Ucloud Api Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:15 AM UTC
• Version: 0.1.2

Overview

This UCloud operations skill is coherent, but it asks agents to handle live cloud resources in ways that can expose credentials or install an unverified CLI binary.

Review before installing. Use this skill only in an isolated, trusted environment with a known-good UCloud CLI already installed if possible. Do not allow it to print passwords or private keys into chat, avoid shared /tmp payload files for sensitive requests, and require explicit confirmation before creating, changing, or deleting cloud resources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17
• Finding: Downloaded UCloud CLI binaries are installed without integrity or authenticity verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-23` **Vulnerability Type**: Unverified executable dependency installation **Risk Level**: High ### Vulnerable Source Excerpt The following is an English translation of the complete relevant instruction segment: ```markdown If the `ucloud` CLI is not installed, unavailable, or older than `v0.3.1`, stop the current resource operation first. Check the operating system and architecture, and then install or upgrade the CLI after obtaining user consent. For Linux, first read `/etc/os-release` and use `uname -m`; for macOS, use `sw_vers` and `uname -m`. **Installation methods** - macOS: Download the binary for the architecture from `https://ucloud-infra.cn-bj.ufileos.com/cli/darwin_{amd64,arm64}/ucloud`. Unless the user specifies an installation path, it must be installed into a directory in `$PATH`; request authorization if permission is unavailable. - Linux: Download the binary for the architecture from `https://ucloud-infra.cn-bj.ufileos.com/cli/linux_{amd64,arm64}/ucloud`. Unless the user specifies an installation path, it must be installed into a directory in `$PATH`; request authorization if permission is unavailable. - Windows: Download the binary from `https://ucloud-infra.cn-bj.ufileos.com/cli/windows_amd64/ucloud.exe`. Unless the user specifies an installation path, it must be installed into a directory in `PATH`; request authorization if permission is unavailable. ``` ### Technical Analysis The Skill instructs the Agent to download an executable directly from a remote object-storage URL and install it in a searchable executable directory. It does not require verification of a cryptographic signature, a pinned SHA-256 digest, a signed release manifest, or an independently authenticated release source. HTTPS provides transport security but does not establish that the downloaded artifact is the exact binary reviewed or intended by the Skill author. A compromised hosting account, storage ...[truncated 1870 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation instructions to an explicit, reviewed UCloud CLI version rather than an unversioned mutable URL. 2. Publish an expected SHA-256 or stronger digest for every supported operating-system and architecture combination. 3. Obtain checksums from an independently authenticated release manifest rather than from the same mutable storage object as the binary. 4. Prefer cryptographic release signatures and verify them using a pinned vendor signing key. 5. Download the executable into a newly created private temporary directory rather than directly into `$PATH`. 6. Verify the digest and signature before making the file executable or moving it into its final location. 7. Abort installation on any verification failure, redirect, unexpected content type, architecture mismatch, or version mismatch. 8. Prefer an authenticated official package repository where one is available. 9. Display the exact version, source URL, expected digest, destination, and required privilege level before requesting installation consent. 10. Invoke the installed binary by its verified absolute path during initial validation to avoid executing a different binary through path precedence. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-usage.md:62
• Finding: Sensitive API requests use a predictable shared temporary file<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-usage.md:62-80` **Additional Locations**: `SKILL.md:88-99`, `SKILL.md:191-199`, `references/common-lookups.md:49-76` **Vulnerability Type**: Predictable temporary file containing plaintext sensitive data **Risk Level**: High ### Vulnerable Code Snippet ```bash cat > /tmp/ucloud-request.json << 'EOF' { "Action": "CreateUHostInstance", "Region": "cn-bj2", "Zone": "cn-bj2-05", "ImageId": "uimage-xxx", "LoginMode": "Password", "Password": "GENERATED_PASSWORD" } EOF ucloud --profile prod-account api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json ``` The surrounding instructions require the Agent to write a JSON payload to `/tmp/ucloud-request.json`, execute it with `ucloud api --local-file`, and delete it afterward. ### Technical Analysis The file name `/tmp/ucloud-request.json` is fixed and predictable. On multi-user Unix-like systems, `/tmp` is normally shared among users and processes. Redirecting shell output to a predictable path without secure file creation creates several risks: - A local attacker can pre-create the path as a symbolic link, potentially redirecting the write to another file writable by the victim. - A local attacker can monitor the predictable path and read the request while it exists. - File confidentiality depends on the process umask because the instructions do not explicitly set restrictive permissions. - Concurrent Skill invocations can overwrite or consume each other's payloads. - An attacker may alter the file between its creation and the CLI reading it. - Cleanup only occurs after the CLI command and is not protected by an exit trap, so interruption or failure may leave the file behind. The demonstrated payload contains a generated VM password in plaintext. Other API requests may contain additional confidential or security-sensitive configuration. Deleting the file after use does not prevent disclosure or tampering while it ...[truncated 1542 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a unique private temporary directory using a secure primitive such as: ```bash umask 077 tmp_dir="$(mktemp -d)" request_file="$tmp_dir/request.json" trap 'rm -rf -- "$tmp_dir"' EXIT HUP INT TERM ``` 2. Ensure that the temporary directory is owned by the current user and has mode `0700`. 3. Create request files atomically with mode `0600`; do not reuse a globally predictable name. 4. Reject symbolic links and verify the file type and ownership before passing the path to the CLI. 5. Keep the private temporary directory and CLI invocation within the same process and minimize the interval during which the payload exists. 6. Install an exit trap so cleanup also occurs after errors, interrupts, or early returns. 7. Avoid writing passwords or tokens to disk when the CLI supports standard input, a secure credential store, an interactive secret prompt, or a dedicated secret reference. 8. Prevent concurrent operations from sharing request paths. 9. Do not log file contents or include sensitive payloads in command previews. 10. Where plaintext temporary storage is unavoidable, document the residual exposure and require an execution environment with appropriate local-user isolation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/deployment.md:9
• Finding: Deployment summaries are instructed to disclose login credentials<![CDATA[ ## Vulnerability Details **File Location**: `references/deployment.md:9` **Vulnerability Type**: Plaintext credential exposure through user-facing output **Risk Level**: Medium ### Vulnerable Source Excerpt The following is an English translation of the complete relevant instruction: ```markdown After resource creation succeeds, display important access and inventory fields in the summary, such as the login username, login credentials, private IP address, public IP address, resource ID, Region, Zone, specification, billing mode, and attached security-group or network information. ``` ### Technical Analysis The deployment rule explicitly includes login credentials in the user-facing creation summary. Elsewhere, the Skill correctly treats UCloud API keys and tokens as sensitive, but that protection does not extend to generated VM passwords or other instance login credentials. Conversation output is an unsafe secret-delivery channel because it may be retained in chat history, Agent traces, tool logs, observability systems, support exports, browser storage, screenshots, or shared collaboration interfaces. A generated password remains a credential even if it is intended only for initial access. The instruction also combines a public IP address, username, and credential in one summary. This gives anyone who can read the transcript nearly all information required to attempt remote access. ### Attack Path 1. The Skill creates a cloud instance and generates or receives an initial login password. 2. The deployment rule instructs the Agent to include the username and login credential in the result summary. 3. The Agent prints the username, password, public IP address, and related resource details into the conversation. 4. The conversation or execution trace is retained by one or more logging or collaboration systems. 5. An unauthorized person with access to those records retrieves the credential. 6. The person connects to the exposed instance using the ...[truncated 854 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove login credentials from all user-facing summaries, plans, tool logs, command previews, and raw API output. 2. Return only non-secret fields such as the resource ID, Region, Zone, IP addresses, username, and a confirmation that the credential was stored securely. 3. Deliver initial credentials through a dedicated secret manager, one-time secret link, encrypted user-controlled destination, or cloud-native credential mechanism. 4. Prefer SSH public-key authentication over password authentication for Unix-like instances. 5. If a password is unavoidable, generate it with sufficient entropy, store it directly in an approved secret store, and require rotation at first login. 6. Do not place the secret-retrieval token or one-time secret URL in broadly retained logs. 7. Redact credential fields from raw CLI and API responses before presenting output. 8. Add an explicit rule that VM passwords, private keys, database passwords, tokens, and recovery credentials must receive the same protection as UCloud API credentials. 9. Encourage users to disable password-based remote login after validating key-based access. 10. Minimize the lifetime and privileges of any bootstrap credential. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Credential Access

High

• Category: Privilege Escalation

Content

## 凭据约定

官方 CLI 将 profile 存储在 `~/.ucloud/config.json` 和 `~/.ucloud/credential.json` 中。
将 profile 作为本技能的主要凭据来源。

CLI 提供 `ucloud auth login`、`ucloud init`、`ucloud config add`、`ucloud config update` 和 `ucloud config list`。优先使用 OAuth 登录处理交互式人工授权；AK/SK 初始化和配置变更是敏感操作，因为 `config add/update` 的 flag 包含 public key 和 private key。

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{"Action":"ListRegions"}
EOF
ucloud api --local-file /tmp/ucloud-request.json
rm -f /tmp/ucloud-request.json

# ListZones（需要 Region）
cat > /tmp/ucloud-request.json << 'EOF'

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{"Action":"ListRegions"}
EOF
ucloud api --local-file /tmp/ucloud-request.json
rm -f /tmp/ucloud-request.json

# ListZones（需要 Region）
cat > /tmp/ucloud-request.json << 'EOF'

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{"Action":"ListRegions"}
EOF
ucloud api --local-file /tmp/ucloud-request.json
rm -f /tmp/ucloud-request.json

# ListZones（需要 Region）
cat > /tmp/ucloud-request.json << 'EOF'

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{"Action":"ListRegions"}
EOF
ucloud api --local-file /tmp/ucloud-request.json
rm -f /tmp/ucloud-request.json

# ListZones（需要 Region）
cat > /tmp/ucloud-request.json << 'EOF'

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{"Action":"ListRegions"}
EOF
ucloud api --local-file /tmp/ucloud-request.json
rm -f /tmp/ucloud-request.json

# ListZones（需要 Region）
cat > /tmp/ucloud-request.json << 'EOF'

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{"Action":"ListRegions"}
EOF
ucloud api --local-file /tmp/ucloud-request.json
rm -f /tmp/ucloud-request.json

# ListZones（需要 Region）
cat > /tmp/ucloud-request.json << 'EOF'

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{"Action":"ListRegions"}
EOF
ucloud api --local-file /tmp/ucloud-request.json
rm -f /tmp/ucloud-request.json

# ListZones（需要 Region）
cat > /tmp/ucloud-request.json << 'EOF'

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The guidance explicitly instructs the agent to display sensitive access details after provisioning, including login credentials. In a cloud-operations skill, this creates a real risk of exposing secrets in chat history, logs, screenshots, shared workspaces, or to unintended viewers, enabling unauthorized access to newly created infrastructure.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The instruction to display login credentials and other access details after resource creation is a direct secret-exposure issue. Because this skill performs real UCloud resource operations, exposed credentials could be used immediately to access hosts or services, making the operational context more dangerous rather than less.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description is broadly scoped to trigger on generic deployment and go-live requests, which can overlap with many unrelated tasks. In an agentic environment this can cause the skill to be selected when the user did not clearly ask for real cloud-side actions, increasing the chance of unintended resource creation, modification, or deletion in a live account.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Treating all deployment-style requests as a strong trigger without clear limits creates ambiguous activation conditions. Because this skill is designed for real infrastructure operations, ambiguous triggering can escalate harmless planning or advisory conversations into execution-oriented cloud actions against the user's account.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This JSON eval file consistently specifies prompts, expected outputs, and assertions in Chinese, including requirements the assistant should follow, but does not indicate that language choice is optional or region-specific. That creates a natural-language policy concern if organizational policy requires not forcing a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents all operational guidance exclusively in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. That creates a natural-language policy concern because it effectively forces a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill directs the agent to query account-scoped metadata such as regions, projects, and balance from the user's cloud account context without first telling the user that account information will be accessed. This creates a privacy and authorization-transparency issue: even if the data is needed operationally, the agent may enumerate account details the user did not explicitly realize would be queried.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: All natural-language instructions in this file are in Chinese, and the skill does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. That creates a locale policy concern because it effectively forces a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill guidance is written only in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s instructional content is entirely in Chinese and does not provide any language choice, opt-in, or note that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The entire skill file is written in Chinese and provides no indication that language selection is optional or limited to a region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire skill file is written as a mandatory Chinese-language product rule set and does not indicate that language choice is optional or user-selected. This can violate language/locale policy when the skill is used in contexts where users have not opted into Chinese output.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: 整个技能说明仅以中文规定行为和输出方式，且未明确给用户提供语言选择或按用户偏好切换语言的机制。若组织要求避免未经用户同意强制特定语言，这种默认单一语言约束可能构成自然语言策略违规。

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: The manifest scopes this skill to real UCloud resource operations and deployment-related cloud tasks through the official UCloud CLI. The documented example for generating an alphanumeric password uses local shell utilities and introduces a general-purpose secret generation capability that is not justified by that scope.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: All user-facing natural-language guidance in the file is in Chinese, and the document does not indicate that the skill is region-specific or that users may opt into another language. Under the policy rule, forcing a specific language without opt-in can be a locale-policy violation.

Static analysis

No suspicious patterns detected.