Security audit
Security checks for vulnerabilities and agentic risk
This deployment skill needs review because it weakens credential protection, exposes model keys in deployment records, and enables automatic renewal without clearly disclosing it.
Before use, require fixes that preserve credential encryption, remove secret output and unnecessary secret copies, explicitly offer renewal choices, and protect existing installations with backups. Use scoped temporary credentials in an isolated environment without your normal hcloud configuration; environment variables alone do not bypass an existing profile. Restrict web access and protect it with TLS. Rotate keys if deployment output containing them has been shared. Cloud operations and downloaded dependencies were not executed during this review.
scripts/utils.pyCredential discovery persistently disables existing CLI credential encryption
When hcloud applies the requested change, credentials previously stored encrypted remain available in plaintext after the deployment workflow. This weakens protection against subsequent disclosure of that configuration file; it does not prove that another user can currently read it.
scripts/config_model.pyModel configuration copies the complete secret-bearing environment file into remote task output
The full model credential and any other environment-file secrets become available wherever that task output is collected or retained. Actual access by an unauthorized principal was not demonstrated.
assets/deploy_script_template.shExisting-instance deployment has destructive operations without enforced approval gates
Existing model and channel configuration can be lost, and a running installation can be disrupted. The paths are fixed; this is not arbitrary-path deletion.
scripts/create_instance.pyInstance creation silently enables automatic renewal
An accepted order may continue renewing and charging beyond the initial one-month purchase until the user disables renewal or releases the resource.
The documentation explicitly says credential loading automatically disables encryption in the existing hcloud configuration. Although disclosed later in the document, this unnecessarily downgrades protection of stored cloud credentials and can expose powerful account access to anyone who subsequently obtains that file.
The command targets the expected cloud service, but performs instance deletion rather than creation, deployment, or configuration. Although it appears in troubleshooting documentation and could support cleanup, the supplied chunk does not restrict deletion to failed deployments or otherwise establish that context. This destructive lifecycle operation is not represented in the declared purpose.
Referenced artifact was not completely inspected
ated**, skip `create_instance.py` and deploy JiuwenSwarm directly onto it: run `install_deps.py` → `deploy_service.py` → `verify_deployment.py` → `config_model.
Referenced artifact was not completely inspected
python scripts/install_deps.py --ip <public_ip>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
1. **Service bound to 0.0.0.0** (configured via `.env` `FRONTEND_HOST=0.0.0.0`)
2. **Security group allows port 5173** (configured in Huawei Cloud Console)
#### .env Configuration (Service-side)
The `.env` file at `/root/.jiuwenswarm/config/.env` must use the correct variable names:
| .env Variable | Purpose | Required Value |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#### .env Configuration (Service-side)
The `.env` file at `/root/.jiuwenswarm/config/.env` must use the correct variable names:
| .env Variable | Purpose | Required Value |
| :------------------- | :------------------- | :------------- |
| `FRONTEND_HOST` | Frontend HTTP bind | `0.0.0.0` |
| `FRONTEND_PORT` | Frontend HTTP port | `5173` |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
client_secret: ""
allow_from: "*"
# Model Configuration (read from .env file)
model:
api_base: ${API_BASE}
api_key: ${API_KEY}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
rate_limit: 100
CONFIGEOF
cat > /root/.jiuwenswarm/config/.env << 'ENVEOL'
API_BASE=https://api.openai.com/v1
API_KEY=your-api-key-here
MODEL_NAME=gpt-4
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Symptoms**: Cannot access http://{ip}:5173, connection refused or timeout.
**Root Cause A: .env variable name mismatch (port bound to 127.0.0.1)**
The service reads `FRONTEND_HOST` for host binding, NOT `JIUWENSWARM_HOST`. If the
wrong variable is used, the service defaults to `127.0.0.1` (localhost only).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The service reads `FRONTEND_HOST` for host binding, NOT `JIUWENSWARM_HOST`. If the
wrong variable is used, the service defaults to `127.0.0.1` (localhost only).
| .env Variable | Default | Required Value |
| :------------------- | :------------------ | :------------- |
| `FRONTEND_HOST` | `localhost` (127.0.0.1) | `0.0.0.0` |
| `FRONTEND_PORT` | `5173` | `5173` |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Fix: update .env and restart
sed -i 's/^JIUWENSWARM_HOST=.*/FRONTEND_HOST=0.0.0.0/' /root/.jiuwenswarm/config/.env
sed -i 's/^JIUWENSWARM_PORT=.*/FRONTEND_PORT=5173/' /root/.jiuwenswarm/config/.env
echo -e "WEB_HOST=0.0.0.0\nAGENT_SERVER_HOST=0.0.0.0\nGATEWAY_HOST=0.0.0.0" >> /root/.jiuwenswarm/config/.env
systemctl restart jiuwenswarm && sleep 10
ss -tlnp | grep 5173 # verify 0.0.0.0
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
print_info(f"Instance ID: {instance_id}")
print_info(f"Region: {region}")
# Verification script - checks service status, .env config, port binding, and HTTP health
verification_script = '''#!/bin/bash
echo "=== JiuwenSwarm Deployment Verification ==="
ALL_OK=true
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
echo "--- [1/4] Service Status ---"
systemctl is-active --quiet jiuwenswarm && echo "PASS: service running" || { echo "FAIL: service not running"; exit 1; }
# 2. .env FRONTEND_HOST check (required for external web access)
echo "--- [2/4] .env FRONTEND_HOST ---"
ENV_FILE="/root/.jiuwenswarm/config/.env"
if [ -f "$ENV_FILE" ]; then
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
systemctl is-active --quiet jiuwenswarm && echo "PASS: service running" || { echo "FAIL: service not running"; exit 1; }
# 2. .env FRONTEND_HOST check (required for external web access)
echo "--- [2/4] .env FRONTEND_HOST ---"
ENV_FILE="/root/.jiuwenswarm/config/.env"
if [ -f "$ENV_FILE" ]; then
if grep -q "^[[:space:]]*FRONTEND_HOST=0.0.0.0" "$ENV_FILE"; then
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
echo "FAIL: FRONTEND_HOST not set to 0.0.0.0 in .env"; ALL_OK=false
fi
else
echo "FAIL: .env file not found at $ENV_FILE"; ALL_OK=false
fi
# 3. Port binding (0.0.0.0 vs 127.0.0.1)
Automatically turning off credential encryption modifies a user's existing security settings merely to simplify credential loading. Persisting cloud secrets in plaintext increases the consequences of configuration-file disclosure, including through backups or local access.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
ENVEOL
chmod 600 /root/.jiuwenswarm/config/config.yaml
chmod 600 /root/.jiuwenswarm/config/.env
log_info "Installing Python 3.11"
Dependency resolution is redirected away from a canonical default, adds another source, or uses a destination that cannot be resolved statically.
pip install --upgrade pip setuptools wheel -q -i https://mirrors.aliyun.com/pypi/simple/
Dependency resolution is redirected away from a canonical default, adds another source, or uses a destination that cannot be resolved statically.
pip install jiuwenswarm -i https://mirrors.aliyun.com/pypi/simple/ --no-cache-dir
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
User=root
Group=root
WorkingDirectory=/opt/jiuwenswarm-env
EnvironmentFile=/root/.jiuwenswarm/config/.env
ExecStart=/opt/jiuwenswarm-env/bin/jiuwenswarm-start
Restart=always
RestartSec=5
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Check port binding — 127.0.0.1 means wrong, 0.0.0.0 means correct
ss -tlnp | grep 5173
# Fix: update .env and restart
sed -i 's/^JIUWENSWARM_HOST=.*/FRONTEND_HOST=0.0.0.0/' /root/.jiuwenswarm/config/.env
sed -i 's/^JIUWENSWARM_PORT=.*/FRONTEND_PORT=5173/' /root/.jiuwenswarm/config/.env
echo -e "WEB_HOST=0.0.0.0\nAGENT_SERVER_HOST=0.0.0.0\nGATEWAY_HOST=0.0.0.0" >> /root/.jiuwenswarm/config/.env
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
ss -tlnp | grep 5173
# Fix: update .env and restart
sed -i 's/^JIUWENSWARM_HOST=.*/FRONTEND_HOST=0.0.0.0/' /root/.jiuwenswarm/config/.env
sed -i 's/^JIUWENSWARM_PORT=.*/FRONTEND_PORT=5173/' /root/.jiuwenswarm/config/.env
echo -e "WEB_HOST=0.0.0.0\nAGENT_SERVER_HOST=0.0.0.0\nGATEWAY_HOST=0.0.0.0" >> /root/.jiuwenswarm/config/.env
systemctl restart jiuwenswarm && sleep 10
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
sed -i 's/^JIUWENSWARM_HOST=./FRONTEND_HOST=0.0.0.0/' /root/.jiuwenswarm/config/.env sed -i 's/^JIUWENSWARM_PORT=./FRONTEND_PORT=5173/' /root/.jiuwenswarm/config/.env echo -e "WEB_HOST=0.0.0.0\nAGENT_SERVER_HOST=0.0.0.0\nGATEWAY_HOST=0.0.0.0" >> /root/.jiuwenswarm/config/.env systemctl restart jiuwenswarm && sleep 10 ss -tlnp | grep 5173 # verify 0.0.0.0
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Authentication failed
**Troubleshooting Steps**:
1. Check .env file configuration
2. Verify API_KEY validity
3. Confirm network can access model service
4. Check proxy configuration
The diagnostic commands print cloud access credentials directly, including the secret key. In an agent-assisted deployment workflow, this can expose credentials through tool transcripts, captured terminal output, or troubleshooting logs, potentially allowing cloud operations within the credentials' permissions.