Tencent Cloud Image Hosting (Upload files to get online URLs)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:49 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform its stated COS upload job, but it handles cloud credentials and shareable signed URLs in ways users should review before installing.

Review before installing. Use least-privilege, preferably short-lived Tencent Cloud credentials limited to the intended bucket and prefix. Prefer environment variables or a protected credential provider over command-line secret flags. Do not upload sensitive files unless bucket permissions, retention, and sharing rules are understood, and treat printed signed URLs as temporary credentials that should not be exposed in logs or chats.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cos-upload.js:28
• Finding: Cloud credentials exposed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cos-upload.js:28-29`; insecure usage is also documented in `SKILL.md:27-32` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```javascript if (arg === '--secret-id' && args[i + 1]) options.secretId = args[++i]; else if (arg === '--secret-key' && args[i + 1]) options.secretKey = args[++i]; ``` The corresponding documented invocation is: ```bash node cos-upload.js /path/to/file.png \ --secret-id AKIDxxx \ --secret-key xxx \ --bucket my-bucket-1250000000 \ --region ap-guangzhou \ --path images/ ``` ### Technical Analysis The script accepts the Tencent Cloud Secret ID and Secret Key directly through command-line arguments. Command-line secrets may be retained in shell history and exposed through operating-system process inspection, audit telemetry, debugging output, or CI/CD execution logs. Tencent Cloud credentials can be long-lived and authorize operations beyond uploading a single file. The precise exposure depends on the execution environment and the permissions assigned to the credentials. ### Attack Path 1. A user follows the documented example and passes Tencent Cloud credentials through `--secret-id` and `--secret-key`. 2. The command is retained in shell history, process metadata, audit records, or automation logs. 3. A local user, administrator, monitoring system operator, or party with access to those records retrieves the credentials. 4. The exposed credentials are used to authenticate to Tencent Cloud APIs. 5. The attacker performs any operation authorized by the credentials' IAM policies. ### Impact Assessment Successful exploitation exposes the Tencent Cloud identity represented by the supplied credentials. The attacker can obtain all privileges granted to that identity, potentially including reading, uploading, replacing, or deleting COS objects and accessing other Tencent Clou ...[truncated 205 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove support for passing `SecretId` and `SecretKey` through command-line arguments. - Obtain credentials through Tencent Cloud's standard credential-provider mechanism, a protected configuration file, environment variables, or a dedicated secrets manager. - Prefer short-lived credentials issued through role-based authentication rather than long-lived static keys. - Apply least-privilege IAM policies that restrict the identity to the required bucket, object prefix, and operations. - Update `SKILL.md` to remove the command-line credential example and document the secure authentication method. - Add warnings against including secrets in shell commands, scripts, source control, CI configuration, or logs. - Rotate any credential that has already been passed through an exposed command line or retained in logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cos-upload.js:135
• Finding: Pre-signed object URL disclosed through standard output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cos-upload.js:135-137` **Vulnerability Type**: Disclosure of a temporary bearer credential through logs **Risk Level**: Medium ### Vulnerable Code ```javascript if (signedUrl) { console.log('\n🔐 Pre-signed URL (24-hour validity):'); console.log(signedUrl); } ``` ### Technical Analysis The script prints the generated pre-signed COS URL unconditionally when URL generation succeeds. A pre-signed URL acts as a bearer credential: possession of the URL is sufficient to exercise its authorized object access until it expires. Standard output is commonly captured by terminal history mechanisms, CI/CD systems, centralized logging services, task runners, and agent execution logs. If such output is visible to users who are not authorized to access the uploaded private object, printing the URL bypasses the confidentiality expected from a private bucket for the URL's 24-hour lifetime. ### Attack Path 1. A user uploads an object to a private COS bucket with the Skill. 2. The script generates a pre-signed URL that remains valid for 24 hours. 3. The script writes the complete URL to standard output. 4. A terminal recorder, CI/CD platform, centralized logging service, or agent transcript stores the output. 5. A party with access to those records copies the URL. 6. That party uses the URL before expiration to access the uploaded object without separately possessing Tencent Cloud credentials. ### Impact Assessment An attacker who obtains the URL can access the specific uploaded object with the permissions encoded in the signature for up to 24 hours. This can disclose images, documents, videos, or other sensitive files uploaded to an otherwise private bucket. The issue does not by itself grant general access to the bucket or Tencent Cloud account. Its scope is limited to the object, operation, and expiration represented by the signed URL. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not print pre-signed URLs by default. - Require an explicit option, such as `--show-signed-url`, before displaying a bearer URL. - Clearly warn users that pre-signed URLs are temporary credentials and must not be placed in logs, tickets, chat messages, or other shared records. - Return sensitive URLs through a protected output channel when integration requires them. - Allow callers to configure a shorter expiration and use the minimum lifetime necessary. - Configure CI/CD and centralized logging systems to redact COS signature query parameters and other signed-URL credentials. - Restrict access to execution logs and establish retention and deletion controls for logs that may already contain signed URLs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The example passes secret ID and secret key directly on the command line, which can leak through shell history, process listings, audit logs, CI job output, or terminal recording. Because these are cloud API credentials, exposure could let an attacker upload, read, modify, or delete data in the associated COS account depending on IAM permissions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence
• Finding: The skill documents use of environment variables containing cloud credentials but does not declare any explicit tool scope or permission boundary. In agent environments, missing scope metadata can cause overly broad or unclear access expectations, making it harder to enforce least privilege and increasing the chance of unintended secret access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly supports uploading arbitrary files and generating direct or signed URLs, yet it gives no warning about privacy, data classification, bucket visibility, or the risk of making sensitive content accessible. Users may upload secrets, personal data, or internal documents and unintentionally expose them via public or shareable links.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code reads cloud credentials from environment variables and also accepts them directly on the command line. Although the script validates missing configuration, it does not provide any user-facing warning that secrets are being consumed or that passing them via CLI may expose them in shell history or process listings.

Static analysis

No suspicious patterns detected.