Security audit

腾讯云跨账号资源迁移

Security checks for vulnerabilities and agentic risk

Overview

This Tencent Cloud migration skill is mostly purpose-aligned, but it handles cloud credentials unsafely and makes Terraform deployment/security claims that are not fully supported by the packaged artifact.

Review before installing. Use only in a controlled workspace with least-privilege, short-lived Tencent Cloud credentials; avoid generate --preview with real secrets; do not pass SecretKeys on command lines; add account.yaml, tc-migrate.yaml, terraform.tfvars, tfplan, and Terraform state files to .gitignore; restrict file permissions; and confirm that the missing Terraform configuration is supplied and audited before running apply, run, destroy, or any -y option.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: src/tc_migrate/commands/generate_cmd.py:25
Finding: Terraform Preview Discloses Both Tencent Cloud SecretKeys
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/tc_migrate/config.py:261
Finding: Cloud Credentials Are Duplicated into Plaintext Files Without Restrictive Permissions
Content: View full analysis
Path: """Save the configuration object as a YAML file.""" path = Path(output_path) path.parent.mkdir(parents=True, exist_ok=True) data = config.model_dump(mode="json") with open(path, "w", encoding="utf-8") as f: yaml.dump(data, f, default_flow_style=False, allow_unicode=True, sort_keys=False) return path ``` ```python # src/tc_migrate/commands/config_cmds.py:256-265 save_config(cfg, path) console.print(f"\n[bold green]✓[/] Configuration file generated: {path}") console.print(f" • UIN values populated automatically") console.print(f" • {len(cfg.vpcs)} VPCs added automatically") console.print(f" • VPCs with CIDR conflicts skipped automatically") if cfg.target_cidr_block: console.print(f" • Target network {cfg.target_cidr_block} automatically divided and allocated") console.print( " [dim]• Credentials are stored in account.yaml and also copied into tc-migrate.yaml[/]" ) ``` ```python # src/tc_migrate/tfvars.py:113-124 def generate_tfvars(config: MigrateConfig, output_path: str | Path) -> Path: """Generate a terraform.tfvars file from the configuration model.""" path = Path(output_path) path.parent.mkdir(parents=True, exist_ok=True) # Base section: authentication, VPC, and CCN content = TFVARS_TEMPLATE.render(config=config) # Append resource plug-in tfvars fragments content += _render_resource_plugins(config) path.write_text(content, encoding="utf-8") return path ``` The rendered content includes: ```python account_a_secret_id = "{{ config.account_a.secret_id }}" account_a_secret_key = ...[truncated 2520 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/tc_migrate/wizard.py:80
Finding: SecretKeys Are Echoed During Interactive Entry and Accepted as Process Arguments
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:4
Finding: Python Dependencies Are Installed from Open-Ended Version Ranges Without Integrity Verification
Content: View full analysis
=8.1.0 pyyaml>=6.0 rich>=13.0.0 pydantic>=2.0.0 jinja2>=3.1.0 tencentcloud-sdk-python>=3.0.0 ``` ```toml # src/pyproject.toml:15-22 dependencies = [ "click>=8.1.0", "pyyaml>=6.0", "rich>=13.0.0", "pydantic>=2.0.0", "jinja2>=3.1.0", "tencentcloud-sdk-python>=3.0.0", ] ``` ```bash # SKILL.md:36-39 pip install -r {baseDir}/requirements.txt ``` ### Technical Analysis All runtime dependencies use lower-bound-only version constraints. Installation can therefore resolve to future package versions that were not reviewed with this project. No lock file or hash-verified requirements are present in the audited directory structure. This does not prove that any currently named dependency is malicious. However, it weakens reproducibility and permits an unreviewed or compromised future release to enter the execution environment automatically. The risk is particularly relevant because these packages execute in a process that handles credentials for two cloud accounts. A compromised dependency could inspect in-memory credential objects, read generated files, alter migration settings, or execute additional operations. ### Attack Path 1. A future allowed dependency release is compromised, malicious, or otherwise unsafe. 2. A user follows the documented `pip install -r requirements.txt` instruction. 3. The package installer selects the unsafe version because the manifest only specifies a minimum version. 4. Package or runtime code executes in the Skill's Python environment. 5. The compromised component accesses cloud credentials, migration configuration, or local files available to the process. 6. It may leak credentials or alter cloud migration operations using the applicati ...[truncated 541 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (119)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior claims broad cross-account migration and CCN-based interconnection, but the analysis indicates the implemented functionality only covers a narrower subset and may even reference a different networking model. In infrastructure tooling, this mismatch is dangerous because operators may trust the skill to perform secure migration steps or network isolation controls that are not actually implemented, leading to partial migrations, insecure connectivity, or unintended resource changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The guide presents tc-migrate destroy as a simple example with no warning that it can permanently delete migrated infrastructure and potentially sever connectivity. In an infrastructure-automation context, omission of a deletion warning materially increases the risk of accidental destructive execution and production outage.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · reference/installation.md (reported line 73)May include surrounding context.
bash
# 添加 HashiCorp GPG key wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg # 添加仓库 echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · reference/installation.md (reported line 76)May include surrounding context.
bash
# 添加 HashiCorp GPG key wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg # 添加仓库 echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · reference/installation.md (reported line 73)May include surrounding context.
bash
# 添加 HashiCorp GPG key wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg # 添加仓库 echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · reference/installation.md (reported line 76)May include surrounding context.
bash
# 添加 HashiCorp GPG key wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg # 添加仓库 echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · reference/installation.md (reported line 79)May include surrounding context.
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

安装

sudo apt update && sudo apt install terraform

text
---

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The auto-generated configuration is saved after collecting account credentials, and the user-facing output explicitly says the secrets are also present in tc-migrate.yaml. Storing cloud API credentials in a general config file without a prominent pre-save warning or explicit consent materially increases the risk of credential leakage via version control, backups, file sharing, or overly broad filesystem access.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · src/tc_migrate/terraform.py (reported line 106)May include surrounding context.
python
cwd=str(tf_dir), capture_output=capture_output, text=True, env={**os.environ, "TF_IN_AUTOMATION": "1"}, ) return result

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The template renders account_a_secret_id, account_a_secret_key, account_b_secret_id, and account_b_secret_key directly into terraform.tfvars, and generate_tfvars() writes that content to disk in plaintext. In a cross-account cloud migration tool, these credentials are highly sensitive; if the file is read by other users, checked into source control, copied into logs/backups, or left on shared hosts, an attacker could gain broad control over both Tencent Cloud accounts.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The generated YAML embeds both source and destination cloud secret IDs and secret keys in plaintext, causing long-lived credentials to be persisted to disk. In a migration tool context this is especially dangerous because the file may be checked into source control, copied between systems, backed up, or read by other local users, exposing two Tencent Cloud accounts and enabling broad infrastructure compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to create and populate an account.yaml file with source and destination cloud account keys, then run an automated cross-account migration, but it does not warn that these credentials are highly sensitive or that the operation can create, modify, or connect major network resources across accounts. In this context, missing security guidance increases the likelihood of credential mishandling, accidental over-privileging, or unintended infrastructure changes with broad blast radius.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents commands that read environment/configuration, create and modify files, and execute shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the operational boundary ambiguous and can lead an agent runtime to grant broader capabilities than users expect, which is risky for a migration tool handling cloud credentials and infrastructure changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README exposes a destructive destroy command with no adjacent warning, safeguards, or confirmation expectations. In the context of cross-account cloud migration, this can lead users or agents to delete infrastructure, networking, or state-backed resources with severe availability and recovery consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document shows SecretId and SecretKey being stored in account.yaml and propagated into generated files such as terraform.tfvars, but it does not warn users to secure, restrict, or exclude those files from version control. In an infrastructure-migration tool, exposed cloud credentials can enable full compromise of one or both Tencent Cloud accounts, including unauthorized provisioning, data access, and network changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This section documents commands that initialize Terraform, generate plans, and apply infrastructure changes across accounts, but it lacks a clear safety warning about cost, outage, access-control, and network-impact risks. In this context, operators may execute the workflow without understanding that it creates or modifies production networking and compute resources, increasing the chance of disruptive misconfiguration.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation says under account A that '原有资源保持不变' while in the same section it states the tool performs 'CCN 跨账号关联申请（自动接受）'. Submitting and accepting a CCN cross-account association is an active change in the source account context, so the wording contradicts the described behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The apply command performs live Terraform changes, and allowing -y/--yes to skip confirmation reduces a key safeguard against accidental infrastructure modification. In a cross-account migration tool managing VPC, CLB, NAT, CVM, and security groups, undocumented non-interactive apply can lead to unintended production-impacting changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes a tool for cross-account resource migration, scanning, configuration generation, and Terraform deployment. This command reference additionally exposes destroy, which deletes all Terraform-managed resources; that is a powerful teardown capability not justified by the stated migration-focused purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document shows an account.yaml structure containing secret_id and secret_key for two cloud accounts but does not instruct users to protect the file, restrict permissions, or avoid committing it to version control. In a cross-account migration tool, these credentials are highly sensitive and could allow takeover or misuse of both source and target Tencent Cloud environments if exposed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire installation guide is written only in Chinese, and there is no indication that users may choose another language or that the language restriction is required for a region-specific compliance purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
bash
# 安装 yum-utils sudo yum install -y yum-utils # 添加 HashiCorp 仓库 sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
bash
# 安装 yum-utils sudo yum install -y yum-utils # 添加 HashiCorp 仓库 sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · reference/installation.md (reported line 38)May include surrounding context.
bash
# 安装 yum-utils sudo yum install -y yum-utils # 添加 HashiCorp 仓库 sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · reference/installation.md (reported line 73)May include surrounding context.
bash
# 安装 yum-utils sudo yum install -y yum-utils # 添加 HashiCorp 仓库 sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Missing User Warnings

Credential Access

Credential Access

Chaining Abuse

Chaining Abuse

Chaining Abuse

安装

Missing User Warnings

Env Variable Harvesting

Missing User Warnings

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Context-Inappropriate Capability

Missing User Warnings

Natural-Language Policy Violations

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution