huawei-cloud-vod-collector

• Outcome: Review
• Latest audit: Aug 6, 2026 · 4:44 AM UTC
• Version: 1.0.1

Overview

This feedback-reporting skill is mostly disclosed, but it needs Review because it can capture rich local context, use persistent local credentials, install third-party login tooling, and publish reports externally without a fresh destination confirmation.

Install only if you are comfortable with a feedback skill that can create local .vod records, collect environment and dialog context, use AtomGit/GitCode credentials, install AtomGit-GO helper binaries, and submit issue content to the configured GitCode repository. Review and narrow the config before use, remove the thinking field, confirm the repo destination, and avoid running auto-login or installer steps unless you trust the AtomGit-GO source and token storage model.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill advertises no declared permissions while clearly instructing use of file writes, shell execution, local environment access, and network communication. This undermines user and platform trust boundaries because an operator may invoke it expecting a low-privilege documentation helper, while it can persist data locally and interact with external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The stated purpose is feedback collection, but the behavior extends to external issue creation, local token handling, starting a login server, polling localhost, and installing third-party tooling. That mismatch is dangerous because users may consent to harmless note-taking without realizing the skill can exfiltrate content to a remote repository and alter the local environment.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The template explicitly instructs logging assistant chain-of-thought via the `[thinking]` field. Capturing internal reasoning is unnecessary for Huawei Cloud issue feedback collection and can expose sensitive hidden analysis, policy logic, secrets, or intermediary data that should never be retained or redistributed.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The configuration explicitly enables collection of environment data and retains multi-turn dialog and error-stack context, which can capture more user/system data than is necessary for basic issue reporting. In a feedback-collection skill, this broadens the data exposure surface and increases the chance that sensitive prompts, secrets, tokens, file paths, or internal errors are collected and later transmitted or stored.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The delivery configuration supports outbound transmission to a Git repository and optional webhook/email channels, creating multiple exfiltration paths for captured conversation and environment data. Because this skill is described as feedback capture, undisclosed or loosely controlled outbound channels materially increase the risk of sensitive data leaving the local trust boundary.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: Optional webhook and email notification features are more general-purpose than the stated bug-reporting function and can be repurposed to send captured data to arbitrary external endpoints. Even though disabled in the template, their presence expands capability scope and makes accidental or malicious reconfiguration more dangerous, especially when combined with rich context capture.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The acceptance criteria expand a simple feedback-collection skill into one that performs delivery to a remote repository and manages authentication state. That materially exceeds the declared purpose and increases the skill’s ability to exfiltrate user-provided content or system-derived data to external services, especially when tied to automated submission workflows.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Automatic installation/login and persistent token storage are high-risk capabilities that are not necessary for merely collecting user feedback. They create a pathway for credential acquisition, persistence, and unintended outbound actions, and the local token file becomes a sensitive asset that could be abused by other components or future workflow steps.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The helper treats any CLI value beginning with '@' as a filesystem path and reads that file's contents into the feedback record without validation, path restrictions, or sensitivity checks. If an upstream agent or untrusted user can influence CLI arguments, this creates a local file disclosure primitive that can exfiltrate secrets, tokens, configs, or other sensitive host data into persisted markdown output.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The docstring characterizes the '@filepath' mechanism as 'safe', but the implementation performs unrestricted file reads from arbitrary paths. That misleading safety claim increases the chance that integrators will expose this behavior to untrusted input or rely on it without adding compensating controls, which can enable the file disclosure issue above.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill goes beyond passive feedback collection by automatically creating issues in an external GitCode repository using locally discovered credentials. That creates a data-exfiltration and unintended side-effect risk because user-provided feedback, environment details, and stack traces may be transmitted to a third party without strong consent controls or content redaction.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill can start and stop a local login server process even though its stated purpose is feedback capture and requirement distillation. Launching auxiliary services expands the attack surface and can enable unintended local process execution or credential flows that users do not expect from this skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code reads authentication tokens from home-directory or environment-selected AtomGit-GO auth files and then uses the access token for outbound API calls. This is dangerous because it silently repurposes existing user credentials across trust boundaries, enabling unauthorized use of the user's account and possible leakage of repository metadata or feedback contents to external systems.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s declared skill purpose is collecting Huawei Cloud user feedback, but the implementation instead clones and builds third-party software from a remote repository. This is dangerous because it introduces unrelated code execution and software installation capabilities, creating supply-chain and arbitrary code execution risk that is not justified by the stated functionality.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code downloads a remote Git repository and executes a local build process, resulting in execution of untrusted third-party source code in the user environment. In the context of a feedback/reporting skill, that capability is especially suspicious and dangerous because it can install persistence or malicious binaries under the guise of a benign support workflow.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script's behavior is unrelated to the declared skill purpose of collecting Huawei Cloud user feedback. Instead, it clones and installs executables from an external repository into the user's local bin directory, which creates an unjustified software installation pathway and strongly suggests hidden or deceptive functionality within the skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script performs a git clone from a third-party repository and extracts a tarball containing executables into ~/.local/bin without authenticity verification, checksum validation, signature verification, or provenance controls. In the context of a feedback-collection skill, this is especially dangerous because it can silently introduce arbitrary code execution under the user's account under false pretenses.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a standalone secret-redaction CLI for text and arbitrary files, which does not match the declared purpose of collecting Huawei Cloud poor-experience feedback and turning it into Voice of Developer requirements. In an agent-skill context, this capability mismatch is dangerous because it expands the skill's authority and data-handling surface beyond user expectations, creating an opportunity to process or alter sensitive local content unrelated to the claimed workflow.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code reads and writes any user-specified path and, by default, overwrites the original file in place. That gives the skill an unnecessary arbitrary file modification capability, which is risky in an agent setting because a user or upstream prompt could direct it to alter unrelated local files, causing data loss, corruption, or unauthorized modification of sensitive content.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The template requires storing `full content, never truncate` for conversation turns and also includes assistant chain-of-thought. This creates excessive data retention and privacy risk, potentially capturing credentials, personal data, proprietary prompts, and internal reasoning unrelated to debugging, making the feedback pipeline a high-value exfiltration and compliance target.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

#### 3.1 Sync to GitCode Issue

> ⚠️ `repo_url` comes **only** from `assets/config.yaml.template` → `delivery.channels.gitcode.repo_url`. Never use `git remote`, never ask the user.

**Single delivery** — submit one feedback as a GitCode Issue:

• Confidence: 90% confidence
• Finding: The instruction to derive the target repository only from configuration and 'never ask the user' removes an important consent and verification checkpoint before publishing feedback externally. In context, the skill can send potentially sensitive user problem reports to a configured remote destination without a fresh user confirmation of where the data will go.

Credential Access

High

• Category: Privilege Escalation

Content

**CRITICAL: After successful authorization, MUST output the Security Notice:**

   - **Security Notice:** After authorization, the access token **will be saved** to `~/.atomcode/auth.toml` (owner-readable only, mode 0600). Anyone with file access can impersonate you — do not share this file.
   - **Note:** Stored only in the local AI Shell environment. It will not be uploaded to any external server.
   - **Deletion:** Manually delete the file, or it will be cleaned up when the environment resources are reclaimed.

• Confidence: 96% confidence
• Finding: The skill explicitly causes an access token to be stored in plaintext in `~/.atomcode/auth.toml`, which creates credential exposure risk if the local environment is compromised, shared, backed up insecurely, or later accessed by other tools. The notice acknowledges impersonation risk, confirming that token persistence is security-sensitive and materially increases the blast radius of compromise.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Token from open-source [AtomGit-GO](https://gitcode.com/weixin_45218422/AtomGit-GO), saved **in plaintext** to `~/.atomcode/auth.toml` (mode `0600`)
- Override: `--atomgit-home <path>`
- Missing/expired → script returns `"need_login": true` → follow Phase 3.1 auto-login
- **Never** write token to any file outside `~/.atomcode/auth.toml`

• Confidence: 94% confidence
• Finding: This finding confirms persistent credential storage in a fixed location, which creates session persistence beyond the immediate task and enables future impersonation if the file is accessed. The fact that the skill normalizes this storage behavior and supports overriding the directory increases the chance of credentials being retained in user-controlled or less-protected paths.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyyaml>=6.0
tomli>=2.0

• Confidence: 93% confidence
• Finding: The dependency specification uses a lower-bound only constraint (pyyaml>=6.0), which allows future unreviewed versions to be installed. This weakens build reproducibility and can introduce supply-chain risk if a later release contains a malicious change, breaking change, or newly introduced vulnerability. In this skill, the risk is somewhat limited because the file only declares common libraries and contains no direct execution logic, but it still increases exposure in downstream environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyyaml>=6.0
tomli>=2.0

• Confidence: 92% confidence
• Finding: The dependency specification tomli>=2.0 is unpinned, so installations may resolve to different future versions over time. That creates a supply-chain and reproducibility risk because an unexpected upstream release could introduce vulnerable or malicious behavior without any change to this repository. The skill context does not materially increase danger here, but it also does not mitigate the dependency hygiene issue.

Static analysis

No suspicious patterns detected.