Security audit

UCloud CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for UCloud cloud management, but it gives an agent broad authority over live, billable cloud resources with some under-scoped handling of confirmations, credentials, and account data.

Install only if you want an agent to operate a real UCloud account. Use a limited-permission profile, require an explicit review of resource scope and cost before any create/update/delete action, and do not allow raw passwords or keys to be printed in chat unless you deliberately request that exposure.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cli-usage.md (reported line 25)May include surrounding context.
md
## 凭据约定官方 CLI 将 profile 存储在 `~/.ucloud/config.json` 和 `~/.ucloud/credential.json` 中。将 profile 作为本技能的主要凭据来源。 CLI 提供 `ucloud auth login`、`ucloud init`、`ucloud config add`、`ucloud config update` 和 `ucloud config list`。优先使用 OAuth 登录处理交互式人工授权；AK/SK 初始化和配置变更是敏感操作，因为 `config add/update` 的 flag 包含 public key 和 private key。

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
{"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
md
{"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/cli-usage.md (reported line 80)May include surrounding context.
md
{"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/common-lookups.md (reported line 55)May include surrounding context.
md
{"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/common-lookups.md (reported line 62)May include surrounding context.
md
{"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/common-lookups.md (reported line 69)May include surrounding context.
md
{"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/common-lookups.md (reported line 76)May include surrounding context.
md
{"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill can create real cloud resources and its instructions include revealing deployment outputs, yet it does not clearly warn users that actions may incur charges or expose sensitive operational details. In a cloud-management skill, missing upfront disclosure materially increases the risk of surprise billing, accidental production changes, and unsafe handling of secrets.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction to display login usernames, credentials, IP addresses, resource IDs, and network/security information after creation directly exposes secrets and sensitive infrastructure metadata in the chat. In this skill context, that is especially dangerous because the system manages real cloud assets, so leaked credentials or topology details could enable unauthorized access or facilitate follow-on attacks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises real create, update, and delete operations on cloud resources but does not prominently warn about destructive, irreversible, or billable effects at the point of capability description. In practice, this raises the risk that users or downstream agents may invoke live actions without appreciating deletion, exposure, downtime, or cost consequences.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger language is overly broad and explicitly treats generic deployment-related requests as a strong signal to invoke this skill, even when the user did not clearly ask for UCloud operations. In an agent setting, this can cause unintended execution of real cloud actions against live infrastructure, especially when deployment requests are ambiguous or could apply to non-UCloud environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guidance explicitly writes API request payloads to /tmp/ucloud-request.json, and the example includes a Password field. On many systems /tmp is shared and predictable, creating exposure to local users, symlink races, or recovery from crashes before cleanup; in this skill context the payload may also contain cloud resource parameters and secrets, so the risk is materially elevated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: All user-facing guidance in this file is in Chinese, and the instructions are framed as normative behavior for the skill without indicating that Chinese is optional or that the skill is region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guidance instructs the agent to query account-scoped project and balance data automatically from account context, but it does not require explicit user consent, minimization, or a warning that sensitive account metadata will be accessed. In an agent setting, this can cause unintended disclosure or over-collection of tenant/account information beyond what the user expected for a simple task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The deployment triggers are broad enough to auto-route generic phrases like 'deploy my web service' or 'put this site online' into a skill that performs real cloud operations. In this context, that increases the chance of unintended billable resource creation or destructive infrastructure changes without sufficiently explicit user intent or confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing operational instructions exclusively in Chinese, with no indication that the user can choose another language or that the locale restriction is intentional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill guidance is written in Chinese and provides operational instructions without any indication that language selection is optional or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The main summary and operational description are presented in Chinese, and the detailed instructions throughout the file are also effectively Chinese-only for execution guidance. Although description_en exists in metadata, the skill body does not state that users may choose their preferred language, which can violate a language-choice policy if the skill defaults to a single language without opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest scopes this skill to operating real UCloud resources and deploying web applications through the official UCloud CLI. The example at L228-L232 adds a standalone credential-generation shell technique that is not a UCloud CLI operation and is not necessary to justify the skill's stated purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file presents all user-facing instructions exclusively in Chinese, which can constitute a language/locale policy violation when no user choice or opt-in is provided. The content does not indicate that the language restriction is optional or justified by a region-specific requirement.
Content: No source excerpt is available for this finding.