Tencent Cloud Management Tool

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:34 AM UTC
• Version: 1.1.1

Overview

This Tencent Cloud management skill is mostly purpose-aligned, but it handles cloud credentials and privileged deployment steps in ways users should review carefully before installing.

Install only if you expect the agent to manage live Tencent Cloud resources. Use a least-privilege cloud account, require explicit confirmation for purchases, DNS changes, disk formatting, remote commands, and deletes, and avoid sending OAuth codes, SecretKeys, personal access tokens, or passwords through chat. Prefer SSH keys with host-key verification, pinned installers/images, and restrictive permissions for ~/.tccli credential files; rotate any credentials used with the documented insecure flows.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/lighthouse-app-deploy.md:235

Finding

Mutable Remote Installation Scripts Executed Directly as Root

Content

View full analysis

' ``` ```bash $SSH ' # Install Node.js through NodeSource curl -fsSL https://deb.nodesource.com/setup_20.x | bash - apt install -y nodejs cd /opt/app npm install npm run build ' ``` ### Technical Analysis The deployment guide downloads shell scripts from external URLs and pipes their contents directly into `sh` or `bash`. The effective scripts are mutable external payloads and are not included in the reviewed Skill package. No version pinning, detached-signature verification, checksum verification, or local inspection is performed before execution. These commands run through the guide's root SSH session, so every instruction returned by either endpoint receives unrestricted operating-system privileges. The domains appear related to the declared Docker and Node.js installation tasks, and there is no evidence that the current endpoints are intentionally malicious. Nevertheless, this delivery pattern allows the effective behavior to change after Skill review and therefore constitutes a remote payload execution vulnerability. ### Attack Path 1. A user asks the agent to deploy a Docker or Node.js application. 2. The Skill directs the agent to follow `references/lighthouse-app-deploy.md`. 3. The agent establishes a remote SSH session as `root`. 4. The agent retrieves a mutable installation script from `get.docker.com` or `deb.nodesource.com`. 5. The downloaded bytes are immediately passed to a privileged shell without integrity validation. 6. If the upstream service, distribution infrastructure, DNS resolu ...[truncated 861 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/lighthouse-app-deploy.md:184

Finding

SSH Host Verification Disabled and Root Password Exposed in Process Arguments

Content

View full analysis

' ssh -o StrictHostKeyChecking=no root@" SCP="sshpass -p '' scp -o StrictHostKeyChecking=no" ``` ### Technical Analysis `StrictHostKeyChecking=no` suppresses SSH server-identity validation. On an initial connection, the client accepts an arbitrary host key instead of requiring the target instance's expected fingerprint. This defeats SSH's protection against active machine-in-the-middle attacks. The use of `sshpass -p` also places the root password in a command-line argument and shell variable. Depending on operating-system behavior and execution tooling, command arguments may be exposed through process inspection, shell history, agent logs, diagnostic output, or monitoring systems. Using a reusable password for direct root access further exceeds the minimum privilege needed for routine application deployment. A restricted deployment account with narrowly scoped privilege escalation would materially reduce impact. ### Attack Path 1. The agent stores the Lighthouse root password in the `SSH` and `SCP` shell variables. 2. The agent initiates its first SSH connection without possessing a trusted host key. 3. A network-positioned attacker redirects or intercepts the connection and presents an attacker-controlled SSH host key. 4. Because strict host-key checking is disabled, the client accepts the impersonated server. 5. The password is submitted to the attacker's SSH endpoint, or source archives are uploaded to it. 6. The attacker reuses the captured root password against the real instance. 7. Alternatively, another local user or process-monitoring component obtains the password from the process command line or execution logs. ### Impact Assessment An attacker who captures the password can o ...[truncated 501 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tccli-oauth-helper.py:208

Finding

OAuth Authentication Continues After State Validation Failure

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tccli-oauth-helper.py:104

Finding

OAuth State Generated with a Non-Cryptographic Random Number Generator

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tccli-oauth-helper.py:65

Finding

Cloud Credential File Is Written Without Explicit Restrictive Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a Tencent Cloud resource-management tool, but it also handles authentication bootstrapping, credential-status checks, and local credential storage management. That mismatch is dangerous because users may consent to cloud operations without realizing the skill can facilitate account login flows and modify persistent local auth material.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document recommends sshpass with a plaintext password and StrictHostKeyChecking=no, which both exposes credentials locally and disables server authenticity verification. In this deployment context, that combination materially increases the chance of credential theft and man-in-the-middle compromise during administrative access to newly created cloud servers.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The explicit recommendation to use a Personal Access Token in the clone URL exposes a reusable credential during deployment operations. In practice, this can lead to unauthorized repository access, source disclosure, or lateral movement into associated development systems if the token is overscoped.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 223)May include surrounding context.

'

text

> 私有仓库需配置 SSH Key 或使用 Personal Access Token：
> `git clone https://<token>@github.com/<user>/<repo>.git`

---

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Embedding a Personal Access Token directly in a Git URL can leak the token via shell history, process listings, logs, CI output, or remote tooling. Because this skill is for provisioning and deployment, such leaked tokens may grant access to private repositories and possibly broader source-code or CI/CD resources.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The | sh chaining pattern is dangerous here because it turns an untrusted network response directly into shell execution as root over SSH. In a deployment skill, this creates a straightforward remote code execution path if the upstream content, transport, or endpoint trust is compromised.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 235)May include surrounding context.

bash

$SSH '
# 安装 Docker（如非 Docker CE 镜像）
curl -fsSL https://get.docker.com | sh
systemctl enable docker && systemctl start docker

# 拉取并运行

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 257)May include surrounding context.

md

$SSH '
# 安装 Go
wget -q https://go.dev/dl/go1.22.5.linux-amd64.tar.gz -O /tmp/go.tar.gz
rm -rf /usr/local/go && tar -C /usr/local -xzf /tmp/go.tar.gz
export PATH=$PATH:/usr/local/go/bin

# 构建

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 257)May include surrounding context.

md

$SSH '
# 安装 Go
wget -q https://go.dev/dl/go1.22.5.linux-amd64.tar.gz -O /tmp/go.tar.gz
rm -rf /usr/local/go && tar -C /usr/local -xzf /tmp/go.tar.gz
export PATH=$PATH:/usr/local/go/bin

# 构建

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 445)May include surrounding context.

md

EOF

ln -sf /etc/nginx/sites-available/app /etc/nginx/sites-enabled/
rm -f /etc/nginx/sites-enabled/default
nginx -t && systemctl restart nginx

# 申请 SSL 证书（需域名已解析到此 IP）

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script encourages sharing the OAuth verification code but does not warn that it contains sensitive authentication data. In this skill context, users are managing Tencent Cloud resources, so disclosure can lead to unauthorized cloud access, privilege abuse, or resource manipulation.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Telling users to provide the verification code to an AI assistant encourages disclosure of authentication material through conversational channels that may be logged, retained, or exposed. Because the code can be used to obtain cloud credentials, this materially increases the attack surface and risk of account compromise.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill performs network access, reads reference files, and writes local credential state, but it does not declare any explicit tool scope or allowed-tools boundary. In a cloud-management skill that can touch authentication flows and local config, missing capability scoping increases the risk of unintended tool use or privilege expansion beyond what users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad and overlap with common requests like checking servers, deploying apps, switching accounts, and security checks, making accidental invocation more likely. In this context, overbroad activation is risky because the skill can lead users into authentication and cloud-management operations that affect live infrastructure and local credentials.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly tells the user to send the OAuth verification code to the AI assistant, which places sensitive authentication material into the model conversation channel in plain text. Even if the code is short-lived, exposing it to the assistant creates avoidable account-access risk, expands the number of systems handling the secret, and normalizes unsafe credential-sharing behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The applicability guidance uses broad scenario descriptions that blur the boundary between health diagnosis, general resource inspection, and other cloud-management actions. In this context, an ambiguous match is dangerous because the skill contains discovery logic for tags, resources, and monitoring namespaces, so accidental activation can expand the scope of data accessed beyond what the user clearly requested.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger examples for invoking the health-check workflow include broad natural-language requests such as service inspection and diagnosis, which can overlap with other operational or security tasks. In an agent skill that can enumerate cloud resources and pull monitoring data, ambiguous activation can cause the wrong workflow to run, leading to unintended account-wide discovery, privacy exposure, or user confusion about what checks are being performed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad phrases such as ‘安全检查’, ‘安全审计’, and ‘安全评估’, which can match many ordinary cloud-management requests and cause this skill to activate unexpectedly. In this skill’s context, unexpected activation is risky because the workflow mandates broad enumeration of security groups, instances, monitoring policies, and CAM users/keys, potentially leading to over-collection of sensitive account security data beyond the user’s actual intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs users to export cloud API credentials as plaintext environment variables without any warning about shell history, process inspection, accidental logging, or persistence in terminal sessions. In a cloud administration skill, exposing long-lived credentials can directly enable unauthorized resource access, modification, or account compromise.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 236)May include surrounding context.

md

$SSH '
# 安装 Docker（如非 Docker CE 镜像）
curl -fsSL https://get.docker.com | sh
systemctl enable docker && systemctl start docker

# 拉取并运行
docker run -d --name app --restart=always -p 80:8080 <image>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 346)May include surrounding context.

md

$SSH '
# 安装 Docker（如非 Docker CE 镜像）
curl -fsSL https://get.docker.com | sh
systemctl enable docker && systemctl start docker

# 拉取并运行
docker run -d --name app --restart=always -p 80:8080 <image>

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/lighthouse-app-deploy.md (reported line 379)May include surrounding context.

md

$SSH 'systemctl status app --no-pager'

# HTTP 验证
curl -s -o /dev/null -w "HTTP %{http_code}\n" http://<公网IP>/

# 浏览器访问
http://<公网IP>

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide provides direct commands and an automation flow that create Lighthouse instances, purchase domains, and publish DNS records, but it does not include an explicit user-facing warning that these actions incur cost and make services publicly reachable. In an agent skill context, this increases the risk of unintended purchases or exposure if an agent follows the playbook too eagerly or with ambiguous user authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions use TAT to execute a remote command and then decode and print the Baota panel's initial password, exposing sensitive credentials in terminal output, logs, transcripts, or agent memory. Because the same guide also discusses opening and accessing the management panel, credential disclosure could quickly enable unauthorized administrative access if outputs are observed or retained.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/lighthouse-app-deploy.md:257