Cloud Storage Manager

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a normal cloud-storage helper with disclosed credential use and user-directed delete/sync actions, but those actions can affect real cloud data.

Before installing, use least-privilege cloud credentials limited to the intended buckets or containers, avoid hardcoding real secrets, verify source and destination paths, and treat delete_remote=True or delete() as potentially irreversible. For safer installs, pin dependencies or use a reviewed lockfile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:5
• Finding: Unbounded Third-Party Dependency Resolution<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:5-24` **Additional Location**: `README.md:20-22` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```text boto3>=1.26.0 # AWS SDK for Python botocore>=1.29.0 # AWS core library # Aliyun OSS Support - 阿里云OSS支持 aliyun-python-sdk-core>=2.13.0 # Aliyun core SDK aliyun-python-sdk-oss>=2.17.0 # Aliyun OSS SDK oss2>=2.17.0 # Aliyun OSS Python SDK # Tencent COS Support - 腾讯云COS支持 qcloud-cos-python-sdk-v5>=1.9.0 # Tencent COS SDK # Azure Blob Support - Azure Blob支持 azure-storage-blob>=12.14.0 # Azure Blob SDK azure-identity>=1.12.0 # Azure authentication # Utilities - 工具库 tqdm>=4.65.0 # Progress bars python-dotenv>=1.0.0 # Environment variables pydantic>=2.0.0 # Data validation pytest>=7.0.0 # Testing framework pytest-asyncio>=0.21.0 # Async testing ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis All declared dependencies use open-ended minimum-version constraints. The project does not provide a lockfile, exact reviewed versions, package hashes, or an explicit trusted package index. Consequently, the installation command can resolve package versions that did not exist when the project was audited. Python package installation may execute package build backends or other installation-time code. If a permitted future version, transitive dependency, or package-distribution account is compromised, following the documented installation procedure could execute unreviewed code under the privileges of the user performing the installation. The audit did not identify an existing malicious package among the declared dependencies. The vulnerability is the mutable and insufficiently verified dependency-resolution process. ### Attack Path 1. An a ...[truncated 1379 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace open-ended minimum constraints with exact, reviewed versions. 2. Generate and commit a reproducible lockfile that includes all transitive dependencies. 3. Require cryptographic hashes during installation, for example by using a hash-locked requirements file with `pip install --require-hashes`. 4. Configure package installation to use an explicitly trusted index rather than relying on ambient index configuration. 5. Review dependency updates before regenerating the lockfile, including release provenance and known-vulnerability checks. 6. Separate runtime dependencies from development and test dependencies so production installations do not include `pytest` and `pytest-asyncio`. 7. Run installation and application processes as a dedicated, least-privileged user without unnecessary access to cloud credentials. 8. Use automated dependency scanning and verify the complete resolved dependency graph in continuous integration. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Credential Access

High

• Category: Privilege Escalation

Content

# 配置示例
    print("\n[5] Configuration Example / 配置示例：")
    print("""
    # .env file / 环境变量文件
    ALIYUN_ACCESS_KEY_ID=your_access_key
    ALIYUN_ACCESS_KEY_SECRET=your_secret_key
    ALIYUN_OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This is a markdown file, so missing user warnings apply to documented behaviors that may affect privacy or system integrity. The quick-start example includes access keys and an upload operation, while the feature list advertises bidirectional sync and cross-provider copy, but the README provides no caution about protecting credentials or about data transfer/modification side effects.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly advertises a sync operation with `delete_remote=True`, which can remove remote files not present locally, but it does not prominently warn about the destructive consequence. In a cloud storage management skill, this creates a realistic risk of accidental bulk deletion of backups or production data through normal use rather than an exploit in code.

Natural-Language Policy Violations

Low

• Confidence: 60% confidence
• Finding: The top-level title includes Chinese text alongside English, which may indicate a language presentation choice not explicitly offered to the user. Because the file otherwise presents both English and Chinese descriptions, this is only a weak signal of a locale policy issue.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The usage example shows `storage.delete("remote/path/file.txt")`, and the API reference documents `delete(remote_path)`, but the skill description does not warn users that this operation removes remote data. For markdown files, destructive behaviors affecting user data should be accompanied by a clear warning.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The file includes bilingual user-facing text and headings in English and Chinese throughout the docstring and console output, but does not indicate that Chinese is optional or required for a specific regional use case. Under the policy criteria, forcing a specific language or locale without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The file includes bilingual comments throughout, with Chinese text embedded as part of the presented documentation/comments, but there is no indication that language display is optional or user-selectable. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy concern.

Unverifiable Dependency: azure-storage-blob has 2 known advisory(ies) (CVE-2022-30187 (Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library); CVE-2022-30187 (Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: The dependency uses a lower-bound specifier (azure-storage-blob>=12.14.0) instead of pinning or constraining to a known-safe range, so installations may resolve to vulnerable versions depending on environment and lock state. In a cloud storage management skill, a vulnerable blob-storage library is more concerning because it directly handles sensitive storage operations and authentication/encryption-related workflows.

Unverifiable Dependency: azure-identity has 2 known advisory(ies) (CVE-2024-35255 (Azure Identity Libraries and Microsoft Authentication Library Elevation of Privi); CVE-2024-35255 (Azure Identity Libraries and Microsoft Authentication Library Elevation of Privi)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 85% confidence
• Finding: azure-identity is specified only with a minimum version, which makes it impossible to verify that deployed environments will avoid vulnerable releases. Because this package is used for cloud authentication, a vulnerable identity library in this skill context could affect token handling or privilege boundaries, increasing the severity beyond a generic library issue.

Unverifiable Dependency: tqdm has 4 known advisory(ies) (CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2016-10075 (TDQM Arbitrary Code Execution); CVE-2016-10075 (The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to e) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 74% confidence
• Finding: tqdm is not pinned, so an installation may select a version affected by known issues, including argument injection or code-execution-related advisories depending on usage. Although it is a utility package rather than a core cloud client, leaving it unconstrained still creates supply-chain risk and avoidable uncertainty in deployed builds.

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 71% confidence
• Finding: python-dotenv is specified with only a minimum version, so environments may install releases affected by known vulnerabilities such as unsafe file handling. In a skill likely to use environment-based secrets for cloud credentials, weaknesses in dotenv handling can have outsized consequences because configuration files often contain sensitive tokens and keys.

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: pydantic is unconstrained beyond a minimum version, so vulnerable versions may be installed in some environments, making the security posture unverifiable. Since pydantic often processes untrusted input and schema validation, issues such as denial of service can matter in an agent skill that may parse external configuration or user-supplied data.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The module-level natural-language text presents all usage text in both English and Chinese, indicating a fixed locale/language choice rather than offering user selection. For policy checks on language/locale behavior, hard-coded multilingual or specific-language presentation without opt-in can violate organizational language-choice requirements.

Static analysis

No suspicious patterns detected.