优云智算GPU管家

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:16 AM UTC
• Version: 1.0.3

Overview

This skill is not clearly malicious, but it needs review because it combines GPU instance management with broad SSH administration and unsafe password handling.

Review carefully before installing. Use it only with credentials scoped to CompShare resources you are willing to let an agent manage, avoid passing passwords on the command line, verify SSH host keys independently, and treat list output and logs as sensitive because they may contain instance login material. The SSH shell and file commands should be considered full remote administration authority, not just instance lifecycle management.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/compshare_client.py:226

Finding

Instance passwords can be disclosed through unredacted API responses printed to stdout

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ssh_client.py:88

Finding

SSH host-key verification is disabled through AutoAddPolicy

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/compshare_client.py:96

Finding

Configurable API endpoint can redirect credentials and instance passwords to an untrusted server

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ssh_client.py:720

Finding

Plaintext passwords are accepted and documented as command-line arguments

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:3

Finding

Third-party dependencies are installed without reproducible version and integrity controls

Content

View full analysis

=0.1.0 - PyYAML>=6.0 - paramiko>=3.0.0 ``` The installation instructions resolve mutable package versions: ```bash pip install ucloud-sdk-python3 PyYAML paramiko ``` ### Technical Analysis Lower-bound constraints permit any future version that satisfies the requirement, while the documented installation command has no version restrictions at all. No lock file, package hashes, or trusted-index controls are supplied. This does not establish that any named dependency is currently malicious. The issue is that installations performed at different times may execute different, unreviewed package code. A compromised package release, dependency account, package index, or transitive dependency could therefore introduce code that was absent during the Skill audit. ### Attack Path 1. A user follows the documented `pip install` command. 2. The package resolver selects the newest currently available versions and their transitive dependencies. 3. A selected release is compromised, malicious, or contains a newly introduced vulnerability. 4. Package installation or import executes the affected code in the user's environment. 5. That code obtains the privileges of the user running the Skill and may access the Skill's API configuration and SSH credentials. ### Impact Assessment The potential scope is the local Python environment and all files, credentials, and network access available to the installing or executing user. In this project, that can include CompShare API keys and SSH passwords. Exploitation depends on an upstream compromise or vulnerable release; no such compromise was confirmed during this static audit. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The manifest presents the skill as GPU instance lifecycle management, but the body also documents arbitrary remote command execution, interactive shell access, and file transfer/manipulation. This mismatch is dangerous because it can mislead users and policy systems into approving a skill with materially broader access than its stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented skill expands from cloud instance lifecycle management into broad SSH remote administration, including command execution and file transfer. In context, this is more dangerous because users invoking a cloud-management skill may not expect it to gain effective root-level access to instance contents and runtime state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Interactive shell access and arbitrary remote command execution are highly sensitive capabilities that exceed what is necessary for starting, stopping, or listing instances. If misused, they enable arbitrary code execution on customer infrastructure, data access, persistence, and destructive actions far beyond the declared lifecycle-management purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The delete command triggers terminate_comp_share_instance, which is a destructive remote operation affecting user resources. Although the function docstring notes that the instance must be stopped first, the executable CLI path provides no confirmation, warning, or other user-facing disclosure before deletion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script advertises and implements a general-purpose SSH administration client, including remote command execution, file transfer, and shell access, which materially exceeds the declared skill purpose of cloud instance lifecycle management. In an agent skill context, this creates a dangerous capability expansion: any caller that can invoke the skill may gain broad post-provisioning access to guest systems, enabling arbitrary actions on remote instances and access to data beyond the intended API-management scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The execute() path exposes arbitrary remote command execution, and the CLI also supports an interactive shell, giving full operator-level access to the target instance. In a skill whose stated purpose is instance create/query/start/stop/reboot/password reset/delete, this is an unnecessary and high-risk privilege expansion that could be abused to run malware, exfiltrate secrets, or tamper with workloads on provisioned machines.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents capabilities that imply shell execution and file access, but it does not declare any explicit tool scope or permissions boundary. This is dangerous because an agent or reviewer cannot easily determine or enforce what operations are authorized, increasing the chance of over-privileged execution and abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents instance deletion but does not prominently warn that deletion may be irreversible and may cause permanent data loss. In an infrastructure-management context, omission of such warnings increases the risk of accidental destructive operations by users or agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to retrieve SSH passwords and connection details from instance listings without clear security guidance on handling secrets. This is dangerous because it encourages exposure of credentials in command lines, logs, transcripts, or agent memory, making compromise of remote hosts more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents remote file deletion, chmod, rename, upload/download, and shell operations over SSH without clear safety warnings or operational guardrails. In context, these actions can directly alter or destroy remote systems and data, so presenting them without cautions increases the likelihood of harmful or unintended administrative actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file uses Chinese-only natural-language instructions and points exclusively to a .cn console and China-region endpoints/region values, which imposes a specific language/locale context without opt-in. The provided content does not state that the skill is region-specific or offer any alternative locale or language choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 18)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 88)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 130)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 288)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 524)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 569)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 615)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 660)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 704)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 759)May include surrounding context.

md

CompShare是优云智算平台提供的GPU云服务器服务。本文档详细说明了所有API接口的参数、响应格式和使用方法。

**API基础地址**: `https://api.compshare.cn/`

**支持的GPU类型**: P40、2080、3090、3080Ti、4090、A800、A100、H20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 455)May include surrounding context.

plain

https://api.ucloud.cn/?Action=DescribeCompShareCustomImages
&Region=cn-zj
&Zone=cn-zj-01
&ProjectId=GSIKgudm

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata says it manages GPU instance lifecycle, but the reference adds broad SSH capabilities including remote command execution, file upload/download, permission changes, and file deletion. This materially expands the skill from infrastructure management into arbitrary remote administration, increasing the chance of unsafe actions, secret access, destructive operations, and post-provisioning misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The SSH section documents high-risk operations such as exec, rm, rmdir, chmod, upload, download, and interactive shell without safety guidance, confirmation requirements, or warnings about remote code execution and data loss. In an agent context, this can normalize destructive or irreversible actions and make accidental or prompt-induced misuse much more likely.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The SSH examples use root-level access patterns and include permission-changing operations such as chmod, alongside arbitrary remote administration. In this context, encouraging privileged remote actions without guardrails increases the blast radius of mistakes or prompt abuse, allowing system-wide modification or destructive changes on provisioned instances.

Content

Scanner excerpt · references/api_reference.md (reported line 806)May include surrounding context.

md

| cat | 查看文件内容 | `python ssh_client.py cat --ssh-command "..." --password "..." --path "/etc/hosts"` |
| stat | 获取文件信息 | `python ssh_client.py stat --ssh-command "..." --password "..." --path "/home/file.txt"` |
| rename | 重命名文件/目录 | `python ssh_client.py rename --ssh-command "..." --password "..." --old "/home/a" --new "/home/b"` |
| chmod | 修改权限 | `python ssh_client.py chmod --ssh-command "..." --password "..." --path "/home/script.sh" --mode 755` |
| upload | 上传文件 | `python ssh_client.py upload --ssh-command "..." --password "..." --local ./file.txt --remote /home/file.txt` |
| upload-dir | 上传目录 | `python ssh_client.py upload-dir --ssh-command "..." --password "..." --local ./project --remote /home/project` |
| download | 下载文件 | `python ssh_client.py download --ssh-command "..." --password "..." --remote /home/file.txt --local ./file.txt` |

Static analysis

No suspicious patterns detected.