tencent-cos-ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:13 AM UTC
• Version: 1.0.0

Overview

This skill does the advertised Tencent COS file operations, but it can delete cloud objects and overwrite local files without built-in safety checks.

Review before installing. Use a dedicated least-privilege COS key limited to the intended bucket and prefixes, avoid production credentials during testing, confirm object keys before deletion, avoid downloading over important local files, and consider pinning the COS SDK version in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/cos_api.md:5

Finding

Unpinned Dependency Installation with Forced Upgrade

Content

View full analysis

Vulnerability Details

File Locations:

• references/cos_api.md:5
• scripts/cos_ops.py:7

Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

From references/cos_api.md:3-6:

bash

## Installation

```bash
pip install -U cos-python-sdk-v5

text

From `scripts/cos_ops.py:7`:

```python
Dependencies: pip install -U cos-python-sdk-v5

Technical Analysis

The project instructs users to install cos-python-sdk-v5 with the -U option and without an exact version constraint, dependency lock file, or package integrity hash. As a result, installation resolves the latest package version and its transitive dependencies at installation time.

The audited project does not contain evidence that this package is currently malicious. However, the mutable installation process creates a supply-chain risk: a future compromised, malicious, or unexpectedly incompatible release could be installed without undergoing the same review as the source code in this project. The forced-upgrade option can also replace a previously reviewed version with a newer unreviewed version.

Python package installation and import may execute package-controlled code. The COS client also operates in a process that has access to COS_SECRET_ID, COS_SECRET_KEY, COS_REGION, and COS_BUCKET, making dependency integrity especially important.

Attack Path

1. An attacker compromises the referenced package, one of its transitive dependencies, or the relevant package publishing account.
2. The attacker publishes a malicious release that satisfies the unrestricted dependency request.
3. A user follows the documented command:

   bash

   pip install -U cos-python-sdk-v5
   

4. pip retrieves and installs the malicious or compromised release instead of a previously reviewed version.
5. Package-controlled code executes during installation or when qcloud_cos is imported and used.
6. The malicious code runs with the pr ...[truncated 956 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unrestricted installation command with an exact, reviewed version:

   bash

   pip install cos-python-sdk-v5==<reviewed-version>
   

2. Remove -U from normal installation instructions so that installation does not silently replace a reviewed dependency with the latest release.

3. Maintain a lock file that pins all transitive dependencies, using a tool such as pip-tools, Poetry, or an equivalent reproducible dependency-management system.

4. Require package hashes during installation. For example, generate a hash-locked requirements file and install it with:

   bash

   pip install --require-hashes -r requirements.txt
   

5. Review dependency changes before updating pinned versions, including release provenance, maintainership changes, transitive dependency changes, and known vulnerability reports.

6. Perform installations in an isolated virtual environment and avoid exposing production COS credentials during dependency installation.

7. Restrict the COS identity according to least privilege, limiting it to required buckets and operations so that a compromised runtime dependency has a reduced impact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requires sensitive environment variables containing Tencent COS credentials, but it does not declare any explicit tool scope or permissions boundary. This weakens auditability and increases the risk that an agent or runtime exposes or misuses secrets beyond the intended storage operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation advertises object deletion but does not warn that the action is destructive and may permanently remove cloud data. In an agent setting, this omission can lead to unsafe execution, accidental deletion of production data, or user misunderstanding about the irreversibility and scope of delete operations.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/cos_api.md (reported line 30)May include surrounding context.

简单上传（文件流）：

python

with open('picture.jpg', 'rb') as fp:
    response = client.put_object(
        Bucket='examplebucket-1250000000',
        Body=fp,
        Key='picture.jpg'

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · scripts/cos_ops.py (reported line 79)May include surrounding context.

python

**简单上传（文件流）**：
```python
with open('picture.jpg', 'rb') as fp:
    response = client.put_object(
        Bucket='examplebucket-1250000000',
        Body=fp,
        Key='picture.jpg'

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/cos_api.md (reported line 39)May include surrounding context.

高级上传（自动分块）：

python

response = client.upload_file(
    Bucket='examplebucket-1250000000',
    LocalFilePath='local.txt',
    Key='picture.jpg',

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · scripts/cos_ops.py (reported line 127)May include surrounding context.

python

**高级上传（自动分块）**：
```python
response = client.upload_file(
    Bucket='examplebucket-1250000000',
    LocalFilePath='local.txt',
    Key='picture.jpg',

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown demonstrates object deletion with delete_object, which can remove user data, but provides no warning that the operation is destructive or potentially irreversible. For markdown files, descriptions should warn about behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The download path is taken directly from user input and written via get_stream_to_file() without any overwrite check, path restriction, or confirmation. In an agent/tooling context, this can clobber arbitrary local files if the agent is induced to use a sensitive destination path, causing data loss or replacement of trusted files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The delete command performs irreversible remote deletion based solely on a supplied object key and bucket, with no confirmation, dry-run mode, or policy guardrails. In an agent-operated skill, prompt injection or user error could cause unintended deletion of cloud data with immediate availability impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file includes example code that reads COS_SECRET_ID and COS_SECRET_KEY from environment variables, which are sensitive credentials. The surrounding documentation does not warn users to protect these values, avoid committing them, or use least-privilege credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.