Security audit

uk8s

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it handles cloud credentials and billable cluster creation in ways users should review carefully before installing.

Install only if you are comfortable with an agent creating paid UCloud infrastructure, installing ucloud-cli from GitHub, and handling a generated cluster password in normal files and chat. Safer behavior would require explicit approval before provisioning, verified CLI installation, a private temporary file that is deleted, and avoiding plaintext password disclosure in the transcript.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:58
Finding: Unverified Remote CLI Download and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:181
Finding: Cluster Login Credential Written to a Predictable Temporary File and Disclosed in Plaintext
Content: View full analysis
" | base64 ``` The instructions explicitly require retaining the plaintext value: ```text The plaintext password must be recorded and reported to the user at the end. ``` The encoded credential is placed in a request document written to a fixed temporary path: ```json { "Action": "CreateUK8SClusterV2", "Region": "", "Zone": "", "ProjectId": "", "ClusterName": "", "Tag": "Default", "LoginMode": "Password", "Password": "", "K8sVersion": "", "VPCId": "", "SubnetId": "", "ExternalApiServer": "Yes" } ``` The request is submitted from that file: ```bash ucloud api --local-file /tmp/create_uk8s.json ``` The final response is instructed to disclose the plaintext credential: ```text Login password: (Keep this password secure.) ``` ### Technical Analysis Base64 encoding does not protect a secret. Anyone who reads `/tmp/create_uk8s.json` can trivially recover the original cluster password. The Skill does not require restrictive file permissions, exclusive creation, symlink protection, ownership validation, or deletion after the API request. The fixed path `/tmp/create_uk8s.json` is predictable. Depending on the behavior of the Write tool and the host operating system, another local process may be able to pre-create, monitor, replace, or link this path. Even without active exploitation, the credential-bearing file can remain on disk after completion and be exposed through local inspection, backups, crash collection, or forensic rec ...[truncated 3308 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The final reporting step instructs the agent to print the cluster login password back to the user, guaranteeing credential exposure in transcript history. In this context, the danger is elevated because the password grants administrative access to newly provisioned cloud infrastructure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The skill downloads an executable archive from the internet and installs it locally during execution. Even though the source is an official GitHub release URL, fetching and executing external binaries at runtime introduces supply-chain risk and bypasses normal package verification and administrator review.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') INSTALL_DIR="$HOME/.local/bin" mkdir -p "$INSTALL_DIR" curl -L "https://github.com/ucloud/ucloud-cli/releases/download/v0.3.0/ucloud-${OS}_${ARCH}.zip" -o /tmp/ucloud.zip unzip -o /tmp/ucloud.zip -d "$INSTALL_DIR" chmod +x "$INSTALL_DIR/ucloud" export PATH="$INSTALL_DIR:$PATH"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to record the generated plaintext cluster password and later disclose it, without any sensitive-data handling safeguards. This creates unnecessary credential exposure in agent memory, tool logs, transcripts, and user-visible output.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Directing the agent to retain and disclose a generated login password in plaintext is a clear secret-handling flaw. If conversation history, telemetry, or shared logs are accessed by others, the cluster can be compromised immediately using those credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill automates creation of a paid UK8S cluster and stages a full request file in /tmp, but it does not require an explicit user confirmation that acknowledges cost, resource creation, and system-impact before execution. In an agent setting, this increases the risk of unintended billable infrastructure provisioning and exposure of request data via a world-readable or shared temporary path depending on host configuration.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 80% confidence
Finding: The instructions fetch and unpack a CLI binary from an external source without integrity verification. In a skill context this is less severe than arbitrary script execution because it does not pipe remote content directly to a shell, but it still creates an avoidable supply-chain and host-modification risk.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') INSTALL_DIR="$HOME/.local/bin" mkdir -p "$INSTALL_DIR" curl -L "https://github.com/ucloud/ucloud-cli/releases/download/v0.3.0/ucloud-${OS}_${ARCH}.zip" -o /tmp/ucloud.zip unzip -o /tmp/ucloud.zip -d "$INSTALL_DIR" chmod +x "$INSTALL_DIR/ucloud" export PATH="$INSTALL_DIR:$PATH"

Static analysis

No suspicious patterns detected.