Cloudnet AI Inspection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 1.0.1

Overview

This WLAN inspection skill is mostly purpose-aligned, but it handles a Cloudnet API key in ways that can expose and persist the credential.

Install only if you are comfortable providing a Cloudnet API key to this workflow. Use a narrowly scoped, revocable key; avoid printing config files that contain secrets; check where mcporter stores its configuration; remove or rotate the token after use; and prefer pinned dependencies in an isolated environment instead of global npm/pip installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 47 and 80 **Vulnerability Type**: Unpinned package installation from third-party registries **Risk Level**: Medium ### Vulnerable Code ```markdown - 通过：≥ 0.9.0 | 未通过：提示 `npm install -g mcporter` ``` ```markdown - 通过：✅ | 未通过：提示 `pip install python-docx`（仅影响DOCX输出，MD仍可生成） ``` ### Technical Analysis The Skill instructs users or an executing Agent to install `mcporter` and `python-docx` without specifying reviewed versions or validating package integrity. Consequently, each installation resolves to whatever package version the configured npm or Python package registry serves at execution time. The `mcporter` instruction additionally uses npm's global installation mode. Package installation scripts can execute with the privileges of the user running npm, and a global installation exposes the resulting executable across that user's environment. The Python installation instruction likewise lacks a version constraint, hash verification, lockfile, or isolated environment requirement. This creates a supply-chain risk if a package publisher account, registry, dependency, DNS route, package mirror, or future release is compromised. The package names are not demonstrated to be malicious; exploitation depends on compromise or substitution of a dependency source. ### Attack Path 1. An attacker compromises a package publisher, dependency, configured registry or mirror, or otherwise causes a malicious package version to be served. 2. The required dependency is absent from the target environment. 3. The Agent or user follows the Skill's installation instruction: - `npm install -g mcporter`, or - `pip install python-docx`. 4. The package manager downloads the unreviewed current version without integrity validation against a project-controlled lockfile or hash. 5. Malicious installation hooks or imported package code execute under the installing user's account. 6. The attacker can act within that ...[truncated 675 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version instead of installing the latest available release. 2. Use lockfiles and package-manager integrity controls: - Commit an npm lockfile and use `npm ci`. - Use a hashed Python requirements file and install with `pip install --require-hashes -r requirements.txt`. 3. Verify package publisher identity, registry origin, release signatures, and checksums before installation. 4. Avoid global npm installation. Install `mcporter` in a dedicated project environment and invoke the locally pinned executable. 5. Install Python dependencies in an isolated virtual environment with minimal filesystem and network permissions. 6. Disable or carefully review npm lifecycle scripts where operationally possible. 7. Document trusted package registries and reject unapproved mirrors or registry overrides. 8. Periodically scan the pinned dependency graph for compromised, malicious, or vulnerable releases. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27
• Finding: Plaintext API Key Exposure and Persistent Bearer-Token Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–40 and 51–63 **Vulnerability Type**: Plaintext secret storage and command-line credential exposure **Risk Level**: High ### Vulnerable Code ```markdown ### 0.1 读取配置文件 ```bash # 读取skill根目录的config.json cat config.json ``` **config.json 格式：** ```json { "mcporter_name": "oasis", "api_key": "xxxxxxxx", "shops": [ { "name": "场所名称" } ] } ``` > 💡 `shops` 只需填写 `name`（场所名称），shopId 在巡检时由第1步 API 自动获取。 如果 `api_key` 为占位文本（如"在此填入"），提示用户填入真实 API Key 后重新巡检。 ``` ```markdown ### 0.3 检查并配置Cloudnet MCP连接 **唯一MCP地址（正式环境）：** ``` https://oasis.h3c.com/mcp-server/api/sse ``` ```bash mcporter config list ``` - 如果列表中已存在 `mcporter_name` 对应的配置 → ✅ 通过 - 如果不存在 → 自动执行配置： ```bash mcporter config add <mcporter_name> https://oasis.h3c.com/mcp-server/api/sse --header "Authorization=Bearer <API_KEY>" ``` ``` ### Technical Analysis The Skill requires a Cloudnet API key to be stored directly in `config.json`, instructs the Agent to print that entire file with `cat`, and then places the key into a bearer-token header supplied through a command invocation. Printing the configuration can disclose the key through terminal output, Agent tool transcripts, orchestration logs, shell recording, or captured diagnostic output. Passing the key in a command can also expose it to shell history, process inspection, command telemetry, or audit logs, depending on the operating system and execution environment. The `mcporter config add` command may persist the authorization header in local configuration. The Skill does not identify the storage location, require restrictive permissions, verify encryption at rest, redact the token, or remove it after inspection. The precise persistence behavior of `mcporter` cannot be verified because the package contains no implementation of that external tool. ### Attack Path 1. A user places a valid Cloudnet API key in `config.json` as directed. 2. The Agent executes `cat config.js ...[truncated 1528 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `api_key` from `config.json`; retain only non-secret settings such as the connection name and shop names. 2. Retrieve the key at runtime from a protected environment variable, operating-system credential store, or dedicated secret manager. 3. Never print a file or environment value that contains credentials. Replace `cat config.json` with validation that reports only whether required fields are present. 4. Avoid placing bearer tokens directly in command-line arguments. Prefer secure standard input, a protected credential reference, or a tool-native secret-provider integration. 5. If `mcporter` must persist credentials: - Document its configuration path and storage behavior. - Require owner-only file permissions. - Prefer encrypted credential storage. - Ensure configuration output redacts authorization headers. 6. Disable shell history for secret-bearing operations and configure Agent/tool logging to redact `Authorization` headers and API-key values. 7. Use narrowly scoped, short-lived tokens with the minimum permissions required for read-only WLAN inspection. 8. Add explicit token cleanup and revocation procedures after the inspection. 9. Exclude all secret-bearing files from source control, report bundles, backups, and generated artifacts. 10. Rotate the API key immediately if it has already appeared in terminal output, Agent transcripts, configuration files with broad permissions, or centralized logs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The description requires output in Chinese MD and DOCX formats, and later requirements state “全部中文,” but there is no user opt-in or selectable language option. This is a natural-language locale policy issue because the skill forces a specific language regardless of user preference.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes generic phrases such as “巡检” and “极简版巡检”, which are broad and could overlap with ordinary requests for inspection rather than this specific Cloudnet WLAN skill. The description does not provide activation constraints, scope limits, or negative examples to clarify when the skill should or should not invoke.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs reading a local config.json that contains a live API key and then using that key on the command line to configure mcporter. This creates credential exposure risk through terminal history, process listings, logs, screenshots, and accidental model disclosure if file contents are echoed back or summarized to the user.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The instructions explicitly require all report content to be in Chinese, preserving only technical acronyms in English. Because no language selection or opt-in mechanism is provided, this imposes a fixed locale on all users and violates the language-choice policy.

Static analysis

No suspicious patterns detected.