ctyun-cli-天翼云-命令行

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:29 AM UTC
• Version: 1.30.0

Overview

This CTYUN CLI guide is coherent, but it under-explains risky handling of powerful cloud credentials and live infrastructure commands.

Review before installing. Use an isolated environment, pin and verify the ctyun-cli package or source commit, and avoid placing long-lived CTYUN secrets in shell startup files or command history. Use least-privilege credentials, rotate any secrets previously exposed this way, and require explicit confirmation before kubeconfig retrieval, deletion, or production-impacting cloud operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Third-Party CLI Dependency Executes Code Outside the Audited Project

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:6, 17-30
Vulnerability Type: Unpinned executable dependency from external package repositories
Risk Level: Medium

Relevant Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"☁️","requires":{"bins":["ctyun-cli"]},"install":[{"id":"pip","kind":"pip","package":"ctyun-cli","bins":["ctyun-cli"],"label":"Install ctyun-cli (pip)"}]}}

bash

pip install ctyun-cli

bash

pipx install ctyun-cli

bash

git clone https://github.com/fengyucn/ctyun-cli.git
cd ctyun-cli
pip install -e .

Technical Analysis

The Skill declares and recommends installation of an executable Python package without specifying an exact version, package hash, signed artifact, Git commit, or immutable source reference. The installed implementation is not included in the audited project, which contains only SKILL.md and _meta.json; consequently, its installation hooks, transitive dependencies, and runtime behavior cannot be verified from this artifact.

A mutable command such as pip install ctyun-cli resolves whichever release and dependencies are available at installation time. Likewise, cloning the default Git branch and running pip install -e . executes content selected by the repository state at that time. Python package installation can invoke build backends and other executable packaging components before the CLI is used.

This is a supply-chain weakness rather than evidence that the current upstream package is malicious. No malicious payload was found in the audited files.

Attack Path

1. An attacker compromises the package publisher account, source repository, release process, or an unpinned transitive dependency.
2. The attacker publishes a modified package release or changes the repository's default branch.
3. A user or Agent follows the Skill's installation instructions.
4. pip, pipx, or the editable installation resolves and ...[truncated 860 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin ctyun-cli to a reviewed exact version in both metadata and documentation.
2. Require cryptographic hashes for downloaded distributions, such as through a locked requirements file and pip --require-hashes.
3. Pin source installations to a reviewed immutable Git commit rather than the default branch.
4. Verify package provenance, publisher identity, release signatures, and repository ownership before installation.
5. Audit the complete upstream source, build configuration, installation hooks, and transitive dependency lockfile.
6. Prefer isolated installation with a dedicated virtual environment or restricted container.
7. Install and run the CLI using a non-privileged operating-system account.
8. Use least-privilege CTYUN credentials and monitor package updates before approving newer versions.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:44

Finding

Cloud Secret Key Is Exposed Through Shell Persistence and Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:44-52
Vulnerability Type: Plaintext credential persistence and command-line secret exposure
Risk Level: High

Relevant Code Snippet:

bash

export CTYUN_ACCESS_KEY=your_access_key
export CTYUN_SECRET_KEY=your_secret_key

bash

ctyun-cli configure --access-key YOUR_ACCESS_KEY --secret-key YOUR_SECRET_KEY --region cn-north-1

Technical Analysis

The documentation recommends exporting CTYUN credentials and making that configuration permanent by adding the exports to shell startup files such as ~/.bashrc or ~/.zshrc. This stores long-lived cloud credentials as plaintext in files routinely read by every interactive shell and commonly included in workstation backups, support archives, synchronization tools, and accidental repository commits.

The alternative configuration command supplies both credentials directly as command-line arguments. Depending on the shell and operating system, these values may be retained in shell history and temporarily exposed through process inspection facilities. Any local process or user with sufficient process-inspection or file-read permissions could obtain them.

Environment variables also propagate to child processes by default. A compromised dependency or unrelated process launched from the configured shell could therefore read CTYUN_ACCESS_KEY and CTYUN_SECRET_KEY.

Attack Path

1. A user follows the documented instructions and places the export statements in a shell startup file, or invokes the configuration command with real credentials.
2. The secret is stored in plaintext in a startup file or shell history, appears in process arguments during execution, or is inherited by child processes through the environment.
3. A malicious local process, compromised dependency, unauthorized local user, backup recipient, or accidental repository consumer accesses the exposed value.
4. The attacker extracts the ...[truncated 1019 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not recommend placing access keys or secret keys in shell startup files.
2. Do not accept secret keys through command-line arguments.
3. Use an interactive configuration flow that reads secrets through hidden terminal input.
4. Store credentials in an operating-system credential manager, encrypted secret store, hardware-backed key store, or a protected cloud credential helper.
5. If a local configuration file is unavoidable, encrypt sensitive values and enforce owner-only permissions such as mode 0600.
6. Prefer short-lived, automatically rotated credentials or workload identity instead of static access keys.
7. Apply least-privilege IAM policies and separate credentials by environment and function.
8. Prevent debug output, logs, crash reports, and configuration-display commands from printing secret values.
9. Document procedures for clearing affected shell history and rotating credentials if users previously followed these instructions.
10. Monitor authentication logs for misuse and revoke exposed keys immediately.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Documenting a command that retrieves kubeconfig exposes a path to highly sensitive cluster access material. In an agent skill context, this is more dangerous because an autonomous system could be induced to fetch credentials and then use or disclose them, enabling cluster compromise or lateral movement.

Content

Scanner excerpt · SKILL.md (reported line 400)May include surrounding context.

ctyun-cli cce describe-cluster --cluster-id YOUR_CLUSTER_ID

text

### 获取 Kubeconfig
```bash
ctyun-cli cce get-kubeconfig --cluster-id YOUR_CLUSTER_ID

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This finding refers to the same sensitive capability: obtaining kubeconfig for a cluster. Even though the documentation is legitimate, kubeconfig commonly contains client certificates, tokens, endpoints, and context data that can grant administrative or broad cluster access if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.

获取 Kubeconfig

bash

ctyun-cli cce get-kubeconfig --cluster-id YOUR_CLUSTER_ID

列出节点

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documentation includes a namespace deletion command for CCE, but there is no nearby warning that deleting a namespace can remove workloads and associated resources. For markdown files, destructive behaviors affecting user data or system integrity should be disclosed clearly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file documents commands that can modify billing mode, bandwidth, NAT, EIP, and related cloud resources, including potentially irreversible or service-impacting changes such as modify, to-cycle, and to-ondemand. The surrounding documentation presents them as routine examples but does not warn that these operations may change live infrastructure state, incur charges, or disrupt services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation presents ctyun-cli clear-cache under a simple heading, but does not explain what cached data will be removed or that users may lose locally stored state and need to re-fetch data afterward. This is a data-affecting operation that should be disclosed in the markdown description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.