T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:303- Finding
Persistent Shell Command Injection Through Unescaped Configuration Values
- Content
View full analysis
/dev/null; then cat >> "$SHELL_RC" <- Remediation
View remediation
Security audit
qiniu-kodo
Security checks for vulnerabilities and agentic risk
Overview
This Qiniu storage skill is purpose-aligned overall, but it has under-disclosed credential persistence, risky installation behavior, and unsafe delete flows that could cause credential exposure or cloud data loss.
Review before installing. Use a narrowly scoped Qiniu key, avoid pasting long-lived secrets into shared shells, inspect and back up shell startup files and mcporter config, and do not use delete or batch-delete on production buckets unless you have independent backups and have verified the exact target objects. Prefer fixing the setup script to avoid global installs, unverified downloads, shell-profile secret exports, and unenforced delete confirmations.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:54- Finding
Cloud Secret Key Exposure Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.sh:247- Finding
Remote Binary Installed Without Integrity or Authenticity Verification
- Content
View full analysis
/dev/null || mv qshell "$HOME/.local/bin/" log_info "✅ qshell 安装成功" cd - > /dev/null rm -rf "$TEMP_DIR" return 0 ``` ### Technical Analysis The setup script downloads an executable archive from an external server and installs its contents without validating a cryptographic checksum or digital signature. HTTPS protects the transport connection but does not establish that the retrieved artifact matches a specific audited release. The downloaded `qshell` executable may be moved into `/usr/local/bin` through `sudo`, making it available system-wide. If the privileged move fails, it is installed into the user's local executable path. ### Attack Path 1. The user accepts the optional qshell installation. 2. The script retrieves the archive from the configured remote URL. 3. The distribution server, artifact, DNS path, certificate trust chain, or delivery infrastructure has been compromised. 4. The script extracts the archive and marks the supplied file executable without checking its digest or signature. 5. The file is installed into a standard executable directory. 6. A later `qshell` invocation executes the substituted payload. If installed with `sudo`, the attacker-controlled binary is placed in a system-wide location. ### Impact Assessment A substituted executable can run arbitrary code with the privileges of any user who invokes it. Installation into `/usr/local/bin` affects the system-wide command search path and can expose multiple users. The malicious execut ...[truncated 157 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/setup.sh:202- Finding
Unpinned Global Package Installation and Unsafe MCP Configuration Replacement
- Content
View full analysis
/dev/null; then log_info "✅ qiniu-mcp 安装成功" # 配置 mcporter if [ -d "$HOME/.mcporter" ]; then cat > "$HOME/.mcporter/mcporter.json" <- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/qiniu_node.mjs:369- Finding
Deletion Proceeds Without the Documented User Confirmation
- Content
View full analysis
` without `--force`. 2. The program prints a confirmation question. 3. It does not wait for or process any response. 4. The Qiniu deletion API is called immediately. 5. The selected object is deleted despite the absence of explicit confirmation. An automation system that intentionally omits `--force` as a safety measure receives no protection from accidental or incorrectly generated deletion commands. ### Impact Assessment The flaw permits unintended deletion of any object accessible to the configured Qiniu credentials. The scope is limited to the configured bucket and credential permissions, but it may include production assets, hosted files, or backups. Recovery may be impossible unless bucket versioning or an independent backup is available. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (33)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description focuses on object storage operations, but the documented behavior also includes software installation, persistent credential storage, shell profile modification, and account configuration. This mismatch is dangerous because users or orchestrators may authorize the skill for routine storage tasks without realizing it can alter the local environment and persist secrets.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/qiniu_node.mjs test-connection
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/qiniu_node.mjs test-connection
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/qiniu_node.mjs test-connection
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/qiniu_node.mjs test-connection
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/qiniu_node.mjs test-connection
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/qiniu_node.mjs test-connection
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/qiniu_node.mjs test-connection
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The delete command prints what looks like a confirmation prompt when --force is absent, but immediately continues to perform the deletion without actually reading or enforcing user consent. This creates a deceptive safety mechanism that can cause irreversible remote object deletion when a user believes execution is paused awaiting confirmation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Remote object deletion is destructive and irreversible, yet the command proceeds even without the advertised force/confirmation safeguard. In a storage-management skill, users may run commands against production buckets, so accidental deletion can directly cause data loss and operational disruption.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Batch deletion reads keys from a file and deletes them with no warning, preview, or confirmation, making large-scale accidental data loss easy. Because this operates on cloud object storage, a mistaken file, malformed list, or automation error could delete many production objects in one run.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill documentation instructs users to provide cloud access credentials directly in a setup command, but does not warn about protecting those secrets or avoiding exposure in shell history and shared terminals. For markdown files, omission of warnings about behaviors affecting privacy or credential safety is in scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file includes a delete command example for object storage, including a force flag, but provides no user warning about permanent deletion or impact on stored data. Under the markdown-specific warning rule, destructive behavior that can affect user data should be disclosed clearly in the skill description.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes shell commands such as bash setup scripts and node CLI operations, but it does not declare any tool scope restrictions like allowed-tools or permissions. This weakens policy enforcement and makes it easier for the skill to trigger broader shell actions than a user may expect, especially because installation and configuration steps are performed through the shell.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation instructs users to pass AccessKey and SecretKey directly on the command line without any warning about secret exposure. Command-line secrets may be captured in shell history, process listings, logs, or transcripts, making credential theft more likely and enabling unauthorized access to the storage account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation includes deletion of remote objects with a force flag but provides no warning about irreversible data loss, scope of deletion, or confirmation expectations. In a storage-management skill, destructive operations are contextually expected, but omitting safeguards increases the chance of accidental deletion of production data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The batch-delete example demonstrates irreversible destructive operations without an explicit warning, dry-run mode, or verification guidance. In a storage-management skill, this increases the chance that users or agents will execute mass deletions on production objects, causing avoidable data loss.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The OpenClaw example shows a successful file move operation as if the skill can already perform it, but the immediately following command-line notes say move/copy '需要扩展' and are not yet implemented in the script. That is an active contradiction in the documentation about whether these capabilities currently exist.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The automated backup script includes both local and cloud cleanup logic that permanently deletes backups based on time thresholds, but it provides no safety warning, validation step, or recovery guidance. In backup workflows, unsafe deletion examples are especially risky because mistakes can silently destroy retention history and undermine disaster recovery.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Comments and especially user-visible console messages throughout the script are written exclusively in Chinese, including success, error, and usage text. The file provides no mechanism for locale selection or explicit limitation to a Chinese-only audience, which violates the language-choice policy described.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest and module header describe the skill as supporting upload, download, list, delete, and URL retrieval operations. The code additionally provides move and copy capabilities, which are object-modification actions beyond the stated operation set rather than an obvious implementation detail of those listed features.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script installs globally executable components via npm and also downloads a qshell ZIP directly from the internet, then places the resulting binary into a user or system PATH location. This creates supply-chain and integrity risk because external code is fetched and made executable without checksum/signature verification or pinning to a trusted digest.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script writes Qiniu credentials into ~/.mcporter/mcporter.json, persisting secrets on disk for another tool without notifying the user of the storage location or retention risk. Because this is a cloud storage skill, these credentials may provide broad access to buckets and objects, so silent persistence expands the attack surface and complicates secret management and rotation.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh cd "$TEMP_DIR" if wget -q "$QSHELL_URL" -O qshell.zip && unzip -q qshell.zip && chmod +x qshell; then sudo mv qshell /usr/local/bin/ 2>/dev/null || mv qshell "$HOME/.local/bin/" log_info "✅ qshell 安装成功" cd - > /dev/null rm -rf "$TEMP_DIR"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script writes access and secret keys into a persistent JSON config file and into shell startup files without clearly warning the user that sensitive credentials will remain on disk. Even though the config file is chmod 600, persistence still raises exposure risk through backups, local compromise, terminal history workflows, and accidental sharing of dotfiles or project directories.
- Content
Static analysis
No suspicious patterns detected.