Tencent Cloud Log Service

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:56 AM UTC
• Version: 0.1.0

Overview

This skill’s purpose is clear, but it asks users to install an unpinned third-party CLI and expose Tencent Cloud credentials to query potentially sensitive logs without enough safety guidance.

Review the clscli source and installation path before use, prefer a pinned and verified release, and use a dedicated least-privilege Tencent Cloud identity limited to the needed CLS regions, logsets, and topics. Treat exported log files as sensitive data and avoid globally exporting long-lived credentials longer than necessary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party CLI Executes with Access to Tencent Cloud Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–20
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata:
    {"requires": {"bin": ["clscli"], "env": ["TENCENTCLOUD_SECRET_ID", "TENCENTCLOUD_SECRET_KEY"]}}

markdown

## Setup
1. Install clscli (Homebrew):
    ```bash
    brew tap dbwang0130/clscli
    brew install dbwang0130/clscli/clscli
    ```
2. Get credentials and region list: https://cloud.tencent.com/document/api/614/56474
3. Set environment variables (same as Tencent Cloud API common parameters):
    ```bash
    export TENCENTCLOUD_SECRET_ID="your-secret-id"
    export TENCENTCLOUD_SECRET_KEY="your-secret-key"
    ```

Technical Analysis

The Skill instructs users to install clscli from a third-party Homebrew tap without pinning an immutable release, formula revision, source commit, checksum, or cryptographic signature. The project contains only SKILL.md; consequently, neither the executable nor its Homebrew formula can be statically verified as part of this audit.

The installed executable is subsequently expected to run in an environment containing TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY. Any process running under the same environment can read these variables. If the tap, formula, release artifact, upstream hosting account, or maintainer account is compromised, a modified executable could access and exfiltrate those credentials and any log data returned by Tencent Cloud CLS.

This finding does not establish that the current third-party package is malicious. The risk arises from the mutable, unverified supply-chain trust relationship combined with access to cloud credentials.

Attack Path

1. An attacker compromises the third-party Homebrew tap, formula repository, upstream release artifact, or a maintainer account.
2. The attacker modifies the formula or referenced artifact ...[truncated 1361 chars]

Remediation

View remediation

Remediation Suggestions

1. Link to the exact authoritative source repository rather than the generic homepage currently shown in the metadata.
2. Pin installation to an immutable, reviewed release and Homebrew formula commit instead of tracking a mutable tap revision.
3. Publish expected SHA-256 or stronger artifact digests and verify them before installation.
4. Prefer signed release artifacts and document verification of the publisher's cryptographic signature.
5. Review and vendor the Homebrew formula or provide a reproducible build process so users can verify the relationship between source and binary.
6. Use short-lived Tencent Cloud credentials instead of long-lived static keys wherever supported.
7. Assign a dedicated IAM identity with only the minimum read-only CLS permissions required to list topics, query logs, and retrieve context.
8. Restrict credentials to the necessary accounts, regions, logsets, and topics, and rotate them immediately if dependency compromise is suspected.
9. Avoid globally exporting credentials for longer than necessary. Provide credentials only to the intended process through an approved secret-management mechanism.
10. Document the dependency trust model, supported version, required IAM actions, credential rotation procedure, and steps for validating installed binaries.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents output options that write retrieved cloud log data to local files, such as result.json, but does not warn that queried logs may contain sensitive or regulated data. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.