T08 · Insecure Dependencies
Error
- Location
SKILL.md:17- Finding
Downloaded UCloud CLI binaries are installed without integrity or authenticity verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Ucloud Api Skill
Security checks for vulnerabilities and agentic risk
Overview
This UCloud operations skill is coherent, but it asks agents to handle live cloud resources in ways that can expose credentials or install an unverified CLI binary.
Review before installing. Use this skill only in an isolated, trusted environment with a known-good UCloud CLI already installed if possible. Do not allow it to print passwords or private keys into chat, avoid shared /tmp payload files for sensitive requests, and require explicit confirmation before creating, changing, or deleting cloud resources.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
references/cli-usage.md:62- Finding
Sensitive API requests use a predictable shared temporary file
- Content
View full analysis
/tmp/ucloud-request.json << 'EOF' { "Action": "CreateUHostInstance", "Region": "cn-bj2", "Zone": "cn-bj2-05", "ImageId": "uimage-xxx", "LoginMode": "Password", "Password": "GENERATED_PASSWORD" } EOF ucloud --profile prod-account api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json ``` The surrounding instructions require the Agent to write a JSON payload to `/tmp/ucloud-request.json`, execute it with `ucloud api --local-file`, and delete it afterward. ### Technical Analysis The file name `/tmp/ucloud-request.json` is fixed and predictable. On multi-user Unix-like systems, `/tmp` is normally shared among users and processes. Redirecting shell output to a predictable path without secure file creation creates several risks: - A local attacker can pre-create the path as a symbolic link, potentially redirecting the write to another file writable by the victim. - A local attacker can monitor the predictable path and read the request while it exists. - File confidentiality depends on the process umask because the instructions do not explicitly set restrictive permissions. - Concurrent Skill invocations can overwrite or consume each other's payloads. - An attacker may alter the file between its creation and the CLI reading it. - Cleanup only occurs after the CLI command and is not protected by an exit trap, so interruption or failure may leave the file behind. The demonstrated payload contains a generated VM password in plaintext. Other API requests may contain additional confidential or security-sensitive configuration. Deleting the file after use does not prevent disclosure or tampering while it ...[truncated 1542 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/deployment.md:9- Finding
Deployment summaries are instructed to disclose login credentials
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## 凭据约定 官方 CLI 将 profile 存储在 `~/.ucloud/config.json` 和 `~/.ucloud/credential.json` 中。 将 profile 作为本技能的主要凭据来源。 CLI 提供 `ucloud auth login`、`ucloud init`、`ucloud config add`、`ucloud config update` 和 `ucloud config list`。优先使用 OAuth 登录处理交互式人工授权；AK/SK 初始化和配置变更是敏感操作，因为 `config add/update` 的 flag 包含 public key 和 private key。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guidance explicitly instructs the agent to display sensitive access details after provisioning, including login credentials. In a cloud-operations skill, this creates a real risk of exposing secrets in chat history, logs, screenshots, shared workspaces, or to unintended viewers, enabling unauthorized access to newly created infrastructure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instruction to display login credentials and other access details after resource creation is a direct secret-exposure issue. Because this skill performs real UCloud resource operations, exposed credentials could be used immediately to access hosts or services, making the operational context more dangerous rather than less.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description is broadly scoped to trigger on generic deployment and go-live requests, which can overlap with many unrelated tasks. In an agentic environment this can cause the skill to be selected when the user did not clearly ask for real cloud-side actions, increasing the chance of unintended resource creation, modification, or deletion in a live account.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Treating all deployment-style requests as a strong trigger without clear limits creates ambiguous activation conditions. Because this skill is designed for real infrastructure operations, ambiguous triggering can escalate harmless planning or advisory conversations into execution-oriented cloud actions against the user's account.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JSON eval file consistently specifies prompts, expected outputs, and assertions in Chinese, including requirements the assistant should follow, but does not indicate that language choice is optional or region-specific. That creates a natural-language policy concern if organizational policy requires not forcing a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all operational guidance exclusively in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. That creates a natural-language policy concern because it effectively forces a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill directs the agent to query account-scoped metadata such as regions, projects, and balance from the user's cloud account context without first telling the user that account information will be accessed. This creates a privacy and authorization-transparency issue: even if the data is needed operationally, the agent may enumerate account details the user did not explicitly realize would be queried.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
All natural-language instructions in this file are in Chinese, and the skill does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. That creates a locale policy concern because it effectively forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill guidance is written only in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s instructional content is entirely in Chinese and does not provide any language choice, opt-in, or note that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill file is written in Chinese and provides no indication that language selection is optional or limited to a region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill file is written as a mandatory Chinese-language product rule set and does not indicate that language choice is optional or user-selected. This can violate language/locale policy when the skill is used in contexts where users have not opted into Chinese output.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
整个技能说明仅以中文规定行为和输出方式，且未明确给用户提供语言选择或按用户偏好切换语言的机制。若组织要求避免未经用户同意强制特定语言，这种默认单一语言约束可能构成自然语言策略违规。
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest scopes this skill to real UCloud resource operations and deployment-related cloud tasks through the official UCloud CLI. The documented example for generating an alphanumeric password uses local shell utilities and introduces a general-purpose secret generation capability that is not justified by that scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All user-facing natural-language guidance in the file is in Chinese, and the document does not indicate that the skill is region-specific or that users may opt into another language. Under the policy rule, forcing a specific language without opt-in can be a locale-policy violation.
- Content
Static analysis
No suspicious patterns detected.