T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cos-upload.js:28- Finding
Cloud credentials exposed through command-line arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Tencent Cloud Image Hosting (Upload files to get online URLs)
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform its stated COS upload job, but it handles cloud credentials and shareable signed URLs in ways users should review before installing.
Review before installing. Use least-privilege, preferably short-lived Tencent Cloud credentials limited to the intended bucket and prefix. Prefer environment variables or a protected credential provider over command-line secret flags. Do not upload sensitive files unless bucket permissions, retention, and sharing rules are understood, and treat printed signed URLs as temporary credentials that should not be exposed in logs or chats.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cos-upload.js:135- Finding
Pre-signed object URL disclosed through standard output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The example passes secret ID and secret key directly on the command line, which can leak through shell history, process listings, audit logs, CI job output, or terminal recording. Because these are cloud API credentials, exposure could let an attacker upload, read, modify, or delete data in the associated COS account depending on IAM permissions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 78% confidence
- Finding
The skill documents use of environment variables containing cloud credentials but does not declare any explicit tool scope or permission boundary. In agent environments, missing scope metadata can cause overly broad or unclear access expectations, making it harder to enforce least privilege and increasing the chance of unintended secret access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly supports uploading arbitrary files and generating direct or signed URLs, yet it gives no warning about privacy, data classification, bucket visibility, or the risk of making sensitive content accessible. Users may upload secrets, personal data, or internal documents and unintentionally expose them via public or shareable links.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code reads cloud credentials from environment variables and also accepts them directly on the command line. Although the script validates missing configuration, it does not provide any user-facing warning that secrets are being consumed or that passing them via CLI may expose them in shell history or process listings.
- Content
Static analysis
No suspicious patterns detected.