Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious with medium confidence because it reports an unrelated CLI being downloaded and installed without a separate approval step, with unclear telemetry and release verification.
Consider avoiding installation until the separate CLI is optional, its telemetry destination and data are clearly explained, and its release is pinned and authenticated. The scan was partial because one local-path reference was unresolved, so the evidence is incomplete.
The description omits the persistent telemetry executable installation that the setup instructions introduce without a dedicated impact preview or confirmation. The full document does disclose telemetry, which weakens the concealment allegation, but ordinary BCS authorization should not implicitly authorize installation of unrelated executable code.
The setup workflow introduces persistent installation of a separate executable without a distinct installation approval gate, despite the advertised preview-and-confirm model for writes. Telemetry installation is disclosed in the document, so it is not wholly hidden, but requiring this additional executable expands the trust boundary of a skill used with cloud credentials.
The supplied command targets skill-quality-cli rather than Huawei Cloud BCS or its declared Python SDK. Nothing in the supplied chunk establishes this tool upgrade as a supporting requirement for BCS functionality. The mismatch is limited to this chunk; no broader implementation was supplied.
The command changes a quality-reporting flag rather than querying or managing BCS resources. This is not a described capability or an evident implementation requirement for BCS access. The chunk alone does not establish whether any downstream reporting is actually disabled.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| Add peers to channel | `batch_add_peers_to_channel` | `POST /v2/{project_id}/blockchains/{blockchain_id}/channels/peers` |
| Remove peers | `batch_remove_peers_from_channel` | `PUT /v2/{project_id}/blockchains/{blockchain_id}/{channel_id}/peers/quit` |
| Remove organizations | `batch_remove_orgs_from_channel` | `PUT /v2/{project_id}/blockchains/{blockchain_id}/{channel_id}/orgs/quit` |
| Delete channel | `delete_channel` | `DELETE /v2/{project_id}/blockchains/{blockchain_id}/channel/{channel_id}` |
| Create instance | `create_new_blockchain` | `POST /v2/{project_id}/blockchains` |
| Update instance | `update_instance` | `PUT /v2/{project_id}/blockchains/{blockchain_id}` |
| Delete instance | `delete_blockchain` | `DELETE /v2/{project_id}/blockchains/{blockchain_id}` |
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| Delete channel | `delete_channel` | `DELETE /v2/{project_id}/blockchains/{blockchain_id}/channel/{channel_id}` |
| Create instance | `create_new_blockchain` | `POST /v2/{project_id}/blockchains` |
| Update instance | `update_instance` | `PUT /v2/{project_id}/blockchains/{blockchain_id}` |
| Delete instance | `delete_blockchain` | `DELETE /v2/{project_id}/blockchains/{blockchain_id}` |
| Invite members | `batch_invite_members_to_channel` | `POST /v2/{project_id}/members/invitations` |
| Cancel invitation | `delete_member_invite` | `DELETE /v2/{project_id}/members/invitations` |
| Handle invitation | `handle_notification` | `POST /v2/{project_id}/notification/handle` |
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| Update instance | `update_instance` | `PUT /v2/{project_id}/blockchains/{blockchain_id}` |
| Delete instance | `delete_blockchain` | `DELETE /v2/{project_id}/blockchains/{blockchain_id}` |
| Invite members | `batch_invite_members_to_channel` | `POST /v2/{project_id}/members/invitations` |
| Cancel invitation | `delete_member_invite` | `DELETE /v2/{project_id}/members/invitations` |
| Handle invitation | `handle_notification` | `POST /v2/{project_id}/notification/handle` |
| Quit union | `handle_union_member_quit_list` | `PUT /v2/{project_id}/members/quit` |
The matched curl-to-Python pipeline parses JSON using fixed local code; it does not directly execute the response as Python. However, that response selects a release archive which the same script downloads, extracts, and installs without a pinned version or trusted signature verification, creating a supply-chain code-execution path if the distribution source is compromised.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"
V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
echo "警告: 无法获取 skill-quality-cli 最新版本，跳过安装" >&2
exit 0
The pipeline itself only parses remote JSON, but the returned version controls the archive subsequently downloaded and installed as executable code. No signature or pinned digest is checked before extraction and installation, so compromise of the release infrastructure could turn a legitimate manual installation into arbitrary code execution when the CLI is used.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"
V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
echo "无法获取 skill-quality-cli 最新版本" >&2
exit 1
Without declared permissions the skill's intent is opaque and cannot be validated.
The guide explicitly makes telemetry automatic and opt-out without identifying the transmitted fields, receiving service, or retention policy. In a cloud-administration workflow this creates an insufficiently bounded disclosure risk, although this source does not establish that credentials or resource data are actually transmitted.
When the CLI is absent, this helper downloads an unpinned release and installs executable files into the user's persistent binary directory without a separate approval gate or artifact authentication. A compromised release source could thereby plant code that later runs with the user's privileges; the telemetry purpose does not require this implicit trust expansion.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
tar xzf "${TMPDIR}/sqc.tar.gz" -C "${TMPDIR}"
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${TMPDIR}/skill-quality-cli" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.bin" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.d/cli_entry.py" ~/.local/bin/skill-quality-cli.d/ 2>/dev/null
L09–L23 retrieve the latest skill-quality-cli version and download its executable archive, while L25–L30 install executable and reporting components persistently under ~/.local/bin. The manifest describes BCS resource management through huaweicloudsdkbcs, not installing a separate skill-quality tool, and the provided code establishes no BCS-related need for this capability.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
curl -fsSL -o "${TMPDIR}/sqc.tar.gz" "${OBS_BASE}/v${V}/skill-quality-cli-v${V}-linux-${ARCH}.tar.gz"
tar xzf "${TMPDIR}/sqc.tar.gz" -C "${TMPDIR}"
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${TMPDIR}/skill-quality-cli" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.bin" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.d/cli_entry.py" ~/.local/bin/skill-quality-cli.d/ 2>/dev/null
Although the surrounding description identifies Huawei Cloud BCS as the skill's purpose, these entries are presented as activation triggers without requiring that context. They also describe unrelated networking, infrastructure, and certificate tasks, which could cause unintended skill selection.