Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only cloud storage helper with expected credential setup guidance and no hidden execution behavior.
Installers should treat any cloud credentials, service account keys, client secrets, SAS tokens, and OAuth refresh tokens as sensitive. Use least-privilege accounts, prefer managed or keyless identity where available, verify costs before large transfers, and require backup verification before deletions.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export AWS_SECRET_ACCESS_KEY=...
export AWS_DEFAULT_REGION=us-east-1
# Named profiles (~/.aws/credentials)
[profile-name]
aws_access_key_id = AKIA...
aws_secret_access_key = ...
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
1. **Create OAuth app** in provider console
2. **Request minimal scopes** — `drive.file` not `drive` for Google
3. **Store refresh tokens** — access tokens expire quickly
4. **Handle token refresh** before long operations
**Traps:**
The AWS authentication examples include direct use of access keys in environment variables and a credentials file path, but they do not explicitly warn that these secrets must not be hardcoded, committed, logged, or shared. In an automation-oriented cloud storage skill, readers are likely to copy these patterns into scripts or local configs, increasing the risk of credential leakage and subsequent cloud account compromise.
The Google Cloud section references a service account key file via GOOGLE_APPLICATION_CREDENTIALS without clearly warning that key.json is highly sensitive credential material. In the context of a cloud storage skill, exposing this pattern without strong safeguards can lead users to leave long-lived key files on disk, in repos, or in shared environments, enabling unauthorized access to GCP resources.
The Azure authentication example shows AZURE_CLIENT_SECRET usage but does not include an explicit caution that client secrets are sensitive and should not be embedded in scripts, shell history, CI logs, or documentation. Because this skill is meant to manage cloud storage across providers, omission of secret-handling guidance raises the chance of accidental disclosure and misuse of privileged Azure identities.
No suspicious patterns detected.