CloudPlus

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:10 AM UTC
• Version: 1.0.0

Overview

This CloudPlus skill is aligned with enterprise chat use, but it needs review because it can install a persistent global npm tool and perform sensitive chat actions without clear confirmation safeguards.

Review this skill before installing. It can act through a CloudPlus enterprise account, send messages and files, read chat history or collected content, and open links or apps. Only use it if you trust the cloudplus-mcp-server npm package and are comfortable with a global install; require explicit confirmation for sends, file transfers, link/app opens, and sensitive data retrieval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:24
• Finding: Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-31 **Vulnerability Type**: Untrusted and unpinned third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash **Step 2: Check whether mcp-cloudplus is installed** ```bash which mcp-cloudplus ``` If the command does not exist, perform the installation: ```bash npm install -g cloudplus-mcp-server ``` ``` The prose shown in the original file is written in Chinese; the executable commands above are reproduced exactly. ### Technical Analysis The skill instructs the agent to install `cloudplus-mcp-server` globally from the npm registry whenever `mcp-cloudplus` is unavailable. The installation does not specify a reviewed version, package integrity hash, trusted registry, lockfile, or provenance requirement. Consequently, npm resolves and installs whatever release is current at execution time. npm packages can execute lifecycle scripts during installation, and global installation places package executables in a shared command path. A compromised maintainer account, malicious package release, registry compromise, or unexpected upstream change could therefore result in arbitrary code execution. Because the executable is installed globally, the action also modifies the user's persistent development environment rather than creating an isolated, task-scoped dependency. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or its distribution path and publishes a malicious release. 2. The target environment does not already contain the `mcp-cloudplus` executable. 3. The agent follows the skill instructions and runs `npm install -g cloudplus-mcp-server`. 4. npm downloads the current unpinned release. 5. Malicious package files or lifecycle scripts execute with the privileges of the account running npm. 6. The package can install a malicious `mcp-cloudplus` executable globally. 7. Subsequent CloudPlus operations invoke the attacker-controlled ...[truncated 707 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example: ```bash npm install --global --ignore-scripts cloudplus-mcp-server@<reviewed-version> ``` 2. Verify the expected package publisher, registry URL, provenance, and integrity hash before installation. 3. Prefer a project-local, locked dependency over a global installation. 4. Execute the CLI from an isolated environment with narrowly scoped filesystem and network permissions. 5. Disable npm lifecycle scripts unless they are required and have been audited. 6. Require explicit user approval before installing or modifying software. 7. Validate the resolved executable path before invocation so that an unrelated or attacker-controlled binary cannot satisfy the `which` check. 8. Periodically audit the pinned package and update it only after reviewing the new release. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39
• Finding: Shell Command Injection Through Unquoted Dynamic CLI Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39-98 **Vulnerability Type**: OS command injection through unsafe shell command construction **Risk Level**: High ### Vulnerable Code The skill presents multiple commands containing dynamic values without defining safe argument handling: ```bash mcp-cloudplus send-text --to <用户名或群名> --message <内容> ``` ```bash mcp-cloudplus send-file --to <用户名或群名> --file <文件路径> ``` ```bash mcp-cloudplus search-user <关键词> ``` ```bash mcp-cloudplus search-group-chat <关键词> ``` ```bash mcp-cloudplus search-file <关键词> ``` ```bash mcp-cloudplus search-message <关键词> ``` ```bash mcp-cloudplus search-light-apps <关键词> ``` ```bash mcp-cloudplus get-chat-history --username <用户名或群名> --start <YYYY-MM-DD> [--end <YYYY-MM-DD>] ``` ```bash mcp-cloudplus open-url <url> ``` ```bash mcp-cloudplus open-app <应用名> ``` The placeholders in these excerpts are reproduced exactly from the source and represent usernames, group names, content, paths, keywords, dates, URLs, and application names. ### Technical Analysis The documented commands place dynamic, potentially user-controlled values directly into shell command templates. The skill does not require an argument-array API, shell escaping, strict input validation, or the `--` end-of-options marker. If an agent implements these templates by textual substitution and passes the resulting string to a shell, whitespace can change argument boundaries and shell metacharacters can introduce additional commands, substitutions, redirections, or pipelines. Values beginning with a hyphen may also be interpreted as unexpected CLI options. Message content, search terms, contact names, file paths, URLs, and application names are particularly likely to contain spaces or punctuation. Quoting alone is not a complete defense if values are inserted into a preconstructed shell string using an incorrect escaping scheme. ### Attack Path 1. An attacker supplies a crafted value for a dynami ...[truncated 1599 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct a shell command by concatenating or interpolating dynamic values. 2. Invoke `mcp-cloudplus` directly through a process execution API that accepts an argument array. Conceptually: ```text executable: mcp-cloudplus arguments: ["send-text", "--to", recipient, "--message", message] shell: disabled ``` 3. Treat recipient names, messages, paths, keywords, dates, URLs, and application names as opaque argument values. 4. Use `--` before positional user-controlled arguments where supported to prevent option injection. 5. Apply allowlist validation appropriate to each field: - Require valid `YYYY-MM-DD` dates. - Restrict URLs to approved schemes and, where appropriate, approved hosts. - Resolve and validate file paths before sending files. - Reject null bytes and invalid encoding. 6. If a shell is unavoidable, apply platform-appropriate escaping to every dynamic argument independently. Do not rely on simple quotation or character replacement. 7. Add tests using spaces, quotes, leading hyphens, substitutions, command separators, redirections, and newline characters to confirm that every supplied value remains one inert argument. 8. Require user confirmation before sending messages or files, especially when targets or paths were derived from untrusted input. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is broad enough to match generic messaging, search, file, or app-opening requests that may not explicitly reference CloudPlus. That can cause the skill to activate in contexts where the user did not intend to interact with CloudPlus, increasing the chance of unintended message sending, file transfer, history access, or link/app opening in a real enterprise account.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill can send messages, send files, open URLs, open apps, and launch CloudPlus, all of which change application state or can trigger external actions, yet there is no warning or confirmation requirement. In an enterprise messaging context, unintended execution could cause data leakage, phishing exposure, or unauthorized communication from the user’s account.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill includes commands to retrieve chat history and collected content, both of which may expose highly sensitive enterprise communications or stored materials, but it provides no warning or consent guidance. In the context of a communications skill, this makes accidental over-collection or disclosure more likely, especially if the skill is auto-selected from broad user requests.

Description-Behavior Mismatch

Low

• Confidence: 93% confidence
• Finding: The manifest says the skill is for sending messages/files, searching contacts/groups/files/messages, and opening apps or links in CloudPlus. The documented command set also includes `get-collect-content`, which is a separate data-retrieval capability not mentioned in the description.

Static analysis

No suspicious patterns detected.