Security audit

管理无阶未来GPU云平台实例的创建、查询与删除操作；当用户需要创建GPU容器、查询实例状态或清理资源时使用

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Vylai GPU cloud management skill that can use an API token to list, create, query, and delete cloud resources, so it is powerful but coherent with its stated purpose.

Install only if you want an agent or operator to manage your Vylai cloud account. Use the least-privileged token available, avoid exposing the token in logs or shared shells, use --no-token when you only need public app listings, and carefully confirm task_id or deploy_name before deleting resources.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is described as managing cloud instances, but this script adds broader application-enumeration capability, including discovery of available apps on the platform. Scope expansion is a security issue because users or orchestrators may invoke the skill assuming only instance-management actions, while it can also inventory platform resources and potentially expose information beyond the declared purpose.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code automatically reads API tokens from environment variables and uses them to enumerate not just public apps but also the user's private applications. This broadens data access beyond the stated instance-management purpose and can silently expose private inventory information whenever the script is run in a token-bearing environment.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill documents deletion of cloud instances without an explicit warning that removal may be irreversible and could destroy running workloads or attached data. In an infrastructure-management skill, destructive actions are inherently higher risk because a user or agent may trigger cleanup flows without appreciating operational and data-loss consequences.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs users to place an API token in environment variables but provides no credential-handling guidance, increasing the risk of accidental exposure through logs, shell history, debugging output, screenshots, or misuse by adjacent scripts. Because this token can control cloud instances, compromise could enable unauthorized resource creation, deletion, or enumeration.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script performs an irreversible instance-deletion API call immediately when invoked with a task_id, with no confirmation prompt, dry-run mode, or explicit safety interlock. In an agent or automation context, a mistaken parameter, prompt injection, or ambiguous user request could cause unintended resource deletion and service disruption.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This alternate deletion path deletes by deploy_name without any confirmation or warning, creating the same unsafe behavior through a second identifier type. Because deploy_name is often human-supplied and potentially easier to confuse, this increases the chance of accidental destructive actions in operational use.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script silently retrieves an API token from environment variables and transmits it in an authenticated request without any user-facing disclosure or consent prompt. In an agent context, this is dangerous because a caller may believe they are performing a harmless listing operation while the tool is actually accessing privileged account data using ambient secrets.

Static analysis

No suspicious patterns detected.