ClawHub
Back to skill

Security audit

Tencent COS Ops

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Tencent COS bucket helper with bounded upload, download, list, and single-object delete behavior, but users should treat it as capable of changing cloud storage.

Install only if you want Codex to operate on the Tencent COS bucket configured in the environment. Set COS_ALLOWED_PREFIX and COS_LOCAL_ROOT when possible, keep COS credentials scoped to the intended bucket/prefix, and review any delete or overwrite request before approving it.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill metadata says it should be used only for one env-configured bucket and an explicitly requested bucket/object key, but the implementation exposes broader capabilities: listing arbitrary allowed prefixes and deleting objects. In an agent setting, this expands the action surface beyond the declared intent, increasing the chance of unauthorized enumeration or destructive operations if the tool is selected or prompted unexpectedly.

Static analysis

No suspicious patterns detected.