Security audit

cloudbase

Security checks across malware telemetry and agentic risk

Overview

This is a real CloudBase development skill, but it needs review because it combines broad cloud/account authority with unsafe or under-scoped examples for auth, public exposure, deletion, logging, and global plugin setup.

Install only when you intentionally want CloudBase-specific agent help. Keep human confirmation enabled for plugin/MCP installation, account login, environment binding, public route changes, database/schema deletion, remote downloads, and deployments; review and harden any copied auth, CORS, logging, telemetry, and storage examples before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (49)

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The public-access guidance mixes different permission field names and semantics (`securityRule`, `rule`, `aclTag`, `permission`) for what appears to be the same operation. In a deployment/security-rule context, this ambiguity can cause operators or agents to apply the wrong setting, potentially making an HTTP function unintentionally public or otherwise misconfigured.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The method-routing section gives unqualified top-level guidance that browser uploads/downloads should use legacy APIs, while the same file later states those APIs must not be used in PG/pgstore mode. In an agent skill, early routing guidance strongly influences generated code, so this contradiction can cause agents to emit incorrect storage calls that fail open/closed in confusing ways, bypass intended permission models, or break security-sensitive upload flows.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The upload section heading and first example present app.uploadFile() as the default upload pattern even though the document elsewhere says PG mode must use app.storage.from('bucket').upload(...). Because example code is often copied verbatim by agents and users, this inconsistency can directly lead to insecure or nonfunctional implementations, especially in environments where storage permissions and bucket semantics differ materially.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The temporary-URLs section describes app.getTempFileURL() as the standard pattern without scoping it to legacy storage, despite the document explicitly prohibiting that API in PG mode. This can cause agents to generate broken access URL flows, mishandle object access controls, and encourage incorrect assumptions about how private file access should be granted under PG storage/RLS.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The example authentication middleware accepts requests without an Authorization header and assigns a default anonymous identity instead of rejecting the request. In a real deployment, this creates an authentication bypass pattern that developers may copy directly, allowing unauthenticated callers to access the agent and any downstream bot functionality under a shared identity.

Intent-Code Divergence

Low

Confidence: 94% confidence
Finding: The comment claims the anonymous-user fallback is only for development, but the code applies it unconditionally whenever the Authorization header is missing. This mismatch is dangerous because readers may trust the comment and deploy the sample unchanged, unintentionally exposing a permissive authentication path in production.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill materially contradicts itself: it is explicitly framed as the browser skill for CloudBase Relational Database using `@cloudbase/js-sdk`, yet it also says tasks mentioning `app.rdb()` should be routed to the PostgreSQL skill. Because `app.rdb()` is also shown as the canonical initialization API here, an agent can be misrouted and produce incorrect data-access guidance, increasing the chance of using the wrong security model or backend semantics.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The body of the document reinforces the same contradiction by teaching `app.rdb()` as the core API while separately instructing the agent to route any request mentioning `app.rdb()` to another skill. In an agent setting, this kind of conflict is dangerous because routing logic and code-generation guidance may diverge, causing the model to apply the wrong access pattern, permission assumptions, or migration path.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to use shell commands such as curl, wget, or Invoke-WebRequest to fetch remote assets into the project. This creates a real prompt-to-action risk because an agent following the skill could be induced to contact attacker-controlled URLs, write untrusted files to disk, or interact with internal network targets, increasing SSRF, supply-chain, and unsafe file ingestion exposure.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The NestJS AuthGuard example accepts any bearer token and sets request.user without actually validating authenticity, expiry, issuer, or audience. Because the sample is framed as an auth guard for token verification, developers may deploy it as-is and unintentionally grant access to protected endpoints to anyone presenting an arbitrary token string.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The top-level description contains very broad activation language such as develop, design, build, deploy, debug, migrate, and troubleshoot, which can cause the skill to activate for loosely related requests. In an agent setting, over-broad routing increases the chance that CloudBase-specific instructions and operational workflows are injected into contexts where they do not apply, potentially leading to incorrect tool usage or unnecessary access to cloud-management guidance.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation trigger section includes phrases that are common in ordinary software requests, such as UI generation, troubleshooting, architecture design, or minimal demo language, without always requiring a strong CloudBase discriminator. This makes misrouting more likely, and because the skill contains operational instructions around auth, deployment, MCP/CLI fallback, and resource management, accidental activation could steer an agent toward inappropriate cloud actions or misleading implementation guidance.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The troubleshooting scenario uses very generic activation signals such as '诊断', 'health check', 'troubleshooting', and '错误排查', which can match many ordinary support or debugging requests outside the intended CloudBase ops context. This can cause the wrong skill to activate, leading the agent to follow operational playbooks, request sensitive environment details, or provide infrastructure-focused guidance when a narrower skill would have been safer and more appropriate.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The demo scenario includes broad phrases like '快速 demo', 'todo app', 'Notes app', 'Kanban', and 'prototype-like' app concepts that commonly appear in general development requests. Because this skill is CloudBase-specific, such loose matching can incorrectly capture unrelated app-building tasks and steer the agent into CloudBase assumptions, inappropriate architectural choices, or unnecessary credential/environment setup guidance.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide demonstrates logging and returning persistent identifiers such as OPENID, APPID, and UNIONID directly to clients without emphasizing data minimization or privacy risks. Even if these values are platform-issued and trustworthy for server-side identity, exposing or routinely logging them increases the chance of identifier leakage through client logs, monitoring systems, screenshots, or downstream misuse.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The guide recommends enabling `traceUser: true` as optional but recommended, yet does not explain that this activates user access tracking in the CloudBase console and may increase collection of user-related metadata. In an auth-focused guide, presenting this as a default recommendation can lead developers to enable extra tracking without privacy review or user-notice considerations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guidance shows how to create an HTTP route for an event function with `auth: false`, which can expose backend functionality publicly without any adjacent warning about internet accessibility, authentication, or authorization requirements. In a CloudBase operations skill, this is more dangerous because users are likely to copy these snippets directly into production workflows, turning internal/server-side functions into unauthenticated public endpoints.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation instructs developers to place both the user ID and the full decoded JWT payload into adapter state without any warning about minimization, logging exposure, or downstream propagation. Because this is an AI/agent integration guide, copied examples may cause sensitive claims in tokens to be retained in memory, logged by middleware, or leaked to other components that do not need them.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation’s streaming example sends `run_input.messages` directly to an external OpenAI API, which can include user prompts, prior conversation history, and potentially sensitive state-derived content. In a developer skill, this is risky because it normalizes data egress to a third-party service without any warning, consent guidance, redaction advice, or mention of privacy/compliance implications.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation repeatedly instructs users to place the full decoded JWT payload into `state["__request_context__"]["user"]["jwt"]`, making all token claims available to downstream agents, adapters, and tools. In an agent framework, that broad propagation increases the chance of accidental exposure in logs, prompts, tool inputs, memory/state persistence, or authorization decisions based on untrusted or over-shared claims.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The observability examples explicitly include `user_id`, `conversation_id`, and later show capturing raw `input` in error reporting, which can normalize logging personally identifiable or sensitive request data without any minimization or redaction guidance. In a CloudBase agent context, these patterns are likely to be copied into production systems handling chats, auth flows, and AI prompts, increasing the risk of privacy leakage through logs and third-party error platforms.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The tracing and APM guidance demonstrates exporting telemetry to external endpoints over HTTP and enabling broad tracing, but does not warn that traces, span attributes, headers, prompts, tool inputs, or metadata may contain secrets or user data. Because this skill targets CloudBase agent development with LLMs and tool calls, copied examples could unintentionally exfiltrate sensitive operational and customer data to third-party observability backends.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation includes an example configuring CORS with allow_origins=['*'], allow_methods=['*'], and allow_headers=['*'] for a multi-agent server, but provides no warning that this is overly permissive for production use. In a server skill focused on deploying CloudBase/FastAPI agent services, readers may copy this directly, enabling unintended cross-origin access patterns and increasing exposure of authenticated or sensitive agent endpoints.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation includes an HTTP tool example with an Authorization header and external API calls but does not warn that tool executions may transmit user data or secrets to third-party services. In an agent-tooling context, this omission can lead developers to hardcode credentials or unknowingly expose sensitive inputs during tool execution.

Missing User Warnings

Low

Confidence: 71% confidence
Finding: The tool-composition example performs a store_results step, implying persistence or state modification, but the documentation does not disclose that running such a tool may write to databases or other storage. In agent ecosystems, insufficient disclosure around side effects increases the risk of unintended data modification, duplication, or persistence of sensitive content.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/ai-model-nodejs/SKILL.md:211

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/ai-model-web/SKILL.md:206

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/ai-model-wechat/SKILL.md:240