huawei-cloud-publish-work-to-gallery

• Outcome: Review
• Latest audit: Sep 9, 2026 · 1:00 PM UTC
• Version: 1.0.0

Overview

The skill is plausibly for publishing projects, but it asks the agent to run broad local setup, inspect credentials, open tunnels, and handle cloud credentials in ways that need careful review.

Install only if you are comfortable giving this skill broad access to your project, local Git/Huawei Cloud authentication state, package installation, browser/font setup, and optional public tunneling. Use it in a dedicated workspace or container, review destination host/protocol environment variables, avoid running remote installer one-liners without verification, and delete temporary STS credential files after publishing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/devbridge-tunnel.md:3
• Finding: Unverified Remote Installer Scripts Are Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `references/devbridge-tunnel.md:3-27`; `references/troubleshooting.md:148` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash # references/devbridge-tunnel.md:3-9 ### Linux / macOS ```bash curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash ``` ``` ```bash # references/devbridge-tunnel.md:17-21 rm -rf /root/.huawei/devbridge 2>/dev/null echo "y" | curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash ``` ```powershell # references/devbridge-tunnel.md:23-27 ### Windows (PowerShell 5.1+) ```powershell irm https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.ps1 | iex ``` ``` ```bash # references/troubleshooting.md:148 curl -sSL https://res-hw-global.obs.ap-southeast-1.myhuaweicloud.com/cli/latest/hcloud_install.sh -o hcloud_install.sh && bash hcloud_install.sh ``` ### Technical Analysis The documented installation procedures retrieve mutable scripts from external URLs and immediately execute them with Bash or PowerShell. The procedures do not pin an immutable version, verify a cryptographic signature, compare a pinned digest, or provide a review boundary between download and execution. The headless installation workaround is particularly dangerous because it first removes the existing DevBridge configuration directory and then supplies automatic confirmation to the unverified installer. This removes safeguards and may destroy configuration or security state before executing externally controlled code. HTTPS protects the transport connection but does not protect against compromise of the hosting account, CDN, object-storage bucket, DNS infrastructure, signing pipeline, or upstream installer itself. ### Attack Path 1. An attacker compromises the installer origin, CDN distribution, storage bucket, DNS path, or vendor publishing account. 2. The attacker replaces t ...[truncated 926 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash`, `Invoke-RestMethod | Invoke-Expression`, and equivalent direct-execution instructions. 2. Publish immutable, versioned installer artifacts. 3. Download the artifact to a new file without executing it. 4. Verify a vendor signature and a pinned SHA-256 or stronger digest before execution. 5. Display the resolved version, source, digest, and requested filesystem changes to the user. 6. Require explicit user confirmation before running the verified installer. 7. Run installation with the lowest available privileges and in a sandbox where possible. 8. Do not automatically remove existing credential or configuration directories. 9. Document a manual installation path that allows source review. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: scripts/check-version.mjs:86
• Finding: Unauthenticated Remote Content Controls Agent-Facing Upgrade Instructions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check-version.mjs:86-94`; `SKILL.md:41,68`; `references/api-spec.md:89-110` **Vulnerability Type**: Remote instruction and output injection **Risk Level**: High ### Vulnerable Code ```js // scripts/check-version.mjs:86-94 for (let i = 0; i < 4; i += 1) { if (a[i] < b[i]) { const promptRes = runApiGet([ "/v1/gallery/prompt", "--prefix", "open-api-guest", "--query", "type=skills&target=outdated&params={}" ]); const prompt = typeof promptRes.data?.data?.prompt === "string" ? promptRes.data.data.prompt.trim() : ""; console.log("status=outdated"); if (prompt) console.log(prompt); process.exit(1); } if (a[i] > b[i]) break; } ``` The corresponding Skill instruction requires the Agent to reproduce the platform-provided upgrade message verbatim and stop publishing: ```text SKILL.md:68 status=outdated → relay the script's upgrade text verbatim to the user and stop publishing. ``` The API documentation explicitly permits the returned prompt to contain an installation command: ```json { "data": { "prompt": "Your publish-work-to-gallery skill is outdated. Update it and retry: npx skills add ..." } } ``` ### Technical Analysis The Skill treats content returned by an unauthenticated guest endpoint as trusted Agent-facing instruction text. The response is not restricted to a structured version identifier or a locally generated message. There is no URL allowlist, command allowlist, output escaping policy, maximum semantic scope, or separation between untrusted service data and Skill instructions. The requirement to reproduce the response verbatim gives the external service control over content emitted in the Agent's current session. Because the documented prompt may include installation commands, compromise or misconfiguration of the service could redirect users to malicious packages or repositories. ### Attack Path 1 ...[truncated 1090 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the remote prompt endpoint from the security-sensitive upgrade path. 2. Retrieve only a strictly validated version identifier and generate the upgrade message locally. 3. Treat all remote strings as untrusted quoted data, never as Agent instructions. 4. If remote links are required, validate them against an exact HTTPS hostname and path allowlist. 5. Do not reproduce remote content verbatim. 6. Do not allow remote responses to supply shell, `npx`, package-manager, or Skill-installation commands. 7. Require explicit user confirmation before any update or installation. 8. Cryptographically sign version metadata if it is used to block normal operation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gen_sts.py:83
• Finding: Temporary Cloud Credentials Are Stored in Predictable Plaintext Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gen_sts.py:83-84,105-118`; `scripts/publish-work.mjs:125-133`; `scripts/api.mjs:287-297` **Vulnerability Type**: Unsafe temporary credential storage **Risk Level**: High ### Vulnerable Code ```python # scripts/gen_sts.py:83-84 creds_out = args.creds_out or str( Path(tempfile.gettempdir()) / "sts-creds.json" ) sh_out = args.sh_out or str( Path(tempfile.gettempdir()) / "sts-creds.sh" ) ``` ```python # scripts/gen_sts.py:105-118 camel = { "accessKeyId": c["credentials"]["access_key_id"], "secretAccessKey": c["credentials"]["secret_access_key"], "securityToken": c["credentials"]["security_token"], "_refresh": { "accountId": args.account, "agencyUrn": agency_urn, "region": args.region, "hcloudExe": hcloud_exe }, } Path(creds_out).write_text( json.dumps(camel, indent=2, ensure_ascii=False), encoding="utf-8" ) Path(sh_out).write_text( f"export STS_AK='{c['credentials']['access_key_id']}'\n" f"export STS_SK='{c['credentials']['secret_access_key']}'\n" f"export STS_TOKEN='{c['credentials']['security_token']}'\n", encoding="utf-8", ) ``` ```js // scripts/publish-work.mjs:125-133 const credsFile = path.join( os.tmpdir(), `sts-creds-${process.pid}.json` ); const credsObj = { accessKeyId, secretAccessKey, securityToken }; if (_refresh && _refresh.accountId && _refresh.agencyUrn && _refresh.region) { credsObj._refresh = _refresh; } writeFileSync(credsFile, JSON.stringify(credsObj), "utf8"); ``` The refresh path similarly overwrites the credentials file without explicitly preserving restrictive permissions: ```js // scripts/api.mjs:287-297 const updated = { accessKeyId: newCreds.access_key_id, secretAccessKey: newCreds.secret_access_key, securityToken: newCreds.security_token, _refresh: refresh, }; fs.writeFileSync(credsFile, JSON.stringify(updated, null, 2), "utf8"); ``` ### Technical Analysis The default STS ...[truncated 1850 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory with mode `0700`. 2. Use `tempfile.mkstemp`, `NamedTemporaryFile`, or an equivalent exclusive-creation API. 3. Set credential files to mode `0600` at creation time; do not rely on the ambient umask. 4. Reject symbolic links and use no-follow semantics where supported. 5. Eliminate the duplicate `sts-creds.sh` file unless strictly necessary. 6. Avoid storing credentials in publication parameter JSON files. 7. Delete credential files in `finally` blocks and register signal/exit cleanup handlers. 8. Preserve restrictive permissions when refreshing credentials. 9. Use an OS credential store or inherited file descriptor where practical. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/api.mjs:38
• Finding: Environment Variables Can Redirect Credentialed Uploads to an Arbitrary Host or Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/api.mjs:38-41,179-199,334-369` **Vulnerability Type**: Credential and artifact exfiltration through unsafe endpoint configuration **Risk Level**: High ### Vulnerable Code ```js // scripts/api.mjs:38-41 const HOST = process.env.GALLERY_API_HOST || "gallery.developer.huaweicloud.com"; const PROTOCOL = (process.env.GALLERY_API_PROTOCOL || "https").toLowerCase(); const PORT = PROTOCOL === "https" ? 443 : 80; const transport = PROTOCOL === "https" ? https : http; ``` The same client adds all STS credentials to request headers: ```js // scripts/api.mjs:179-199 if (o.credsFile) { const c = JSON.parse(raw); ak = c.accessKeyId ?? c.access_key_id ?? c.AK; sk = c.secretAccessKey ?? c.secret_access_key ?? c.SK; token = c.securityToken ?? c.security_token ?? c.token; } else { ak = process.env.STS_AK; sk = process.env.STS_SK; token = process.env.STS_TOKEN; } if (!ak || !sk || !token) return { injected: false }; o.headers.push( ["X-Tmp-Ak", ak], ["X-Tmp-Sk", sk], ["X-Security-Token", token] ); ``` The resulting request is sent to the environment-selected destination: ```js const reqH = transport.request( { host: HOST, port: PORT, path: url, method: o.method.toUpperCase(), headers: { ...headers, ...(o.idempotencyKey ? { "Idempotency-Key": o.idempotencyKey } : {}), ...Object.fromEntries(o.headers), }, }, ... ); ``` ### Technical Analysis The destination hostname and protocol are taken directly from inherited environment variables. There is no allowlist for the production Gallery hostname and no rule preventing credential-bearing requests over plaintext HTTP. The API client also builds multipart requests containing the cover image, detail ZIP archive, repository URL, branch, work name, introduction, and optional tunnel URL. Therefore, a poisoned process environment can redirect both credentials and unpublished project ar ...[truncated 1405 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Hardcode or strictly allowlist `gallery.developer.huaweicloud.com` for credential-bearing production requests. 2. Reject all non-HTTPS protocols when credentials or files are present. 3. Validate the protocol against an exact set instead of treating every non-HTTPS value as HTTP. 4. Separate test and production clients. 5. Require an explicit credential-free test mode for custom endpoints. 6. Do not inherit endpoint overrides silently from the general process environment. 7. Verify the TLS certificate and expected hostname. 8. Log the final destination before sending data, without logging credentials. 9. Require explicit user confirmation if any non-production endpoint is ever supported. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/resolve-domain.mjs:34
• Finding: Shell Command Injection in Huawei Cloud Domain Resolution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/resolve-domain.mjs:34-36,73-89` **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```js // scripts/resolve-domain.mjs:34-36 for (let i = 0; i < args.length; i++) { if (args[i] === "--region") region = args[++i] || REGION; else if (args[i] === "--hcloud") hcloudExe = args[++i] || ""; } ``` ```js // scripts/resolve-domain.mjs:73-89 function tryExec(cmd) { try { return execSync(cmd, { encoding: "utf8", timeout: 15000, stdio: ["ignore", "pipe", "pipe"] }).trim(); } catch (e) { return null; } } const cfgOut = tryExec( `"${hcloud}" configure set --cli-region=${region}` ); ``` The executable path is also interpolated into a shell command: ```js const domainsOut = tryExec( `"${hcloud}" IAM KeystoneListAuthDomains` ); ``` ### Technical Analysis `execSync` with a string invokes a command through the operating-system shell. The `region` argument is concatenated without validation or shell escaping. Shell metacharacters in the value can terminate or extend the intended command. Quoting the executable path does not make the construction safe. A crafted executable path containing a quote can break out of the quoted section if an attacker can arrange for such a path to exist and pass it through `--hcloud`. The legitimate task only requires invoking a fixed executable with a fixed argument array, so shell interpretation is unnecessary and exceeds minimum privilege. ### Attack Path 1. An attacker causes the Agent or wrapper to pass a malicious `--region` value containing shell syntax. 2. `resolve-domain.mjs` concatenates the value into a command string. 3. `execSync` passes the command string to the platform shell. 4. The shell interprets attacker-supplied metacharacters. 5. The injected command executes with the privileges and environment of the Skill process. A similar path may be available through a malicious `--hcloud` pa ...[truncated 345 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `execSync(string)` with `execFileSync(executable, argumentArray)`. 2. Pass the region as a discrete argument: ```js execFileSync(hcloud, [ "configure", "set", `--cli-region=${region}` ], options); ``` 3. Invoke `IAM KeystoneListAuthDomains` using the same argument-array API. 4. Validate regions against a strict pattern and, preferably, a known Huawei Cloud region allowlist. 5. Resolve and validate the executable as a regular file before execution. 6. Reject unknown command-line arguments and missing values. 7. Never rely on shell quoting as the primary defense. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/preflight.sh:47
• Finding: Automatic Installation and Execution of Unpinned Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/preflight.sh:47-55,103-125,186-229,260-263`; `scripts/ensure-gitcode-credential.mjs:116-123`; `SKILL.md:90` **Vulnerability Type**: Unsafe dependency and supply-chain execution **Risk Level**: High ### Vulnerable Code ```bash # scripts/preflight.sh:47-55 _TS_SRC="https://pypi.tuna.tsinghua.edu.cn/simple" pip_user_install() { local py_bin="$1"; shift "$py_bin" -m pip install -q \ --index-url="${_TS_SRC}" --user "$@" \ >>"$PREFLIGHT_LOG" 2>&1 && return 0 "$py_bin" -m pip install -q \ --index-url="${_TS_SRC}" "$@" \ >>"$PREFLIGHT_LOG" 2>&1 } ``` ```bash # scripts/preflight.sh:103-125 if pip_user_install "$py" numpy pillow && pip_user_install "$py" playwright; then ready="${ready:+$ready }$py" fi ``` ```bash # scripts/preflight.sh:186-229 if ! "$py_bin" -c "import playwright" >/dev/null 2>&1; then log "playwright package unavailable; attempting pip installation..." pip_user_install "$py_bin" playwright || pip_user_install "$py_bin" playwright || return 1 fi export PLAYWRIGHT_DOWNLOAD_HOST="https://cdn.npmmirror.com/binaries/playwright" "$py_bin" -m playwright install chromium ``` ```text # scripts/ensure-gitcode-credential.mjs:116-123 npx skills add https://gitcode.com/zhoucungen/gitcode-oauth.git \ --skill gitcode-oauth --copy -y ``` ```text # SKILL.md:90 npx http-server . -p <port> ``` ### Technical Analysis The preflight process installs `numpy`, `pillow`, and `playwright` without exact versions or cryptographic hashes. It may install packages into every discovered Python interpreter, expanding the affected environment beyond the minimum interpreter needed by the Skill. Playwright then downloads a browser binary from a mutable mirror or fallback CDN without a Skill-pinned digest. The GitCode OAuth Skill is fetched from a personal repository without a commit pin, and `npx http-server` may resolve and execute a newly selected package version. Package i ...[truncated 1385 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin exact dependency versions in a lockfile. 2. Require package hashes, such as `pip --require-hashes`, for every transitive artifact. 3. Use a dedicated virtual environment instead of modifying every discovered Python interpreter. 4. Pin Playwright and its browser revision, and verify the browser archive with a trusted digest or signature. 5. Pin Git dependencies to a reviewed immutable commit. 6. Avoid repositories controlled by unaffiliated personal accounts for credential-handling components. 7. Replace bare `npx http-server` with a locally locked dependency invoked using offline or frozen resolution. 8. Require explicit user approval before installing any package or browser binary. 9. Prefer bundled, reviewed tooling where licensing and update procedures permit. 10. Record provenance and verify signatures for all downloaded executable components. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions yet its documented behavior clearly includes reading local files, writing temp/artifact files, and executing shell commands. This mismatch weakens user and platform consent boundaries because a caller may invoke a seemingly simple publishing skill without realizing it can inspect repositories, generate credentials, run processes, and modify the local environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The advertised purpose is just publishing a work, but the skill also performs substantially more invasive actions: generating Huawei STS credentials, installing local dependencies, taking screenshots, configuring fonts, and validating rendered content. This is dangerous because users may consent to a narrow publishing task while the skill gains broad access to the workstation, project contents, and cloud-linked identity context.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to run local projects and expose them through a tunnel, which goes beyond simple upload/publish behavior. Running untrusted code and opening a public tunnel can expose local services, source content, secrets in the app, or development-only endpoints to external access, especially if the project is user-supplied or not reviewed.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill inspects local GitCode credential sources such as git credential helpers, ~/.git-credentials, environment variables, and Windows credential storage. Accessing credential stores as part of a publishing workflow materially increases the risk of token exposure, over-collection, and misuse beyond what is needed to publish a work.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The troubleshooting guide explicitly authorizes agent-driven installation of Python, which changes the user's local environment and extends beyond the core skill purpose of publishing a work. That creates unnecessary supply-chain and system-modification risk, especially because it includes silent install commands and PATH changes rather than limiting the agent to guidance-only behavior.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The guide instructs the agent to recursively scan the current environment for all README files and infer candidate project roots before the user has explicitly provided a target directory. For a publishing skill, this exceeds data minimization and can expose unrelated repositories, path information, and metadata from the broader workspace that are not necessary to complete the requested task.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The guide directs the agent to perform deep code analysis with external tooling to generate articles and diagrams, going beyond the stated purpose of publishing a selected work. This broadens access from packaging user-provided metadata into structural inspection of source code, routes, dependencies, and call relationships, increasing the chance of collecting sensitive implementation details and overreaching tool usage.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This script performs external network downloads from third-party endpoints and installs files into user or system font directories, which is unrelated to the stated purpose of publishing works to the Huawei Cloud University platform. Even though it uses HTTPS and basic size/type checks, it still expands the skill's attack surface by introducing supply-chain risk, unneeded host modification, and potential persistence on the local machine through font installation.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script introduces behavior unrelated to the declared Huawei Cloud publishing purpose by probing for GitCode credentials and recommending installation of a separate gitcode-oauth skill. This scope mismatch is dangerous because it expands trust boundaries, conditions the agent to interact with another credential-handling component, and can lead users into unnecessary credential workflows not required for the advertised task.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The operative logic of the file is centered on discovering GitCode authentication material and steering execution based on credential presence, rather than publishing to the Huawei Cloud gallery. In the context of a skill whose manifest promises a different platform action, this hidden capability is risky because it can silently inspect local auth state and trigger unrelated account-linking behavior under false pretenses.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script renders arbitrary HTML with Playwright using `page.set_content(..., wait_until="networkidle")`, which allows embedded remote resources such as images, scripts, fonts, or fetch/XHR requests to be contacted during rendering. In this skill's publish-to-gallery context, diagram generation is ancillary, so permitting outbound network access from untrusted HTML expands the attack surface and can leak environment metadata or trigger unintended requests.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script’s documented purpose is to prepare a local rendering stack (fonts, fontconfig, Playwright/Chromium, screenshot dependencies), which is materially unrelated to a skill whose declared function is publishing a user’s work to the Huawei Cloud University platform. This broadens the skill’s operational scope to local system modification and browser/runtime setup, creating unnecessary attack surface and increasing the chance that invoking a publishing skill triggers privileged package installs, downloads, or environment changes on the user machine.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: From this region onward, the script performs extensive local provisioning: installing fonts, editing fontconfig under user or system paths, installing Python packages from a mirror, installing Playwright, downloading Chromium, and using yum/apt/brew. For a publishing-oriented skill, this is excessive capability that can alter the host substantially and fetch unpinned remote dependencies, making the mismatch between stated intent and actual behavior especially dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script unconditionally runs `hcloud configure set --cli-region=...`, which mutates the user's global CLI configuration as a side effect of a read-only helper whose stated purpose is only to resolve a domain ID. In an agent setting, this can silently alter later Huawei Cloud operations to target the wrong region, causing misconfiguration, failed deployments, or unintended actions in subsequent commands.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script scans an additional hard-coded filesystem location (/root/job-envs/sandboxes/codearts-*/) that is outside the user-selected search directory and broader than the publish-to-gallery skill's stated purpose. In an agent context, this can expose unrelated project paths and metadata from other sandboxes or workspaces, violating least-privilege expectations and potentially leaking sensitive repository names or locations.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad and colloquial, increasing the chance that the skill activates during ordinary conversation about posting or submitting work. In this skill's context that is risky because activation can lead to credential generation, local project scanning, shell execution, and possible tunneling, so accidental invocation has meaningful security consequences.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guidance explicitly writes temporary STS credentials, including AK/SK and a long security token, to local files for later reuse, but it does not require restrictive file permissions, secure storage location selection, or deletion after use. Even though the credentials are short-lived and scoped, local files can be read by other users, processes, backups, logs, or malware on the host, enabling unauthorized API calls during the validity window and potentially exposing account identity metadata used for refresh.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document instructs PowerShell users to recursively and forcibly delete a staging directory with `Remove-Item -Recurse -Force` but does not prominently warn about data loss or require validation of the target path before deletion. In an agent skill context, this is risky because path variables may be derived or modified unexpectedly, and a destructive command in documentation can be copied or executed without sufficient safeguards.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes temporary cloud credentials, including secret access key and security token, to predictable locations under the system temp directory and does not set restrictive permissions or warn the user. On multi-user systems or in insecure temp environments, other local processes/users may read or recover these files and use the STS credentials until expiry.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script automatically installs Python packages from a configured mirror and may download Playwright browser binaries as part of a preflight check, without an explicit consent prompt at execution time. In an agent skill context, this creates a meaningful trust and supply-chain risk because running a seemingly preparatory script causes network access and system modification beyond simple validation.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script accepts an arbitrary URL from argv and unconditionally navigates a browser to it, which creates a network request without any warning or restriction. In this skill context, that can be abused to contact attacker-controlled hosts, trigger internal network access/SSRF-like behavior from the agent environment, or load hostile pages in an automated browser outside the stated Huawei publishing flow.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

Generate a system architecture diagram showing the project's components, services, and their relationships.

**Available tools:**

| Tool | Best For | Example |
| ---- | -------- | ------- |

• Confidence: 83% confidence
• Finding: The finding indicates effectively unrestricted access to tooling in the context of code and architecture analysis. In a publishing skill, broad tool authority is risky because it can be used to inspect more of the repository or environment than needed, especially when combined with instructions to analyze routes, dependencies, and architecture automatically.

Credential Access

High

• Category: Privilege Escalation

Content

`gitUrl` 必填，`gitBranch` 必须显式读取。`workName` 从 README 解析/合成（<30 字符）。

1. `git -C <workDir> remote get-url origin` + `branch --show-current`。
2. **凭证排查**：`node <skill>/scripts/ensure-gitcode-credential.mjs`——自动检测本机 GitCode 凭证（`git credential fill`/`~/.git-credentials`/`$GITCODE_TOKEN`/`cmdkey`），无凭证时按平台给可行路径（Linux 提示手动配置 / Windows 检测 `gitcode-oauth` skill 并输出安装命令）。exit 0=有凭证或已有路径；exit 1=Windows 无凭证且 skill 未装（stderr 含安装命令 + Windows Git Bash 兼容提示）。
3. **凭证剥离**：`gitUrl="$(node <skill>/scripts/strip-git-credential.mjs "$(git remote get-url origin)")"`。硬校验：无 `@`、`https://` 开头、`.git` 结尾。
4. **命名**：`node <skill>/scripts/extract-workname.mjs <workDir>`——按优先级 frontmatter → H1 → manifest → `index.html <title>` → 目录名提取。stdout `#name=<name> source=<来源>`。`source=dirname` 时 agent 可合成/修改（<30 字符）。

• Confidence: 98% confidence
• Finding: The documented behavior explicitly checks sensitive credential locations including ~/.git-credentials, git credential helpers, environment tokens, and cmdkey. Even if intended only to verify presence, touching these stores creates unnecessary access to secrets and expands the blast radius if the skill, its logs, or surrounding tooling mishandle the data.

Credential Access

High

• Category: Privilege Escalation

Content

//   node ensure-gitcode-credential.mjs [--work-dir <dir>]
//
// 行为:
//   1. 检测本机已有 GitCode 凭证（git credential fill / ~/.git-credentials / $GITCODE_TOKEN / cmdkey）
//   2. 有凭证 → exit 0，stdout "#credential=found source=<来源>"
//   3. 无凭证 + Linux/macOS → exit 0，stdout "#credential=missing action=manual"（提示用 git credential fill 等）
//   4. 无凭证 + Windows → 检测 gitcode-oauth skill 是否已装

• Confidence: 98% confidence
• Finding: The documented behavior explicitly states that the script will inspect multiple local credential sources, including git credential helpers, ~/.git-credentials, environment variables, and Windows credential storage. Even if it only checks for presence, this is credential-access behavior outside the stated Huawei publishing purpose and creates unnecessary exposure to sensitive authentication material.

Credential Access

High

• Category: Privilege Escalation

Content

const fillOut = tryExec('echo -e "protocol=https\\nhost=gitcode.com" | git credential fill 2>/dev/null');
if (fillOut && fillOut.includes("password=")) credSource = "git-credential-fill";

// ~/.git-credentials
if (!credSource) {
  const credFile = path.join(homedir(), ".git-credentials");
  if (existsSync(credFile)) {

• Confidence: 99% confidence
• Finding: The script invokes `git credential fill` for gitcode.com, which queries configured credential helpers and may retrieve stored usernames and passwords/tokens from the local system. Accessing credential helpers in a skill unrelated to GitCode publishing is dangerous because it inspects sensitive auth state and can normalize unauthorized secret discovery by the agent.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/api.mjs:264

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/build-cover.mjs:100

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/build-detail-zip.mjs:144

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/check-version.mjs:49

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/detect-env.mjs:21

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/ensure-gitcode-credential.mjs:50

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/publish-work.mjs:149

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/resolve-domain.mjs:75

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/ensure-gitcode-credential.mjs:59