byted-bp-cdn-pagesdeploy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:18 AM UTC
• Version: 1.0.1

Overview

This deployment skill has a legitimate purpose, but its scripts expose users to unexpected local code execution, persistent cloud credential storage, and service-affecting cloud changes with limited safeguards.

Review this skill before installing or using it on a machine with valuable files or production cloud credentials. Use only trusted build commands and metadata values, prefer short-lived or isolated credentials, verify exact project IDs before deploy/offline/delete operations, and avoid running it in shared or CI environments unless credential persistence and npm package installation are acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/deploy.sh:215

Finding

Shell Command Injection Through Deployment Metadata

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/deploy.sh:132

Finding

Python Code Injection Through the Secrets File Path

Content

View full analysis

/dev/null || true) sk=$(python3 -c "import json; print(json.load(open('$secrets'))['secret_key'])" 2>/dev/null || true) ``` ### Technical Analysis The caller-controlled `--secrets-file` path is interpolated directly into Python source passed to `python3 -c`. Shell quoting does not protect the resulting Python string literal. A path containing a single quote can terminate `open('...')` and append attacker-controlled Python statements. The path is not limited to a trusted directory and is not passed as a normal process argument. Consequently, a value that is valid shell data can become executable Python syntax after interpolation. ### Attack Path 1. An attacker causes the deployment command to use a crafted `--secrets-file` value. 2. The script stores this value in `SECRETS_FILE` and later in `secrets`. 3. The path is embedded inside the source string supplied to `python3 -c`. 4. A quote in the path terminates the intended Python string literal. 5. Injected Python code executes with the privileges of the deployment user. 6. The trailing syntax can be neutralized by the crafted input so that the overall Python command remains valid. ### Impact Assessment Exploitation permits arbitrary Python code execution as the invoking user. The attacker could read files and environment variables, modify local data, launch subprocesses, or access deployment credentials. The scope includes all resources available to the local account and any cloud permissions represented by credentials accessible during execution. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:16

Finding

Unpinned Nest CLI Installation Creates Supply-Chain Risk

Content

View full analysis

/dev/null ``` From `scripts/deploy.sh`: ```bash if npm install @byteplus/nest --prefix "$install_dir" 2>/dev/null; then NEST="$install_dir/node_modules/.bin/nest" log_ok "Installed nest CLI to $install_dir" else # Fallback to /tmp install_dir="/tmp/nest-cli-$$" npm install @byteplus/nest --prefix "$install_dir" 2>/dev/null NEST="$install_dir/node_modules/.bin/nest" ``` ### Technical Analysis The scripts install `@byteplus/nest` without an exact version or lockfile. Every new installation can therefore resolve to a different package release. NPM package lifecycle scripts may execute during installation, giving the resolved package an immediate code-execution opportunity. Although the package name is consistent with the documented service, the implementation does not establish which reviewed artifact should be trusted. A compromised upstream release, registry account, dependency, or package resolution path could change the code executed by the Skill after the Skill itself has been audited. ### Attack Path 1. The Nest CLI is absent from the expected local and global locations. 2. The deployment or setup script invokes `npm install @byteplus/nest`. 3. NPM resolves the currently published package and its transitive dependencies. 4. Installation lifecycle scripts execute under the deployment user's account. 5. The newly installed executable is immediately trusted and used for authentication and cloud operations. 6. A compromised dependency can access local files, environment variables, or credentials and can alter subsequent deployment behavior. ### Impact Assessment A compromised package ...[truncated 379 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/deploy.sh:177

Finding

Arbitrary Shell Execution Through the Build Command Option

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/deploy.sh:205

Finding

Ambiguous Project Name Matching Can Modify the Wrong Deployment

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents a destructive delete operation (manage.sh delete --pages p-xxx) without any warning about irreversible project removal, confirmation expectations, or guidance to verify the target before execution. In an agent-driven workflow, users may copy or invoke this command with limited review, increasing the risk of accidental deletion of production Pages projects or associated deployment state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script persists access_key and secret_key into the nest CLI global config using config set -g, which stores credentials beyond the lifetime of this deployment. On shared machines, CI runners, or agent environments, later processes or users may read or reuse these credentials, increasing the blast radius of any compromise.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script executes the user-provided --build-cmd value with shell eval, which permits arbitrary shell metacharacters, command substitution, and chaining. In an agent/skill context, this is dangerous because untrusted or indirectly influenced input can lead to arbitrary code execution on the host running the deployment, including secret theft or filesystem tampering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script offers a user-controlled build command and executes it via eval without an explicit trust boundary or safety warning. In this deployment skill, that makes the feature more dangerous because build parameters may come from automation, wrappers, or less-trusted operators, turning a convenience option into arbitrary command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The offline command performs a service-affecting operation immediately with no confirmation, dry-run, or explicit warning. In a deployment-management skill, this increases the risk of accidental downtime from mistyped IDs, automation misuse, or an operator misunderstanding, especially since nearby destructive actions like delete do require confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script reads the Secret Key with a normal prompt, so the credential is echoed to the terminal as the user types. This can expose the secret to shoulder-surfing, screen recording, terminal logs, or session capture tools, which is especially risky in a deployment setup workflow where real cloud credentials are being entered interactively.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persists the access key and secret key into the CLI's global configuration without clearly warning the user that long-lived cloud credentials will be stored on disk for future use. If the local machine, home directory, backups, or config files are later accessed by another user or malware, these credentials could be recovered and used to manage or deploy cloud resources.

Content

No source excerpt is available for this finding.