Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because its optional cloud-storage setup grants excessive permanent permissions, and some instructions risk exposing credentials or private files.
Before use, have an administrator narrow the optional delegation to necessary actions and the selected bucket/prefix, verify the trusted principal, and define expiry and removal. Skip OBS delegation when unnecessary. Upload only reviewed files from a staging directory; disabling OBS output still sends source code to OptVerse. Keep credentials out of agent memory and redact support payloads. Verify the CLI download before installation. Static inspection resolved the material scanner gaps, but external companion skills and effective cloud permissions were not tested.
references/iam-agency.mdResult-upload setup delegates unscoped destructive OBS permissions
The delegate obtains permissions to read or delete unrelated objects and versions and modify bucket access policies, subject to any independently configured explicit denies. The delegation remains after the evolution task ends.
Inspecting and listing agencies are reasonable supporting operations for the declared IAM setup. However, modifying agencies, revoking their policies, and deleting them extend beyond the stated capability to create a trust agency and grant algorithm-design bucket permissions. These commands are not explicitly restricted to LLM4AD-related agencies. The deletion comment mentions two-step confirmation, but the supplied command does not implement such a safeguard.
Listing authorizations and buckets supports the declared permission-setup workflow. However, revoking an existing authorization is a distinct, potentially disruptive capability not covered by the stated agency-creation and permission-granting purpose. The use of OptVerse rather than IAM is not itself the mismatch; the undeclared revocation operation is.
Referenced artifact was not completely inspected
loud IAM ...` call, dispatch `scripts/precheck.sh` (Linux / Git Bash / WSL) or `scripts/precheck.ps1` (Windows PowerShell) via `skill action=exec`. The precheck
Referenced artifact was not completely inspected
powershell scripts/precheck.ps1
Referenced artifact was not completely inspected
| `powershell` on PATH | Windows PowerShell 5.1 (system-installed, widespread) | `powershell scripts/precheck.ps1` |
Referenced artifact was not completely inspected
If `precheck.sh` / `precheck.ps1` cannot run, see [`references/prerequisites.md`](references/prerequisites.md) §2.1 "5-line manual probe" for the 5 manual verif
Referenced artifact was not completely inspected
| Direct shell + relative path (cwd must be at skill root) | `powershell scripts/precheck.ps1` | bash / PowerShell tool calls directly; requires cwd already at
Referenced artifact was not completely inspected
- `precheck.sh` / `precheck.ps1`: 5-item one-shot environment check
Referenced artifact was not completely inspected
`precheck.sh` / `precheck.ps1` cannot run, see [`references/prerequisites.md`](references/prerequisites.md) §2.1 "5-line manual probe" for the 5 manual verific
Referenced artifact was not completely inspected
| [references/prerequisites.md](references/prerequisites.md) | Credentials, environment, project ID |
Referenced artifact was not completely inspected
See [`references/parameter-format.md`](references/parameter-format.md) §7 "CreateEvolveTask required-field 3-layer breakdown" for the full 6-field table; the sa
Referenced artifact was not completely inspected
enum / size-limit / JMESPath syntax lives in [`references/parameter-format.md`](references/parameter-format.md). This section is a quick **A/B/C classification*
Referenced artifact was not completely inspected
ions`** (**required**): number of evolution rounds; see [`parameter-format.md`](references/parameter-format.md) for the full `--evaluator_parameter.*` syntax
Referenced artifact was not completely inspected
| [references/parameter-format.md](references/parameter-format.md) | Parameter forms, nesting, arrays, JMESPath |
Referenced artifact was not completely inspected
| [references/plan-maintenance.md](references/plan-maintenance.md) | **(agent-side, optional)** `plan` / `scratchpad` tool maintenance (multi-step task state-ma
The delegated policy includes bucket deletion, policy and ACL modification, object deletion, and other administrative actions beyond storing evolution results, without an explicit resource restriction. Combined with the FOREVER agency lifetime, compromise or misuse of the trusted service could enable persistent data destruction, disclosure, or access-control changes beyond the intended output location.
Without declared permissions the skill's intent is opaque and cannot be validated.
The standard workflow instructs the agent to upload algorithm, evaluator, and baseline files to Huawei Cloud, but provides no warning to check for secrets, confidential code, or restrictions on third-party processing. The default 'no OBS upload' scenario still uploads these source files to OptVerse; it only disables the separate result upload.
The document mandates execution through the Skill Runtime but later permits direct shell execution as an alternative. This contradictory fallback can lead an agent to bypass runtime isolation, approval, or auditing controls where those controls are provided by the wrapper; actual impact depends on the runtime.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| ❌ Anti-pattern | Why it's bad |
|---|---|
| `requests.post('https://optverse...', json=...)` direct to OpenAPI | Bypasses KooCLI auth / error handling / retry / `--debug` logging; crosses the "direct OpenAPI" red line |
| `--key value` space-separated | bash splits it as `--key=` (empty value) + `value` (independent token); PowerShell `$VAR` doesn't expand |
| `python -c "import subprocess; ..."` self-forking hcloud | Bypasses agent-framework isolation / cache semantics; inconsistent with Skill Runtime's script-call mechanism |
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| ❌ Anti-pattern | Why it's bad |
|---|---|
| `requests.post('https://optverse...', json=...)` direct to OpenAPI | Bypasses KooCLI auth / error handling / retry / `--debug` logging; crosses the "direct OpenAPI" red line |
| `--key value` space-separated | bash splits it as `--key=` (empty value) + `value` (independent token); PowerShell `$VAR` doesn't expand |
| `python -c "import subprocess; ..."` self-forking hcloud | Bypasses agent-framework isolation / cache semantics; inconsistent with Skill Runtime's script-call mechanism |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
When starting a task, the agent decides where each parameter comes from by following the three categories below — **first fill from A, then collect from B, finally cover with C defaults**.
### 8.1 A. Pre-configured (Agent retrieves automatically, do NOT ask user)
| Parameter | Source |
|---|---|
The workflow instructs the agent to archive the local source directory and upload it through hcloud OptVerse. Although the upload is clearly described, there is no warning that source code or sensitive content in the archive will leave the local system and be transmitted to the cloud service.
Using sudo for a system-wide installation is not inherently unsafe, but this sequence promotes an unverified executable from a predictable shared temporary path into a trusted system PATH directory. A compromised download or local file-substitution attack could install a malicious CLI that subsequently receives cloud credentials and privileged IAM commands.
curl -L -o /tmp/hcloud.tar.gz "" tar -xzf /tmp/hcloud.tar.gz -C /tmp sudo mv /tmp/hcloud /usr/local/bin/hcloud hcloud version
The workflow instructs the agent to upload the project ZIP to OptVerse, transmitting source code and any other included files to an external service. It does not warn users about this disclosure or instruct them to review the archive for credentials, confidential code, or other sensitive content before uploading.