Security audit
Security checks for vulnerabilities and agentic risk
This cloud-deployment skill needs review because it can accept website agreements automatically and does not enforce private storage of cloud credentials.
Before use, remove automatic agreement clicks and store cloud keys in a private work directory with owner-only access. Use a restricted IAM identity, review downloaded templates and dependency versions, and approve the Terraform plan before changes. Credentials remain on disk until successful teardown. All bundled files were inspected, including the scanner's JavaScript gap; separately downloaded code remains unverified.
The supplied command installs Playwright CLI; it does not provision Huawei Cloud resources, run Terraform, or deploy Dify. Although tooling installation can be a supporting implementation detail, this chunk provides no connection between the browser automation package and the declared deployment purpose. The command alone does not demonstrate browser execution or data access.
The supplied command sets up browser tooling; it does not provision Huawei Cloud resources or deploy Dify. The chunk provides no connection establishing browser installation as a supporting step for the declared Terraform/SAC deployment workflow.
The supplied command installs browser tooling rather than provisioning Huawei Cloud resources or deploying Dify. Although browser tooling could support deployment verification, the supplied chunk establishes no such role, so its demonstrated behavior falls outside the declared purpose.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
config environment; mapping PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH onto those
makes chromium (arm64/headless) the launch target instead of Google Chrome.
"""
env = dict(os.environ)
executable = resolve_chromium_executable()
if executable:
env["PLAYWRIGHT_MCP_BROWSER"] = "chromium"
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### Security
- 🚫 Never expose AK/SK in conversation or output
- 🚫 Never ask user to type AK/SK in chat
- ✅ Prefer IAM users over primary account
- ✅ Modification ops (`apply`, `destroy`) require explicit user confirmation
Although this is a CLI invocation rather than an MCP server declaration, unversioned npx can fetch and execute a mutable package release when no suitable local package exists. A compromised release could execute with the installing user's privileges, which is particularly consequential on a workstation used for cloud deployment.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -fsSL -o /tmp/terraform.zip "<URL_from_table_above>"
unzip -o /tmp/terraform.zip -d /usr/local/bin/
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
allow_failure: bool = False,
) -> subprocess.CompletedProcess:
full_cmd = [*base_cmd, f"-s={session}", *args]
proc = subprocess.run(
full_cmd,
capture_output=True,
text=True,
The extraction script automatically clicks a button named “同意” without checking the dialog's purpose or obtaining authorization. A consent or terms dialog could therefore be accepted on the user's behalf, exceeding a workflow that only needs to read solution metadata and pricing.