Security audit
Security checks for vulnerabilities and agentic risk
The folder counter is read-only, but its verification runner permits commands that exceed the skill’s stated safety limits.
Review before installing. Use credentials restricted to listing the intended buckets, and avoid the verification runner until it is limited to fixed read-only operations. The supplied tests are harmless, but its command filter does not guarantee that. Obtain the CLI and matching checksum from Huawei’s official page, configure credentials outside chat without exposing them in history, and confirm test bucket names before running checks. All bundled files were inspected; live cloud behavior and downloaded binaries remain unverified.
The skill's broad read-only and tool-scope declarations do not hold for the referenced automated verification workflow: its runner permits general hcloud, curl, Bash, and Python commands from test data. This creates an execution path beyond directory counting, although the primary counting script itself uses fixed listing operations.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
cd ~/Downloads
# --- x86_64 ---
curl -fLO https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-linux-amd64.tar.gz
# --- ARM64 (e.g. Huawei Kunpeng, Apple Silicon via macOS) ---
curl -fLO https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-linux-arm64.tar.gz
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Extract and install into your user home without sudo:
cd ~/Downloads
tar -xzf hcloudcli-linux-amd64.tar.gz
chmod +x hcloud
# Install into your user-local bin (create it if needed)
mkdir -p ~/.local/bin
mv hcloud ~/.local/bin/hcloud
chmod +x ~/.local/bin/hcloud
# Add ~/.local/bin to PATH for the current shell (and persist it)
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
export PATH="$HOME/.local/bin:$PATH"
zsh users: append the same line to ~/.zshrc instead.
Expand-Archive "$HOME\Downloads\hcloudcli.zip" -DestinationPath "$HOME\hcloudcli"
# Add "$HOME\hcloudcli" to your user PATH via System Settings > Environment Variables.
The hcloud OBS module uses obsutil, which needs its own AK/SK and endpoint. Run
this in your own terminal (never paste AK/SK into a chat):
hcloud obs con
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
#
# Executes the test cases in templates/test-vars.json against the count script.
# Every command is validated against a strict allow-list before execution:
# - first word must be hcloud | python3 | curl | bash
# - no `bash -c`, no $ or backtick, no shell concatenation/redirect/subshell
# - python3 commands must not call os.system/os.popen/subprocess/eval/exec
# Live count cases require a real OBS bucket (see templates/test-vars.json).
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
#
# Executes the test cases in templates/test-vars.json against the count script.
# Every command is validated against a strict allow-list before execution:
# - first word must be hcloud | python3 | curl | bash
# - no `bash -c`, no $ or backtick, no shell concatenation/redirect/subshell
# - python3 commands must not call os.system/os.popen/subprocess/eval/exec
# Live count cases require a real OBS bucket (see templates/test-vars.json).
The validator restricts executable names but not their actual capabilities: test data can request mutating hcloud operations, curl uploads of readable files, or execution of arbitrary local scripts. A malicious test-case entry can therefore run actions with the user's credentials and filesystem access despite the runner's claimed restrictions; blocking some shell syntax and Python strings is not a sandbox.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
chmod +x hcloud
# Install into your user-local bin (create it if needed)
mkdir -p ~/.local/bin
mv hcloud ~/.local/bin/hcloud
chmod +x ~/.local/bin/hcloud
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if extra:
cmd.extend(extra)
try:
proc = subprocess.run(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
The language policy specifies English-first runtime messages followed by Chinese hints, without offering a language choice or justifying this fixed language requirement. The workflow also instructs the agent to relay these bilingual failure messages, making this a user-facing language constraint rather than merely a description of documentation language.
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
Ensure the IAM user holds OBS **read-only** permissions. See
`references/iam-policies.md` for full policy JSON.
**Minimum required permissions:**
- `obs:bucket:ListAllMyBuckets` — list buckets (v3) / `obs:bucket:listAllMyBuckets` (v5)
- `obs:bucket:ListBucket` — list objects (v3) / `obs:bucket:listBucket` (v5)
- `obs:bucket:GetBucketMetadata` — bucket attributes (v3) / `obs:bucket:getBucketMetadata` (v5)
The document defines correct failure behavior as an English-first bilingual message, and reiterates the English-first requirement for authentication failures at lines 84–85. This imposes a specific output language preference without offering a user choice or documenting a justification for the constraint.