ClawHub
Back to skill

Security audit

腾讯云 CloudBase 最小 Web BaaS Demo / Tencent CloudBase Minimal Web BaaS Demo

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a CloudBase demo helper, but it should be reviewed because it directs automatic template downloads and package installs during credential/trust setup.

Install only if you are comfortable with the agent creating CloudBase schema resources and running a template dependency install. Prefer using a test tenant, reviewing the template source and lockfile, disabling install scripts where possible, and approving any SessionStart hook or connector changes before they are enabled.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:83
Finding

Unverified Template Retrieval Followed by Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 83–96 and 122
Vulnerability Type: Supply-chain exposure through unverified templates and dependencies
Risk Level: Medium

Relevant code snippets:

text
1. Template warmup // parallel with credential wait   ← downloadTemplate + install
markdown
1. **Warm template in parallel with credentials** (see partner notes below): `downloadTemplate` (`react` default, `vue` if requested) → `npm install` / `pnpm install`.
markdown
| WorkBuddy / connector without hooks | **Pre-enable** the CloudBase MCP connector for the tenant when possible; inject a short system brief that points here; warm `downloadTemplate` + `npm install` **during** credential/Trust wait (do not idle). |

Technical Analysis

The Skill instructs the agent to retrieve a template and immediately install its dependencies. It does not require an immutable template version, trusted source validation, integrity hash, reviewed lockfile, dependency audit, or suppression of package lifecycle scripts.

An npm install or pnpm install operation may execute lifecycle scripts such as preinstall, install, and postinstall. Consequently, the downloaded template and its transitive dependency graph form a local code-execution channel. If the template source, lockfile, registry, or dependency is compromised, attacker-controlled code can run before the project is reviewed.

Performing this installation automatically “during credential/Trust wait” increases exposure because the environment may contain active authentication material while reducing the opportunity for manual inspection. The history does not establish that the template or dependencies are malicious, so this is an insecure supply-chain workflow rather than confirmed intentional malware.

Attack Path

  1. An attacker compromises or influences the template distribution service, a mutable template release, its manifest ...[truncated 1299 chars]
Remediation
View remediation

Remediation Suggestions

  1. Restrict downloadTemplate to an explicitly approved registry or repository.
  2. Pin templates to immutable versions, commit hashes, or content digests and verify integrity before use.
  3. Require a reviewed, committed lockfile and use frozen installation modes such as npm ci or pnpm install --frozen-lockfile.
  4. Disable lifecycle scripts by default with --ignore-scripts; enable only individually reviewed scripts when required.
  5. Audit direct and transitive dependencies for unexpected sources, install hooks, dependency confusion, and known vulnerabilities.
  6. Separate dependency installation from credential handling. Run installation in a sandbox with minimal environment variables, filesystem access, and network permissions.
  7. Present the template source, resolved version, integrity result, and planned install command for approval before execution.
  8. Avoid automatic background installation during the credential or trust workflow unless equivalent provenance verification and isolation controls are enforced.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
## Hard rules (align with Sites SessionStart Rule 5)

1. **BaaS-first data path**
   - **Schema / admin:** Prefer MCP management tools. Do not ask the user to create collections/tables in the console. If MCP tools are missing in this session, configure MCP for next time and use `tcb` CLI (`../cloudbase-cli/SKILL.md`) for equivalent schema/admin ops.
     - NoSQL: `writeNoSqlDatabaseStructure` (create collection / indexes) + permission tools as needed; CLI: NoSQL commands in `cloudbase-cli`.
     - PostgreSQL: follow `../postgresql-development-cloudbase/SKILL.md` (`queryPgDatabase` / `managePgDatabase` / migrations); CLI parity via `tcb db pg …` when MCP is unavailable.
   - **Reads / writes:** `@cloudbase/js-sdk` in the browser.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The guidance says to replace language with the exact phrase "必须云函数中转 / 前端绝不直连库", which is a natural-language locale choice embedded in instructions. Because the file does not indicate that Chinese should be used only when the user or host has opted into that language, this can violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.