagnosis` | `sites.deploy-diagnosis` | `sites_deploy-diagnosis` |
| `POST /sites/{uuid}/provision-retry` | `sites.provision-retry` | `sites_provision-retry` |
| `POST /sites/{uuid}/ssl/renew` | `sites.ssl.renew` | `sites_ssl_renew` |
| `DELETE /sites/{uuid}` | `sites.destroy` | `sites_destroy` |

Every tool description embeds its REST path and operation id, so the endpoint
tables in each skill map 1:1 to tool names on the flat profile and to

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · plugins/xcloud/scripts/xcloud.sh (reported line 16)May include surrounding context.

sh

# override flag or environment variable.
#
# Reads:
#   XCLOUD_API_TOKEN            (required) Sanctum personal access token
#   XCLOUD_API_BASE_URL         (default https://app.xcloud.host) — custom hosts
#                               must be https:// (see XCLOUD_ALLOW_INSECURE_HTTP)
#   XCLOUD_ALLOW_INSECURE_HTTP  (optional) set to 1 to permit a plaintext http://

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · plugins/xcloud/reference/auth.md (reported line 92)May include surrounding context.

md

-> choose read-only scopes only (e.g. read:servers) -> copy it (shown only once).

Step 2 — Store it persistently for Claude Code:
  a. Open  ~/.claude/settings.json   (e.g.  nano ~/.claude/settings.json )
  b. Add an "env" block with your token:
       {
         "env": {

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · plugins/xcloud/reference/auth.md (reported line 94)May include surrounding context.

md

-> choose read-only scopes only (e.g. read:servers) -> copy it (shown only once).

Step 2 — Store it persistently for Claude Code:
  a. Open  ~/.claude/settings.json   (e.g.  nano ~/.claude/settings.json )
  b. Add an "env" block with your token:
       {
         "env": {

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · plugins/xcloud/reference/auth.md (reported line 97)May include surrounding context.

md

-> choose read-only scopes only (e.g. read:servers) -> copy it (shown only once).

Step 2 — Store it persistently for Claude Code:
  a. Open  ~/.claude/settings.json   (e.g.  nano ~/.claude/settings.json )
  b. Add an "env" block with your token:
       {
         "env": {

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · plugins/xcloud/scripts/xcloud.sh (reported line 46)May include surrounding context.

sh

-> choose read-only scopes only (e.g. read:servers) -> copy it (shown only once).

Step 2 — Store it persistently for Claude Code:
  a. Open  ~/.claude/settings.json   (e.g.  nano ~/.claude/settings.json )
  b. Add an "env" block with your token:
       {
         "env": {

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares a strict REST safety boundary ('GET-only', 'no write override', 'do not bypass') but the same document later instructs the agent to use the same wrapper for DELETE and PUT operations. That contradiction can cause an agent or maintainer to trust the boundary while still being nudged into destructive actions such as revoking API tokens or mutating alert state, defeating the claimed safeguard.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill says token management is REST-only and 'always use $XC' even though the opening boundary says the wrapper is GET-only and cannot perform writes. This specifically normalizes using the fallback path for token revocation, a destructive credential-management action, which increases the chance of unauthorized or unintended token deletion if an agent follows the later instruction instead of the earlier safety claim.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · plugins/xcloud/reference/auth.md (reported line 127)May include surrounding context.

md

| One alert | `GET /alerts/{alertUuid}` | `read:servers` or `read:sites` |
| Mark an alert read / unread | `PUT /alerts/{alertUuid}/read` | `read:servers` or `read:sites` |
| List API tokens | `GET /user/tokens` | token (`*`) |
| Revoke a token | `DELETE /user/tokens/{tokenUuid}` | token (`*`) |
| List Cloudflare integrations | `GET /integrations/cloudflare` | `read:servers` |
| List connected Git providers | `GET /integrations/git` | `read:servers` |
| Repositories a provider exposes | `GET /integrations/git/{provider_uuid}/repositories` | `read:servers` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · plugins/xcloud/reference/mcp.md (reported line 225)May include surrounding context.

md

| One alert | `GET /alerts/{alertUuid}` | `read:servers` or `read:sites` |
| Mark an alert read / unread | `PUT /alerts/{alertUuid}/read` | `read:servers` or `read:sites` |
| List API tokens | `GET /user/tokens` | token (`*`) |
| Revoke a token | `DELETE /user/tokens/{tokenUuid}` | token (`*`) |
| List Cloudflare integrations | `GET /integrations/cloudflare` | `read:servers` |
| List connected Git providers | `GET /integrations/git` | `read:servers` |
| Repositories a provider exposes | `GET /integrations/git/{provider_uuid}/repositories` | `read:servers` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · plugins/xcloud/skills/account/SKILL.md (reported line 54)May include surrounding context.

md

| One alert | `GET /alerts/{alertUuid}` | `read:servers` or `read:sites` |
| Mark an alert read / unread | `PUT /alerts/{alertUuid}/read` | `read:servers` or `read:sites` |
| List API tokens | `GET /user/tokens` | token (`*`) |
| Revoke a token | `DELETE /user/tokens/{tokenUuid}` | token (`*`) |
| List Cloudflare integrations | `GET /integrations/cloudflare` | `read:servers` |
| List connected Git providers | `GET /integrations/git` | `read:servers` |
| Repositories a provider exposes | `GET /integrations/git/{provider_uuid}/repositories` | `read:servers` |

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

After stating that non-GET REST operations below are not executable, the document includes concrete $XC mutation commands for DELETE and PUT. In practice, copy-pastable examples are stronger than prose constraints, so this can train or prompt an agent to attempt state-changing actions through the fallback wrapper despite the supposed read-only boundary.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This concrete example shows a destructive DELETE operation against a token UUID using the same $XC wrapper that is advertised as read-only. Because token revocation is irreversible for the affected credential and examples are highly actionable, an agent may execute or recommend a destructive call through an unsafe or contradictory path, causing loss of access or denial of service for integrations using that token.

Content

Scanner excerpt · plugins/xcloud/skills/account/SKILL.md (reported line 110)May include surrounding context.

bash

TOKEN_UUID='8c1f3a89-2c4e-4a73-9d4c-8b1f2a3d4e5f'
"$XC" DELETE "/user/tokens/$TOKEN_UUID" | jq '.message'

Teams and unread error alerts:

Static analysis

No suspicious patterns detected.