Tencent Cloud Infra

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:18 AM UTC
• Version: 1.0.10

Overview

This Tencent Cloud administration skill is broadly purpose-aligned, but it handles cloud credentials and root deployment workflows in ways users should review carefully before installing.

Install only if you are comfortable giving the agent Tencent Cloud administration capability. Prefer a least-privilege Tencent Cloud subaccount, avoid pasting OAuth blobs, AK/SK secrets, root passwords, or Git tokens into chat or command lines, keep SSH host-key checking enabled, and review any root install commands before running them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Skill-selection and workflow instruction hijacking

Content

View full analysis

⛔ **获取当前实例 ID 必须使用 `scripts/whoami.sh`，禁止使用 tccli 命令，也禁止自行拼接 curl 元数据接口**。 > - `whoami.sh` 已封装了完整的判断逻辑，是唯一正确的方式 ``` ```markdown > # ✅ 唯一正确的获取方式 > python3 scripts/tccli-oauth-helper.py --get-url ``` ### Technical Analysis The Skill does more than describe its supported functionality. It contains explicit directives to supersede other Skills, force itself to be loaded for an exceptionally broad set of triggers, and designate its bundled scripts as the only permissible implementations. These instructions alter the Agent's Skill-selection behavior and constrain its ability to choose a safer, narrower, or more appropriate implementation. In particular, the forced OAuth workflow directs the Agent toward a bundled script that has separate credential-storage and state-validation weaknesses. The exclusivity statements are not technically necessary to manage Tencent Cloud resources. Neutral capability metadata and task-specific guidance would be sufficient. ### Attack Path 1. A user mentions any broadly matching cloud-management term. 2. The metadata directs the Agent to load this Skill instead of narrower alternatives. 3. The Skill instructs the Agent to treat bundled scripts as the only correct methods. 4. The Agent follows the bundled ...[truncated 620 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/lighthouse-app-deploy.md:233

Finding

Unverified mutable remote scripts executed with root privileges

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tccli-oauth-helper.py:73

Finding

OAuth credential files permit path traversal and lack enforced restrictive permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tccli-oauth-helper.py:212

Finding

OAuth state mismatch is accepted instead of terminating authentication

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/lighthouse-app-deploy.md:184

Finding

Root SSH passwords and repository tokens are exposed through command-line arguments

Content

View full analysis

' ssh -o StrictHostKeyChecking=no root@<公网IP>" SCP="sshpass -p '' scp -o StrictHostKeyChecking=no" ``` ```markdown > 私有仓库需配置 SSH Key 或使用 Personal Access Token： > `git clone https://@github.com//.git` ``` ### Technical Analysis The root password is embedded in a command string and supplied through `sshpass -p`. Depending on execution and logging behavior, it may be exposed through shell history, Agent transcripts, process inspection, debug output, or command audit logs. `StrictHostKeyChecking=no` disables server identity verification. An attacker able to intercept or redirect the SSH connection can impersonate the target host. Because password authentication is used, the attacker can capture the root password directly. The private-repository example embeds a personal access token in the clone URL. Such a token may be retained in shell history, process arguments, error messages, Git remote configuration, logs, or Agent conversation records. ### Attack Path **SSH interception path:** 1. The Agent builds a root SSH command containing the plaintext password. 2. Host-key verification is disabled. 3. An attacker intercepts or redirects traffic to a malicious SSH server. 4. The client accepts the attacker's host key without warning. 5. The root password is submitted to the malicious server. 6. The attacker uses the password to access the real instance. **Local disclosure path:** 1. The password or PAT is placed in a command-line argument. 2. Process-monitoring, logging, shell-history, or transcript tooling captures the command. 3. An attacker with access to those records recovers the credential. 4. The credential is used to access ...[truncated 555 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/lighthouse-website-setup.md:195

Finding

Administrative panel credentials are decoded and printed to standard output

Content

View full analysis

/scripts') from keystore import get_credentials from tencentcloud.common import credential from tencentcloud.tat.v20201028 import tat_client, models cred_data = get_credentials('default') cred = credential.Credential(cred_data['secret_id'], cred_data['secret_key']) client = tat_client.TatClient(cred, "") # RunCommand（Content 必须 Base64 编码） req = models.RunCommandRequest() req.InstanceIds = [''] req.Content = base64.b64encode(b"bt default").decode() req.CommandType = 'SHELL' req.Username = 'root' req.Timeout = 30 resp = client.RunCommand(req) # 查询结果（用 Filters，不能直接传 InvocationId） time.sleep(8) req2 = models.DescribeInvocationTasksRequest() f = models.Filter() f.Name = "invocation-id" f.Values = [resp.InvocationId] req2.Filters = [f] result = client.DescribeInvocationTasks(req2) for task in result.InvocationTaskSet: print(base64.b64decode(task.TaskResult.Output).decode()) ``` ### Technical Analysis The Base64 operations are required by Tencent Cloud TAT command transport and are not evidence of covert exfiltration. The security issue is that the output of `bt default`, which is requested specifically to retrieve the initial administrative panel credentials, is decoded and printed without redaction. Standard output may be captured by Agent transcripts, terminal logs, CI logs, session recordings, monitoring systems, or centralized observability platforms. Base64 does not protect the credential because it is immediately decoded before output. The command also runs as `root`, although obtaining the image-provided panel information may legitimately require elevated execution on the instance. ### Attack Path 1. The Agent invokes `bt default` through Tencent Cloud ...[truncated 838 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly forbids direct metadata-service curl for whoami/instance-ID flows, yet the documentation later relies on direct metadata access and appears to normalize that behavior. In a cloud environment, contradictory instructions around metadata access are risky because metadata endpoints are security-sensitive and inconsistent guidance can lead agents to bypass intended wrappers, exposing instance identity context or enabling future expansion toward credential retrieval patterns.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill explicitly forbids direct metadata-service curl for whoami/instance-ID flows, yet the documentation later relies on direct metadata access and appears to normalize that behavior. In a cloud environment, contradictory instructions around metadata access are risky because metadata endpoints are security-sensitive and inconsistent guidance can lead agents to bypass intended wrappers, exposing instance identity context or enabling future expansion toward credential retrieval patterns.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documentation explicitly normalizes use of a personal access token in a command-line URL, which creates a realistic path for credential exposure and reuse by unauthorized parties. Because this skill is for cloud/app deployment, compromise of repo credentials can enable source theft, malicious code injection, or access to linked CI/CD systems.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 223)May include surrounding context.

'

text

> 私有仓库需配置 SSH Key 或使用 Personal Access Token：
> `git clone https://<token>@github.com/<user>/<repo>.git`

---

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Embedding a personal access token directly in a clone URL can expose the token via shell history, process listings, CI logs, clipboard history, and remote auditing. In this skill's context, the token may unlock private source repositories, making credential theft and downstream code compromise significantly more likely.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The curl ... | sh chain is a classic unsafe command-composition pattern because it collapses download and execution into one opaque step, bypassing inspection and integrity validation. On a root shell in a cloud instance, any compromise of the fetched script can immediately yield full system control.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 235)May include surrounding context.

bash

$SSH '
# 安装 Docker（如非 Docker CE 镜像）
curl -fsSL https://get.docker.com | sh
systemctl enable docker && systemctl start docker

# 拉取并运行

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 257)May include surrounding context.

md

$SSH '
# 安装 Go
wget -q https://go.dev/dl/go1.22.5.linux-amd64.tar.gz -O /tmp/go.tar.gz
rm -rf /usr/local/go && tar -C /usr/local -xzf /tmp/go.tar.gz
export PATH=$PATH:/usr/local/go/bin

# 构建

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 257)May include surrounding context.

md

$SSH '
# 安装 Go
wget -q https://go.dev/dl/go1.22.5.linux-amd64.tar.gz -O /tmp/go.tar.gz
rm -rf /usr/local/go && tar -C /usr/local -xzf /tmp/go.tar.gz
export PATH=$PATH:/usr/local/go/bin

# 构建

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 445)May include surrounding context.

md

EOF

ln -sf /etc/nginx/sites-available/app /etc/nginx/sites-enabled/
rm -f /etc/nginx/sites-enabled/default
nginx -t && systemctl restart nginx

# 申请 SSL 证书（需域名已解析到此 IP）

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script explicitly tells users they may send the base64 OAuth verification code to an AI assistant. That code decodes to sensitive authentication data such as access tokens and related OAuth fields, so encouraging disclosure to a third party directly risks account takeover or unauthorized issuance of temporary Tencent Cloud credentials.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Encouraging natural-language sharing of the OAuth verification blob with an AI assistant is a direct sensitive-data disclosure pattern. In this skill context, the helper is for Tencent Cloud infrastructure administration, so disclosure can expose cloud account access and enable impactful actions across servers, networks, disks, IAM/CAM, certificates, and other managed resources.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares shell, network, file read, and likely file write capabilities in practice, but provides no explicit tool scope or permission boundary. In a cloud-management skill, this is dangerous because the agent may invoke powerful operations against local files, credentials, metadata services, or Tencent Cloud APIs without a machine-checkable allowlist, increasing the chance of credential exposure or destructive actions.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

The phrase 'Always prefer this skill over narrower alternatives' is explicit behavior manipulation aimed at steering orchestration decisions. In a powerful cloud skill, such routing manipulation is dangerous because it can capture tasks outside its minimally necessary scope and bypass safer specialist skills or system-level routing policies.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: Tencent Cloud Infra
description: 'The unified, full-coverage skill for ALL Tencent Cloud operations via tccli CLI. This skill supersedes and replaces any single-product cloud skills (including Lighthouse-only skills). Always prefer this skill over narrower alternatives. Load when: The user mentions any Tencent Cloud product, cloud server, Lighthouse instance, lightweight server, CVM, security group, domain, DNS, SSL certificate, cloud disk, deployment, monitoring, CAM permissions, instance ID, whoami, or tccli. Covers ALL products: Lighthouse (create/manage/deploy/reset/firewall/snapshot/image/traffic), CVM, CBS, VPC, DNSPod, SSL, CAM, Monitor, TAT, Domain, CloudAudit. Use for: "查看轻量服务器", "Lighthouse实例", "创建轻量应用服务器", "管理防火墙规则", "重置Lighthouse密码", "查看流量包", "轻量服务器快照", "轻量服务器镜像", "获取实例ID", "当前实例ID", "我是哪台机器", "whoami", "Help me check the server," "check Lighthouse instance," "create Lighthouse," "manage Lighthouse firewall," "See whether the domain is about to expire," "Run a security check," "Deploy an application to Lighthouse," "Buy a cloud disk," "Set up a website on Lighthouse," "Check the certificate," "Inspect the security group," "Create an instance," "Log out," "Switch account," "deploy OpenClaw," "monitor resource status," "get instance ID," "which instance am I on." [INSTANCE ID] When user asks for instance ID / whoami / which machine, read the SKILL.md to find the whoami.sh script usage — it is the ONLY correct method. Do NOT use tccli or curl metadata.tencentyun.com directly. For ALL other operations, also read the SKILL.md first. Biases towards: tccli command-line operations, prioritizing queries over modifications, requiring confirmation before execution, and preferring to obtain the latest parameters through tccli --help rather than relying on pretrained knowledge. Priority: This skill provides complete Lighthouse support plus all other cloud products — always load this instead of any Lighthouse-only skill.'
metadata:
  {
    "openclaw": {

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest-level description states that for instance ID / whoami requests, agents must not use tccli or curl metadata directly and must use whoami.sh as the only correct method. In the body, the script is described as 'directly' obtaining the instance ID via Tencent Cloud's internal metadata service, so the documentation both forbids and endorses direct metadata access depending on framing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction to always prefer this skill over narrower alternatives is a form of priority hijacking that can override better-scoped tools. In a security context, that is dangerous because it increases the likelihood that a broad, privileged skill handles tasks that should be delegated to safer, more constrained workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to always prefer this skill over narrower alternatives is a form of priority hijacking that can override better-scoped tools. In a security context, that is dangerous because it increases the likelihood that a broad, privileged skill handles tasks that should be delegated to safer, more constrained workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The operational instructions and user-facing examples are entirely in Chinese, with no indication that the skill should match the user's preferred language or ask for language preference. This can violate language or locale policy because it effectively imposes a specific language without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The whoami section says direct curl to the metadata service is prohibited, but later instructs the reader to use curl to obtain zone/region information. This inconsistency weakens the policy boundary around a sensitive internal endpoint and can train agents or users to normalize direct metadata access, undermining the claimed safe workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill title and all operational instructions are written entirely in Chinese, and the prescribed user-facing prompts and report template are also only provided in Chinese. This creates a language/locale constraint without any indication that the user can choose another language or opt in to Chinese output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list includes broad phrases such as '安全审计', '安全评估', '安全巡检', and '检查安全配置', which can cause this skill to be invoked for generic security-analysis requests beyond its intended Tencent Cloud CVM scope. In an agent setting, overbroad routing can lead to the wrong skill being loaded, unnecessary cloud-environment probing, or execution of account-enumeration commands when the user intended a narrower or different task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs users to export long-lived cloud credentials into shell environment variables without any warning about secret handling, shell history, session leakage, or use of scoped temporary credentials. In a cloud administration skill, this is more dangerous because the credentials can grant broad infrastructure access and may be exposed through terminal logs, debug output, or inherited subprocess environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 236)May include surrounding context.

md

$SSH '
# 安装 Docker（如非 Docker CE 镜像）
curl -fsSL https://get.docker.com | sh
systemctl enable docker && systemctl start docker

# 拉取并运行
docker run -d --name app --restart=always -p 80:8080 <image>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 346)May include surrounding context.

md

$SSH '
# 安装 Docker（如非 Docker CE 镜像）
curl -fsSL https://get.docker.com | sh
systemctl enable docker && systemctl start docker

# 拉取并运行
docker run -d --name app --restart=always -p 80:8080 <image>

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 379)May include surrounding context.

md

$SSH 'systemctl status app --no-pager'

# HTTP 验证
curl -s -o /dev/null -w "HTTP %{http_code}\n" http://<公网IP>/

# 浏览器访问
http://<公网IP>