Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches a Huawei Cloud voucher assistant, but it needs Review because it adds unverified telemetry tooling and cloud-account credential use around purchasing workflows.
Review before installing. Use only least-privilege Huawei Cloud credentials, consider disabling telemetry with SKILL_QUALITY_REPORT=0, and avoid running the installer unless you accept a remote latest-version binary being placed in ~/.local/bin. The voucher lookup code itself is mostly read-oriented, but the telemetry installer and confirmed voucher-application path deserve operator approval.
Downloading binaries from remote endpoints and installing them locally under the guise of a voucher assistant creates a hidden execution path and broadens compromise impact to the host environment. Even if intended for telemetry or helper tooling, this is materially riskier than the declared read-only purchase-advice function.
Downloading binaries from remote endpoints and installing them locally under the guise of a voucher assistant creates a hidden execution path and broadens compromise impact to the host environment. Even if intended for telemetry or helper tooling, this is materially riskier than the declared read-only purchase-advice function.
Downloading binaries from remote endpoints and installing them locally under the guise of a voucher assistant creates a hidden execution path and broadens compromise impact to the host environment. Even if intended for telemetry or helper tooling, this is materially riskier than the declared read-only purchase-advice function.
Downloading binaries from remote endpoints and installing them locally under the guise of a voucher assistant creates a hidden execution path and broadens compromise impact to the host environment. Even if intended for telemetry or helper tooling, this is materially riskier than the declared read-only purchase-advice function.
The script retrieves remote metadata and then downloads a versioned tarball from external endpoints, using that untrusted network response to decide what binary to install locally. Without pinned versions, checksum/signature verification, or strong provenance guarantees, this creates a supply-chain attack path where a compromised endpoint, bucket, or transport trust chain could deliver attacker-controlled executables.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"
V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
echo "警告: 无法获取 skill-quality-cli 最新版本，跳过安装" >&2
exit 0
The script retrieves remote data to determine the latest version and then uses that value to fetch an executable archive, effectively trusting external network content for code installation. Even though the JSON is only parsed locally by python3 and not shell-evaluated, this is still dangerous because the entire installation flow depends on unverified remote metadata and artifacts, making supply-chain compromise possible.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"
V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
echo "无法获取 skill-quality-cli 最新版本" >&2
exit 1
The skill declares no explicit tool or permission scope even though the documented behavior uses environment credentials, network access, and shell execution. This creates an unnecessary trust boundary gap: a reviewer or orchestrator cannot easily constrain the skill, while the skill is able to read AK/SK from the environment and invoke external commands.
The manifest trigger list includes generic phrases such as "下单", "选购", "买一台", "coupon", and "discount", which can appear in many unrelated purchasing conversations. Because the description does not provide exclusion conditions or tighter scope boundaries beyond Huawei Cloud in the same sentence, these broad terms could still cause unintended invocation collisions.
The manifest says the skill does not directly purchase, but the documented apply_voucher action can make real order-system changes when confirmed. This inconsistency can cause reviewers or users to treat the skill as read-only when it actually has a state-changing commerce path.
The natural-language description presents the skill entirely in Chinese and frames the assistant as a Huawei Cloud voucher consultation helper without stating that users may choose another language. Since the file also includes English trigger examples, the absence of an explicit language-choice statement suggests a locale/language constraint without opt-in.
Calling the skill a decision-support tool while also documenting a real change-making action undermines operator expectations and safe approval flows. In security-sensitive environments, this kind of mismatch increases the chance of accidental execution of account-affecting operations.
Line L29 requires SKILL.md to include Chinese and English trigger words, and the document itself is entirely Chinese, but it does not state that language selection is optional or that the skill is restricted to a China-specific audience. This creates a natural-language locale policy concern because the skill appears to impose or privilege a specific language setup without explicit user opt-in or justification.
The guide introduces skill-quality-cli, a telemetry-oriented tool that is not clearly necessary for a voucher-assistant whose stated purpose is reading coupon balances and advising on discounts. Adding an unrelated CLI expands the trust boundary and can cause operators to install and run extra code with reporting behavior, creating unnecessary supply-chain and privacy risk.
The documentation states that telemetry is automatic and opt-out, which exceeds the skill’s described coupon and discount functionality and introduces undisclosed data reporting behavior. In a skill that may handle account-linked cloud purchasing context, background reporting can expose usage metadata or operational details without informed consent.
Enabling telemetry by default without a clear privacy warning is a genuine security and privacy issue because users are encouraged to run software that may transmit data without understanding the scope of collection. In the context of a cloud-purchasing assistant that may interact with account credentials and service-selection workflows, even metadata leakage can be sensitive.
This markdown file presents all operational instructions and safety-relevant usage guidance only in Chinese. The file does not indicate that the skill is region-specific or provide any user opt-in or alternative language, which can violate language/locale policy requirements for broadly usable skills.
The verification document references an apply_voucher capability with a --confirm execution path, which expands the apparent skill behavior from read/recommend into a transactional operation. In a skill that uses cloud account AK/SK credentials and influences purchasing flows, undocumented or out-of-scope execution capability is dangerous because it can enable unauthorized financial actions or mislead reviewers about the real permission boundary.
This code includes multiple natural-language strings and locale-specific values entirely in Chinese, such as cycle keys and recommendation reasons. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not documented here.
The manifest primarily describes a skill for analyzing Huawei Cloud voucher balance, coupon applicability, and purchase-saving options. This code also implements a separate recommendation engine for Growth Center tasks, which is a different capability from voucher deduction analysis and broadens the skill beyond its core described behavior.
The module docstring and many user-visible or developer-facing natural-language strings are entirely in Chinese, including exceptions and interface documentation, with no indication that the skill is intentionally region-specific or that alternative locales are supported. Under the locale policy, this is a language constraint presented without user opt-in or documented justification.
The manifest describes a voucher assistant that reads account coupons via AK/SK, so using credentials to call Huawei Cloud APIs is expected. However, this file independently pulls AK/SK from process environment variables, which is a broader configuration-sensitive capability not stated in the skill purpose and can expose the skill to unintended access to ambient credentials.
This file adds a Growth Center task-list data source that is unrelated to the skill’s declared purpose of voucher, discount, and purchase assistance. Even though it only uses an anonymous public endpoint, the extra capability expands the skill’s functional scope and can be used to steer users toward unrelated engagement/reward tasks, creating unnecessary data-access and behavioral surface beyond the manifest’s stated intent.
This file implements an anonymous client for Huawei Cloud Growth Center task-list APIs, which is unrelated to the skill’s declared purpose of coupon/voucher lookup during cloud purchases. In a security review, unexplained capability drift is dangerous because it expands the skill’s reachable functionality and may be used to collect unrelated user data, trigger unintended network access, or mask hidden behaviors under a misleading skill description.
The skill description does not mention that execution will fetch remote content and install local tooling, so the runtime behavior is materially different from the advertised function. In a purchasing assistant that may handle cloud credentials, undisclosed installation behavior is especially risky because it can modify the operator environment and add opaque binaries from the network.
The script installs a global skill-quality-cli that is unrelated to the stated Huawei Cloud voucher-assistant purpose, creating hidden functionality beyond the declared scope. This expands the trust boundary, introduces a supply-chain dependency, and can persist software on the host without a clear user need or informed consent.
No suspicious patterns detected.