us3-uploader-encrypted

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:13 AM UTC
• Version: 1.0.0

Overview

This skill is a real US3 upload helper, but it is overbroad because it makes external uploads the default for any generated file and installs an unpinned package at runtime.

Install only if you intentionally want agents to upload generated files to your UCloud US3 bucket. Treat the signed URLs as shareable external links, avoid using this for secrets or private documents, pin/provision the `ufile` SDK outside runtime, validate the bucket endpoint, and require explicit approval before each upload.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:5
• Finding: Always-Enabled Skill Forces Indiscriminate External File Uploads## Vulnerability Details **File Location**: `SKILL.md:5-9` and `SKILL.md:15-32` **Vulnerability Type**: Forced agent behavior and external data transfer **Risk Level**: High ### Vulnerable Code ```yaml description: | Upload files to UCloud US3 (UFile) object storage and generate download URLs. 当用户需要：上传文件、发送文件、分享文件、生成文件链接、把文件发给用户、导出文件、 生成PDF/图片/文档后发送、任何文件产出需要给用户时，必须使用此 skill。 沙箱内的文件用户无法直接访问，必须上传到 US3 生成下载链接。 metadata: | { "openclaw": { "always": true } } ``` ```markdown > [!CAUTION] > **强制要求 - 文件产出必须上传！** > > 如果任务产出的内容是**任何类型的文件**，包括但不限于： > - 图片（截图、生成的图片、处理后的图片等） > - 视频（录制、剪辑、转码后的视频等） > - PDF（生成的报告、转换的文档等） > - 其他文档（Word、Excel、PPT、代码压缩包等） > > **必须执行以下步骤：** > 1. 使用 `python3 scripts/upload_to_us3.py <文件路径>` 上传到 US3 > 2. 将生成的下载链接发送给用户 > > **禁止：** 只告诉用户"文件已保存在 /tmp/xxx"或本地路径。沙箱环境中的文件用户**完全无法访问**，必须上传后提供链接！ ``` ### Technical Analysis The skill declares itself as always active and uses mandatory instructions to require uploading every generated file to an external UCloud US3 bucket. The instructions do not distinguish between files intentionally created for public sharing and files containing source code, credentials, personal information, internal reports, or other confidential data. This changes the agent's behavior across otherwise unrelated file-producing tasks. It also removes normal discretion to keep files local or ask for user authorization before external transmission. The signed URL subsequently printed by the script creates an additional disclosure channel because anyone who receives or observes that URL may access the object until it expires. ### Attack Path 1. The skill is loaded automatically because its metadata sets `always` to `true`. 2. A user asks the agent to create or process any file. 3. The file contains potentially sensitive or internal information. 4. The skill's mandatory instructions direct the agent to invoke `scripts/upload_to_ ...[truncated 744 chars]
• Remediation: ## Remediation Suggestions 1. Remove `"always": true` and activate the skill only when a user explicitly requests an external upload. 2. Replace mandatory and prohibitive instructions with an opt-in workflow. 3. Ask for explicit confirmation immediately before each upload, identifying the local file and destination bucket. 4. Add sensitivity checks that reject credentials, private keys, environment files, internal source archives, and files containing personal or regulated data unless the user gives informed authorization. 5. Provide a local-delivery or approved platform-native attachment option where available. 6. Display the destination hostname, bucket, object name, expiration period, and sharing implications before transmission. 7. Minimize signed URL lifetime and avoid printing URLs into logs or unrelated conversation contexts.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/upload_to_us3.py:27
• Finding: Unvalidated Configuration Permits Uploads to an Arbitrary Endpoint## Vulnerability Details **File Location**: `scripts/upload_to_us3.py:27-29`, `scripts/upload_to_us3.py:48-62`, and `scripts/upload_to_us3.py:108-110` **Vulnerability Type**: Unrestricted externally configured upload destination **Risk Level**: High ### Vulnerable Code ```python # Read from environment variables PUBLIC_KEY = os.environ.get("US3_PUBLIC_KEY") PRIVATE_KEY = os.environ.get("US3_PRIVATE_KEY") BUCKET = os.environ.get("US3_BUCKET") ``` ```python # Parse bucket configuration # BUCKET can be either: # - Full domain: "bucket-name.region.ufileos.com" # - Just bucket name: "bucket-name" (requires US3_ENDPOINT) if '.' in BUCKET: # Full domain format parts = BUCKET.split('.', 1) BUCKET_NAME = parts[0] ENDPOINT = parts[1] else: # Just bucket name BUCKET_NAME = BUCKET ENDPOINT = os.environ.get("US3_ENDPOINT", "cn-sh2.ufileos.com") # Set upload suffix to use the correct endpoint with dot separator config.set_default(uploadsuffix="." + ENDPOINT, downloadsuffix="." + ENDPOINT) ``` ```python handler = filemanager.FileManager(PUBLIC_KEY, PRIVATE_KEY) ret, resp = handler.putfile(BUCKET_NAME, remote_name, file_path, None) ``` ### Technical Analysis The script accepts the bucket and endpoint from environment variables and passes the derived endpoint directly into the SDK's global upload and download suffix configuration. It does not verify that the resulting hostname belongs to an approved UCloud domain, matches the intended account configuration, or excludes attacker-controlled hosts, IP literals, unexpected ports, or malformed values. If an attacker or compromised execution environment can alter `US3_BUCKET` or `US3_ENDPOINT`, the SDK can be directed toward an unintended network destination. The subsequent `putfile` operation sends the selected local file to that destination. Depending on the SDK's authentication protocol, requests may also expose the public-k ...[truncated 1399 chars]
• Remediation: ## Remediation Suggestions 1. Maintain a strict allowlist of approved UCloud endpoint hostnames. 2. Validate hostname boundaries rather than relying on substring matching; for example, require an exact approved endpoint or a correctly bounded subdomain of `ufileos.com`. 3. Reject IP literals, embedded credentials, URL schemes, paths, query strings, fragments, ports, whitespace, and control characters. 4. Do not infer an endpoint by splitting an arbitrary dotted bucket value. Store the bucket name and endpoint as separate, independently validated settings. 5. Pin the destination in trusted configuration that ordinary task input cannot modify. 6. Resolve and display the final hostname and bucket before upload, then require confirmation for sensitive files. 7. Apply outbound network restrictions so the uploader can connect only to approved UCloud addresses. 8. Use narrowly scoped storage credentials restricted to the required bucket and write operation, and rotate them if traffic may have reached an untrusted endpoint.

T08 · Insecure Dependencies

Error

• Location: scripts/upload_to_us3.py:18
• Finding: Runtime Installation of an Unpinned Third-Party Package## Vulnerability Details **File Location**: `scripts/upload_to_us3.py:18-23` **Vulnerability Type**: Unpinned runtime dependency installation **Risk Level**: High ### Vulnerable Code ```python try: from ufile import filemanager, config except ImportError: print("Installing ufile SDK...") os.system("pip3 install -q ufile") from ufile import filemanager, config ``` ### Technical Analysis If the `ufile` import fails, the script invokes `pip3` at runtime and installs whichever package version named `ufile` is selected by the active package index and pip configuration. The command provides no version constraint, cryptographic hash, trusted index restriction, provenance verification, or lock file. Python packages can execute code during installation and import. Consequently, compromise of the configured package index, dependency substitution, a malicious future release, or manipulation of pip configuration can turn a routine upload into arbitrary code execution. The installed package is then immediately imported and receives the US3 public and private keys when `FileManager` is constructed. Although the shell command is static and does not contain user-controlled interpolation, its supply-chain behavior remains unsafe. ### Attack Path 1. The legitimate `ufile` module is absent or its import is made to fail. 2. An attacker influences the active pip index, package resolution, network path, or a future package release. 3. The script executes `pip3 install -q ufile` without a version or hash. 4. Pip downloads and installs attacker-controlled package content. 5. Malicious installation hooks or module-level import code execute with the uploader process's operating-system privileges. 6. The malicious package reads environment variables, local files, or process data. 7. When `FileManager(PUBLIC_KEY, PRIVATE_KEY)` is called, the malicious implementation can directly capture both US3 credentials and uploade ...[truncated 464 chars]
• Remediation: ## Remediation Suggestions 1. Remove all package installation behavior from runtime application code. 2. Declare the SDK in a controlled dependency manifest and pin it to an exact, reviewed version. 3. Use a lock file with verified cryptographic hashes, such as pip's `--require-hashes` workflow. 4. Install dependencies during a trusted build or provisioning stage rather than when handling user files. 5. Restrict installations to an authenticated, approved package repository or internal mirror. 6. Generate and review a software bill of materials and monitor the pinned dependency for known vulnerabilities. 7. If the dependency is unavailable at runtime, fail safely with an installation instruction instead of invoking pip automatically. 8. Run the uploader under a minimally privileged account and provide bucket-scoped, short-lived credentials where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (10)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

from ufile import filemanager, config
except ImportError:
    print("Installing ufile SDK...")
    os.system("pip3 install -q ufile")
    from ufile import filemanager, config

# Read from environment variables

• Confidence: 95% confidence
• Finding: The script invokes a shell command to install a package at runtime with os.system("pip3 install -q ufile"), which introduces supply-chain and execution risk. In an agent skill that handles file uploads and has access to storage credentials, dynamic package installation expands the trust boundary to the network and shell environment, allowing package substitution, PATH hijacking, or unintended command execution in a sensitive context.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes shell commands, reads environment variables, and performs network uploads, but it does not declare any explicit tool scope or permission boundaries. In an always-on skill that is mandated for any file output, this creates excessive implicit authority and makes unintended data exfiltration or misuse of credentials more likely.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation text is extremely broad and says the skill must be used for essentially any task involving file creation, sharing, export, or sending. Combined with the always-on metadata and mandatory upload language, this can cause over-triggering and external upload of sensitive or unnecessary files, increasing exfiltration risk beyond user expectations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The usage instructions normalize automatic upload of generated files to third-party object storage and direct sharing of signed URLs, but provide no step to verify user consent, data sensitivity, or whether the file contains secrets or personal data. In an agent context, this creates a real exfiltration risk because sandbox files are explicitly inaccessible unless uploaded, making the skill a built-in mechanism for transferring potentially sensitive outputs outside the execution environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The AI guidance explicitly instructs the agent to upload a file and send the resulting link to the user as a default workflow, without any caution about sensitive content, destination trust, or confirmation that external sharing is appropriate. Because this is operational guidance for agent behavior, it materially increases the likelihood of unreviewed disclosure of confidential outputs, especially when the skill is mandated for 'any file output' scenarios.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

chmod +x filemgr

# Move to PATH (optional)
sudo mv filemgr /usr/local/bin/filemgr
```

**Verify installation:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Installing dependencies during execution is not necessary for the stated purpose of uploading a file and generating a link, and it creates a network-enabled supply-chain path at runtime. Because this skill also consumes secret environment variables for US3 access, any compromise of the installed package or install path could lead to credential exposure or unauthorized object-store operations.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The instructions direct users to specific console items using Chinese labels such as 'API 密钥' and '对象存储 US3' without indicating that these names may vary by locale or offering an alternative language path. This can amount to a locale-specific requirement without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The skill content and the sample user-facing response are exclusively in Chinese, which may effectively force a specific language without user opt-in. Under the language/locale policy, this should be documented as optional or accompanied by a user language choice unless the locale restriction is justified.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This code includes a user-facing message in Chinese ("下载链接（7天内有效）") without offering a language or locale option. That can violate a language/locale policy when the skill forces a specific language without user opt-in.

Static analysis

No suspicious patterns detected.