腾讯云 CloudBase · Tencent CloudBase

• Outcome: Review
• Latest audit: Oct 16, 2026 · 4:23 AM UTC
• Version: 1.92.138

Overview

This CloudBase skill is mostly coherent, but it needs Review because one documented path can persistently expand a shared cloud role's permissions without a clear mandatory per-change confirmation.

Install only if you are comfortable granting a CloudBase-focused agent broad cloud-management capability. Before allowing CAM policy attachment, FullAccess policy use, environment deletion, domain/DNS/CDN changes, or plaintext credential reveal, require an explicit prompt showing the exact target, policy or action, persistence, and rollback plan.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/cloud-api-operations/references/calling-methods.md:132

Finding

Persistent Cloud Role Privilege Expansion Without Mandatory Per-Change Confirmation

Content

View full analysis

Vulnerability Details

File Location: references/cloud-api-operations/references/calling-methods.md:132-149
Vulnerability Type: Persistent cloud IAM privilege expansion
Risk Level: High

Vulnerable Instruction Segment

text

cam/ListPolicies → cam/AttachRolePolicy → cam/ListAttachedRolePolicies

The same section permits attaching predefined policies to TCB_QcsRole, including broad write policies such as:

text

QcloudMonitorFullAccess
QcloudSSLFullAccess
QcloudCDNFullAccess
QcloudDNSPodFullAccess
QcloudAuditFullAccess

It also explains that adding a policy expands the role's permission surface and that every caller obtaining temporary credentials for the role inherits the new permissions.

Technical Analysis

When an API call fails with UnauthorizedOperation or AuthFailure, the documented recovery path allows an agent operating under an account-level identity to call cam/AttachRolePolicy directly instead of requiring the user to approve the persistent IAM change through the authorization page.

This converts a failure of one requested operation into a durable permission change on a shared service role. The attached policy is not scoped to the current request or session. Any future process that assumes TCB_QcsRole receives the newly attached permissions.

The file recommends read-only policies where possible, but this is advisory rather than an enforced confirmation boundary. It also lists broad FullAccess policies as valid choices. The directly routed references/cloud-api-operations/SKILL.md does not require loading the Change Safety Protocol before following this recovery procedure. Although references/cloudbase-platform/references/protocols/change-safety-protocol.md separately requires explicit confirmation for access-control changes, that requirement is not incorporated into this direct execution path.

There is no evidence that this behavior was included with malicious intent. It is therefore classified ...[truncated 1782 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation immediately before every cam/AttachRolePolicy invocation.
2. Present the following information before requesting confirmation:
   • Exact target role.
   • Exact policy name.
   • Whether the policy is read-only or permits writes.
   • Principal cloud actions and products covered.
   • The fact that the attachment persists after the current session.
   • The fact that all future callers assuming the role inherit the permission.
3. Default to a task-specific custom policy containing only the required actions and resources.
4. Prefer read-only predefined policies where the requested task does not require mutation.
5. Never automatically attach a FullAccess policy as an authorization-error recovery step.
6. Require the agent to load and follow references/cloudbase-platform/references/protocols/change-safety-protocol.md before any CAM policy attachment.
7. Add a post-operation cleanup option that detaches temporary task-specific authorization after verification, while requiring confirmation before removal if other workloads may depend on it.
8. Record the role, policy, confirmation, attachment result, and cleanup status in an audit trail without recording credentials.
9. Prefer directing the user to the interactive CAM authorization page when persistent permission expansion is necessary, rather than silently applying the change through the current account identity.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (263)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/ai-model-web/SKILL.md (reported line 237)May include surrounding context.

md

const app = cloudbase.init({
  env: "<YOUR_ENV_ID>",
  accessKey: import.meta.env.VITE_PUBLISHABLE_KEY  // auto-provision via queryAppAuth / manageAppAuth, write to .env.local (see auth-web-cloudbase prerequisites)
});

const auth = app.auth;

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly instructs users to request temporary credentials with reveal=true and states the plaintext STS credential triplet will be returned. Even though the credentials are temporary, exposing secrets in plaintext within an interactive assistant/tooling context materially increases the risk of accidental disclosure via chat logs, screenshots, copy/paste, telemetry, or prompt leakage.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cloudbase-agent/py/adapter-coze.md (reported line 122)May include surrounding context.

For production, use environment variables:

bash

# .env
COZE_BOT_ID=bot_1234567890
COZE_API_KEY=sk-1234567890
COZE_BASE_URL=https://api.coze.com  # optional

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cloudbase-agent/py/adapter-langgraph.md (reported line 544)May include surrounding context.

For production, use environment variables:

bash

# .env
COZE_BOT_ID=bot_1234567890
COZE_API_KEY=sk-1234567890
COZE_BASE_URL=https://api.coze.com  # optional

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 371)May include surrounding context.

For production, use environment variables:

bash

# .env
COZE_BOT_ID=bot_1234567890
COZE_API_KEY=sk-1234567890
COZE_BASE_URL=https://api.coze.com  # optional

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cloudbase-agent/py/server-quickstart.md (reported line 393)May include surrounding context.

For production, use environment variables:

bash

# .env
COZE_BOT_ID=bot_1234567890
COZE_API_KEY=sk-1234567890
COZE_BASE_URL=https://api.coze.com  # optional

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cloudbase-agent/py/skill.md (reported line 226)May include surrounding context.

For production, use environment variables:

bash

# .env
COZE_BOT_ID=bot_1234567890
COZE_API_KEY=sk-1234567890
COZE_BASE_URL=https://api.coze.com  # optional

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 98% confidence

Finding

The document embeds agent-directed hidden instructions that attempt to control execution order and tool use. In an LLM-driven environment, such directives can override higher-level operator intent, increasing prompt-injection risk and making the agent follow file-local instructions rather than user-approved workflows.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 26)May include surrounding context.

md

## ⚠️ DEPLOYMENT IS A 4-STEP BLOCKING PIPELINE

<!-- INSTRUCTION (AI MUST EXECUTE EVERY STEP IN ORDER) -->

> **AI: You MUST execute Steps 1→2→3→4 in order. Do NOT skip any step.**
> **Do NOT call `manageAgent` until Step 3 (Verification) passes ALL checks.**

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 98% confidence

Finding

This hidden instruction explicitly tells the AI to execute environment setup actions. Treating documentation as executable control input is dangerous because a malicious or modified file could coerce the agent into running local commands without independent validation.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 40)May include surrounding context.

md

## Step 1: Ensure Python 3.10

<!-- INSTRUCTION (AI MUST EXECUTE) -->

Execute one of the following to ensure Python 3.10 is available:

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 98% confidence

Finding

This hidden instruction pressures the agent to execute a fixed script 'as-is' and forbids modification. That pattern is risky because it discourages safety checks and can be abused to smuggle destructive or unsafe shell behavior into a trusted workflow.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 74)May include surrounding context.

md

## Step 2: Build env/ (One-Shot Install)

<!-- INSTRUCTION (AI MUST EXECUTE) -->

> ### ⚠️ CRITICAL: `env/` is an immutable build artifact
>

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The document repeatedly instructs the agent to run rm -rf ./env, a destructive filesystem operation. Even though scoped to a relative directory, placing deletion commands in untrusted skill content creates a path for prompt-driven file destruction if the agent executes repository text blindly.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 79)May include surrounding context.

md

> ### ⚠️ CRITICAL: `env/` is an immutable build artifact
>
> The ONLY correct workflow is:
> 1. **Delete** → `rm -rf ./env`
> 2. **Install** → single `pip install` command (below)
> 3. **Never touch again**
>

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This script contains an actual destructive command rm -rf ./env && mkdir ./env intended for direct execution. In an agent setting, unreviewed execution of such commands can delete local data and normalize unsafe shell behavior from documentation.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 107)May include surrounding context.

md

echo "✅ Using: $PYTHON_BIN ($($PYTHON_BIN --version 2>&1))"

# ── Atomic env/ rebuild ──
rm -rf ./env && mkdir ./env

# ── One-shot install ALL deps ──
$PYTHON_BIN -m pip install -r ./requirements.txt \

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 98% confidence

Finding

This hidden instruction conditions tool usage on checks defined inside the same untrusted document. That gives repository content undue authority over agent behavior and can be leveraged to gate, delay, or redirect deployment steps in unsafe ways.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 126)May include surrounding context.

md

## Step 3: Verify env/ Integrity (MANDATORY)

<!-- INSTRUCTION (AI MUST EXECUTE) -->

> **Do NOT call `manageAgent` until ALL checks below pass.**
> **If ANY check fails, the ONLY fix is: edit requirements.txt → rm -rf env/ → re-run Step 2.**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The text asserts that the 'ONLY fix' is deleting env/, pressuring the agent toward a destructive action without contextual safety checks. Such rigid instructions are risky because they reduce the chance of safer troubleshooting and can be repurposed in adversarial docs.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 129)May include surrounding context.

md

<!-- INSTRUCTION (AI MUST EXECUTE) -->

> **Do NOT call `manageAgent` until ALL checks below pass.**
> **If ANY check fails, the ONLY fix is: edit requirements.txt → rm -rf env/ → re-run Step 2.**

### 3a. Verify all top-level packages are present

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This line operationalizes deletion as the default remediation path after failed verification. Repeated destructive advice increases the chance an automated agent performs filesystem changes based solely on markdown content.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 170)May include surrounding context.

md

for f in failed:
        print(f'  ❌ MISSING: {f}')
    print()
    print('Fix: Check requirements.txt spelling, then rm -rf env/ and re-run Step 2')
    sys.exit(1)
else:
    print()

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This troubleshooting instruction again directs deletion of env/ in response to import failures. In the context of an agent skill, repetitive destructive remediation is unsafe because it can be triggered automatically from untrusted content.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 226)May include surrounding context.

md

if failed:
    print(f'\n❌ Import verification failed for: {failed}')
    print('Fix: Ensure these are in requirements.txt, then rm -rf env/ and re-run Step 2')
    sys.exit(1)
else:
    print('\n✅ All imports verified')

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Calling deletion the 'Golden Rule' strongly biases the agent toward destructive action and discourages alternative diagnosis. That is dangerous in a prompt-injection context because the repository content is attempting to dictate filesystem changes authoritatively.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 261)May include surrounding context.

md

> **Golden Rule: ANY problem with `env/` has exactly ONE fix:**
> ```
> edit requirements.txt (if needed) → rm -rf env/ → re-run Step 2 script → re-run Step 3
> ```
> **There is NO other fix. Never deviate from this.**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This recovery step again recommends rm -rf env/ after dependency resolution issues. While the target appears limited, direct destructive commands in skill content are hazardous because agents may execute them without verifying that the path is safe or expected.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 269)May include surrounding context.

md

- **Cause**: A package doesn't have a `manylinux2014_x86_64` wheel for Python 3.10
- **Fix**: Pin a version in `requirements.txt` that has a compatible wheel, or check spelling
- **Then**: `rm -rf env/` → re-run Step 2

### Error: `ModuleNotFoundError` at runtime (ANY module)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The same destructive pattern appears for runtime module errors, reinforcing unsafe automated deletion behavior. The issue is not the specific directory alone but the normalization of shell deletion commands embedded in adversarially modifiable documentation.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 276)May include surrounding context.

md

- **Cause 1**: The module is missing from `requirements.txt` → add it
- **Cause 2**: `env/` was built with Python 3.11+ → ensure Python 3.10, rebuild
- **Cause 3**: `env/` was built incrementally (multiple pip installs) → rebuild atomically
- **Fix**: `rm -rf env/` → re-run Step 2

### Error: Namespace package submodule missing (e.g., `cloudbase_agent.xxx`)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This line recommends deletion for namespace package issues, continuing the unsafe pattern of repository-controlled filesystem operations. In an AI-agent workflow, such instructions can be abused to trigger destructive actions under the guise of maintenance.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 281)May include surrounding context.

md

### Error: Namespace package submodule missing (e.g., `cloudbase_agent.xxx`)

- **Cause**: Multiple `pip install` commands into `env/` caused namespace package fragmentation
- **Fix**: `rm -rf env/` → re-run Step 2 (single command installs all packages atomically)

### ⛔ PROHIBITED OPERATIONS (will cause deployment failures)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The summary restates rm -rf env/ as a standard rebuild rule, reinforcing destructive behavior as normative. Because the skill is agent-consumable, this increases the likelihood of unsafe command execution from documentation text.

Content

Scanner excerpt · references/cloudbase-agent/py/agent-deployment.md (reported line 430)May include surrounding context.

md

| **Python runtime** | Python 3.10 (MUST USE, `runtime="Python3.10"`) |
| **Dependency strategy** | Local pre-packaging to `./env` (**MUST use Python 3.10 interpreter**, `installDependency=false`) |
| **Build workflow** | Step 1 (Python) → Step 2 (build env/) → Step 3 (verify) → Step 4 (deploy) |
| **env/ rebuild rule** | ALWAYS atomic: `rm -rf env/` → single `pip install` — NEVER incremental |
| **Default platform** | HTTP Cloud Functions |
| **Fallback platform** | CloudRun (only for special requirements) |
| **Startup script** | `scf_bootstrap` — set `PYTHONPATH="./env:$PYTHONPATH"`, do NOT `pip install` at startup |

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/cloudbase-agent/py/references/observability.md (reported line 185)May include surrounding context.

async with httpx.AsyncClient() as client: response = await client.get(url, headers=headers)

Extract context from incoming request

context = extract_trace_context(request.headers)

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cloudbase-agent/py/server-quickstart.md (reported line 291)May include surrounding context.

1. CloudBase Agent Native Endpoint

bash

curl -X POST http://localhost:9000/chatbot/send-message \
  -H "Content-Type: application/json" \
  -d '{
    "conversationId": "conv_123",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

This duplicate finding points to the same risky command: rm -f /private/var/folders/*/*/T/cloudapp-*.zip. In a security review, the presence of a destructive shell command embedded in operational instructions is a real risk because agents or users may run it verbatim without verifying what files match the glob.

Content

Scanner excerpt · references/cloudbase-cli/references/app.md (reported line 217)May include surrounding context.

md

**规避**（三选一，推荐 ①+③）：
1. 部署时显式传 `--ignore "**/target/**"`（CLI）或 `ignore: ["**/target/**", ...]`（MCP deployApp）
2. 项目根 `cloudbaserc.json` 的 `app.ignore` 加 `**/target/**`（CLI 会合并）
3. 部署完成后删除残留：`rm -f /private/var/folders/*/*/T/cloudapp-*.zip`（部署进程异常时残留不清理会堆积）

**判断**：部署日志显示 "Project directory: xxx" 只代表 framework 检测目录，**不代表打包目录**；怀疑打包过大时先看生成的 zip 大小。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

This duplicate finding points to the same risky command: rm -f /private/var/folders/*/*/T/cloudapp-*.zip. In a security review, the presence of a destructive shell command embedded in operational instructions is a real risk because agents or users may run it verbatim without verifying what files match the glob.

Content

Scanner excerpt · references/cloudbase-cli/references/app.md (reported line 217)May include surrounding context.

md

**规避**(三选一,推荐 1+3):
1. 部署时显式传 `--ignore "**/target/**"`(CLI)或 `ignore: ["**/target/**", ...]`(MCP deployApp)
2. 项目根 `cloudbaserc.json` 的 `app.ignore` 加 `**/target/**`(CLI 会合并)
3. 部署完成后删除残留:`rm -f /private/var/folders/*/*/T/cloudapp-*.zip`(部署进程异常时残留不清理会堆积)

**判断**:部署日志显示 "Project directory: xxx" 只代表 framework 检测目录,**不代表打包目录**;怀疑打包过大时先看生成的 zip 大小。

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/ai-model-nodejs/references/custom-onboarding.md:21

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/ai-model-web/SKILL.md:207

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/ai-model-wechat/SKILL.md:243

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/cloud-storage-web/SKILL.md:185

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/postgresql-development-cloudbase/SKILL.md:184