Security audit

Tencent COS

Security checks for vulnerabilities and agentic risk

Overview

This Tencent Cloud storage skill mostly matches its stated purpose, but it needs Review because it handles powerful cloud credentials with weak local secret protection and can send authenticated SDK requests to unvalidated custom endpoints.

Install only after reviewing the cloud permissions you will grant. Prefer short-lived STS credentials or a least-privilege Tencent sub-account, avoid persisting long-lived keys in .env or .env.enc, leave KIKI=1 enabled when you do not need deletion or local credential management, and do not set custom COS Domain, ServiceDomain, or Protocol values unless you fully trust and verify the endpoint.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/ci_client.mjs:83
Finding: Predictable Key Used to Encrypt Persisted Cloud Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/cos_node.mjs:97
Finding: Custom SDK Endpoints Can Redirect Authenticated Requests
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package.json:10
Finding: Unpinned Dependency Installation Produces Non-Reproducible Builds
Content: View full analysis
&1 | tail -3) ok "项目依赖安装完成" ``` ### Technical Analysis The caret range permits installation of later compatible releases rather than the exact version reviewed during the audit. No lockfile was present in the audited project structure, and setup invokes `npm install` rather than a frozen installation command. As a result, two installations of the same Skill can receive different direct or transitive dependency code. A compromised registry account, malicious transitive update, or unsafe future release could execute with the privileges of the user running setup. npm lifecycle scripts may also execute during installation unless separately disabled. This is a supply-chain hardening deficiency. No evidence was found that the currently declared package is malicious. ### Attack Path 1. A malicious or compromised version is published within the accepted semantic-version range, or a transitive dependency is compromised. 2. The user runs `scripts/setup.sh --from-env`. 3. The setup script invokes `npm install` without a committed lockfile. 4. npm resolves and downloads the changed package graph. 5. Malicious package code may execute through lifecycle hooks during installation or when the Skill imports the COS SDK. 6. The code runs under the setup user’s account and can access environment variables, local files, persisted cloud credentials, and network resources available to that process. ### Impact Assessment Exploitation could provide arbitrary code execution with the operating-system privileges of the user running setup. Because setup is commonly exec ...[truncated 311 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (103)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 1)May include surrounding context.
text
.env .env.enc .env.enc.bak

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented primarily as a COS/CI operations helper, but it also instructs the agent to persist cloud credentials locally, modify .gitignore, run setup/bootstrap scripts, and install npm dependencies. This mismatch is dangerous because users may consent to file storage actions without realizing the skill also performs sensitive local environment changes and secret handling.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
- `scripts/cos_node.mjs`：COS 存储、写操作、处理作业和通用 CI 能力。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
- `scripts/cos_node.mjs`：COS 存储、写操作、处理作业和通用 CI 能力。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
md
- `scripts/cos_node.mjs`：COS 存储、写操作、处理作业和通用 CI 能力。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.
md
- `scripts/cos_node.mjs`：COS 存储、写操作、处理作业和通用 CI 能力。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 618)May include surrounding context.
md
- `scripts/cos_node.mjs`：COS 存储、写操作、处理作业和通用 CI 能力。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 711)May include surrounding context.
md
- `scripts/cos_node.mjs`：COS 存储、写操作、处理作业和通用 CI 能力。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 957)May include surrounding context.
md
- `scripts/cos_node.mjs`：COS 存储、写操作、处理作业和通用 CI 能力。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1020)May include surrounding context.
md
- `scripts/cos_node.mjs`：COS 存储、写操作、处理作业和通用 CI 能力。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.
md
- `scripts/preview_gen.mjs`：检索结果的本地批量签名与 HTML 预览生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.
md
- `scripts/preview_gen.mjs`：检索结果的本地批量签名与 HTML 预览生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
除了入口拦截，`scripts/lib/ci_client.mjs` 的 `cosRequest` 与 `scripts/cos_node.mjs` 的 `cosRequestPromise` 会在请求层再次拒绝 DELETE 请求，双重兜底避免绕过。需要调整隐藏列表时，修改其中的 `STRICT_HIDDEN_ACT

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The skill explicitly supports persisting cloud credentials into a local .env file and automatic reuse later. Storing long-lived SecretId/SecretKey material in project files materially increases the risk of accidental disclosure through local compromise, backups, editor tooling, misconfigured permissions, or downstream automation.
Content: Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.
默认模式：凭证仅存于当前 session，关闭终端后需重新 export

{baseDir}/scripts/setup.sh --from-env

持久化模式：凭证写入项目本地 .env 文件，下次自动读取

{baseDir}/scripts/setup.sh --from-env --persist

text

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The documented support for encrypting and decrypting .env files confirms that the skill manages raw credential material locally and can restore it to plaintext on demand. Even with encryption at rest, embedding secret-management flows inside a broad cloud-operations skill expands exposure and makes credential access a first-class capability available to the agent.
Content: Scanner excerpt · SKILL.md (reported line 923)May include surrounding context.
md
| | `upload` → 指向知识库桶 | "上传到知识库" → 上传文档 | | | `hybrid-search` → 指向知识库数据集 | "查询知识库" → 语义检索文档内容 | | **🚫 禁止** | ~~deleteBucket~~ | **不允许删除/清空存储桶** | | **🔐 凭证管理** | `encrypt-env` | 加密 .env → .env.enc 并删除明文 | | | `decrypt-env` | 解密 .env.enc → .env 还原明文 | ## 安全注意事项

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The ability to decrypt .env.enc back to plaintext .env creates an explicit path from protected-at-rest secrets to readable local files during normal skill use. This undermines the claimed safety of local encryption because any agent with skill access can potentially materialize secrets on disk where other processes or users may access them.
Content: Scanner excerpt · SKILL.md (reported line 924)May include surrounding context.
md
| | `hybrid-search` → 指向知识库数据集 | "查询知识库" → 语义检索文档内容 | | **🚫 禁止** | ~~deleteBucket~~ | **不允许删除/清空存储桶** | | **🔐 凭证管理** | `encrypt-env` | 加密 .env → .env.enc 并删除明文 | | | `decrypt-env` | 解密 .env.enc → .env 还原明文 | ## 安全注意事项

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The encryption design derives the key from predictable local attributes such as hostname, username, and project path, which are not high-entropy secrets. If an attacker can learn or guess those values on the same machine or environment, the protection may be weak, and the presence of a documented decrypt path further increases the chance of credential recovery.
Content: Scanner excerpt · SKILL.md (reported line 958)May include surrounding context.
md
- 密钥派生：`SHA-256(hostname + username + 项目绝对路径)` - **加密文件绑定当前机器和用户**，拷贝到其他机器/用户无法解密 - 如需还原明文：`node scripts/cos_node.mjs decrypt-env` - 清理凭证：`rm -f .env .env.enc` **其他安全要求**： - **永远不要在对话中回显** SecretId/SecretKey

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api_reference.md (reported line 159)May include surrounding context.
md
| 服务 | 开通 action | 请求 | 关闭 action | 请求 | | --- | --- | --- | --- | --- | | 数据万象绑定 | `create-ci-bucket` | `PUT /`，CAM `ci:CreateCIBucket` | `delete-ci-bucket` | `PUT /?unbind`，CAM `ci:DeleteCIBucket` | | 文档处理 | `create-doc-process-bucket` | `POST /docbucket`，CAM `ci:CreateDocProcessBucket` | `delete-doc-process-bucket` | `DELETE /docbucket`，CAM `ci:DeleteDocProcessBucket` | | 媒体处理 | `create-media-bucket` | `POST /mediabucket`，CAM `ci:CreateMediaBucket` | `delete-media-bucket` | `DELETE /mediabucket`，CAM `ci:DeleteMediaBucket` | | 智能语音 | `create-asr-bucket` | `POST /asrbucket`，CAM `ci:CreateAsrBucket` | `delete-asr-bucket` | `DELETE /asrbucket`，CAM `ci:DeleteAsrBucket` | | 文件处理 | `create-file-process-bucket` | `POST /file_bucket`，CAM `ci:CreateFileProcessBucket` | `delete-file-process-bucket` | `DELETE /file_bucket`，CAM `ci:DeleteFileProcessBucket` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api_reference.md (reported line 159)May include surrounding context.
md
| 服务 | 开通 action | 请求 | 关闭 action | 请求 | | --- | --- | --- | --- | --- | | 数据万象绑定 | `create-ci-bucket` | `PUT /`,CAM `ci:CreateCIBucket` | `delete-ci-bucket` | `PUT /?unbind`,CAM `ci:DeleteCIBucket` | | 文档处理 | `create-doc-process-bucket` | `POST /docbucket`,CAM `ci:CreateDocProcessBucket` | `delete-doc-process-bucket` | `DELETE /docbucket`,CAM `ci:DeleteDocProcessBucket` | | 媒体处理 | `create-media-bucket` | `POST /mediabucket`,CAM `ci:CreateMediaBucket` | `delete-media-bucket` | `DELETE /mediabucket`,CAM `ci:DeleteMediaBucket` | | 智能语音 | `create-asr-bucket` | `POST /asrbucket`,CAM `ci:CreateAsrBucket` | `delete-asr-bucket` | `DELETE /asrbucket`,CAM `ci:DeleteAsrBucket` | | 文件处理 | `create-file-process-bucket` | `POST /file_bucket`,CAM `ci:CreateFileProcessBucket` | `delete-file-process-bucket` | `DELETE /file_bucket`,CAM `ci:DeleteFileProcessBucket` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api_reference.md (reported line 160)May include surrounding context.
md
| --- | --- | --- | --- | --- | | 数据万象绑定 | `create-ci-bucket` | `PUT /`，CAM `ci:CreateCIBucket` | `delete-ci-bucket` | `PUT /?unbind`，CAM `ci:DeleteCIBucket` | | 文档处理 | `create-doc-process-bucket` | `POST /docbucket`，CAM `ci:CreateDocProcessBucket` | `delete-doc-process-bucket` | `DELETE /docbucket`，CAM `ci:DeleteDocProcessBucket` | | 媒体处理 | `create-media-bucket` | `POST /mediabucket`，CAM `ci:CreateMediaBucket` | `delete-media-bucket` | `DELETE /mediabucket`，CAM `ci:DeleteMediaBucket` | | 智能语音 | `create-asr-bucket` | `POST /asrbucket`，CAM `ci:CreateAsrBucket` | `delete-asr-bucket` | `DELETE /asrbucket`，CAM `ci:DeleteAsrBucket` | | 文件处理 | `create-file-process-bucket` | `POST /file_bucket`，CAM `ci:CreateFileProcessBucket` | `delete-file-process-bucket` | `DELETE /file_bucket`，CAM `ci:DeleteFileProcessBucket` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api_reference.md (reported line 160)May include surrounding context.
md
| --- | --- | --- | --- | --- | | 数据万象绑定 | `create-ci-bucket` | `PUT /`,CAM `ci:CreateCIBucket` | `delete-ci-bucket` | `PUT /?unbind`,CAM `ci:DeleteCIBucket` | | 文档处理 | `create-doc-process-bucket` | `POST /docbucket`,CAM `ci:CreateDocProcessBucket` | `delete-doc-process-bucket` | `DELETE /docbucket`,CAM `ci:DeleteDocProcessBucket` | | 媒体处理 | `create-media-bucket` | `POST /mediabucket`,CAM `ci:CreateMediaBucket` | `delete-media-bucket` | `DELETE /mediabucket`,CAM `ci:DeleteMediaBucket` | | 智能语音 | `create-asr-bucket` | `POST /asrbucket`,CAM `ci:CreateAsrBucket` | `delete-asr-bucket` | `DELETE /asrbucket`,CAM `ci:DeleteAsrBucket` | | 文件处理 | `create-file-process-bucket` | `POST /file_bucket`,CAM `ci:CreateFileProcessBucket` | `delete-file-process-bucket` | `DELETE /file_bucket`,CAM `ci:DeleteFileProcessBucket` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api_reference.md (reported line 161)May include surrounding context.
md
| 数据万象绑定 | `create-ci-bucket` | `PUT /`，CAM `ci:CreateCIBucket` | `delete-ci-bucket` | `PUT /?unbind`，CAM `ci:DeleteCIBucket` | | 文档处理 | `create-doc-process-bucket` | `POST /docbucket`，CAM `ci:CreateDocProcessBucket` | `delete-doc-process-bucket` | `DELETE /docbucket`，CAM `ci:DeleteDocProcessBucket` | | 媒体处理 | `create-media-bucket` | `POST /mediabucket`，CAM `ci:CreateMediaBucket` | `delete-media-bucket` | `DELETE /mediabucket`，CAM `ci:DeleteMediaBucket` | | 智能语音 | `create-asr-bucket` | `POST /asrbucket`，CAM `ci:CreateAsrBucket` | `delete-asr-bucket` | `DELETE /asrbucket`，CAM `ci:DeleteAsrBucket` | | 文件处理 | `create-file-process-bucket` | `POST /file_bucket`，CAM `ci:CreateFileProcessBucket` | `delete-file-process-bucket` | `DELETE /file_bucket`，CAM `ci:DeleteFileProcessBucket` | 请求域名均为 `https://<bucket>.ci.<region>.myqcloud.com`。所有 `delete-*` action 在严格模式下隐藏并拒绝执行；其中 `delete-ci-bucket` 虽使用 `PUT`，仍按解绑删除语义保护。

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api_reference.md (reported line 161)May include surrounding context.
md
| 数据万象绑定 | `create-ci-bucket` | `PUT /`,CAM `ci:CreateCIBucket` | `delete-ci-bucket` | `PUT /?unbind`,CAM `ci:DeleteCIBucket` | | 文档处理 | `create-doc-process-bucket` | `POST /docbucket`,CAM `ci:CreateDocProcessBucket` | `delete-doc-process-bucket` | `DELETE /docbucket`,CAM `ci:DeleteDocProcessBucket` | | 媒体处理 | `create-media-bucket` | `POST /mediabucket`,CAM `ci:CreateMediaBucket` | `delete-media-bucket` | `DELETE /mediabucket`,CAM `ci:DeleteMediaBucket` | | 智能语音 | `create-asr-bucket` | `POST /asrbucket`,CAM `ci:CreateAsrBucket` | `delete-asr-bucket` | `DELETE /asrbucket`,CAM `ci:DeleteAsrBucket` | | 文件处理 | `create-file-process-bucket` | `POST /file_bucket`,CAM `ci:CreateFileProcessBucket` | `delete-file-process-bucket` | `DELETE /file_bucket`,CAM `ci:DeleteFileProcessBucket` | 请求域名均为 `https://<bucket>.ci.<region>.myqcloud.com`。所有 `delete-*` action 在严格模式下隐藏并拒绝执行;其中 `delete-ci-bucket` 虽使用 `PUT`,仍按解绑删除语义保护。

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api_reference.md (reported line 162)May include surrounding context.
md
| 文档处理 | `create-doc-process-bucket` | `POST /docbucket`，CAM `ci:CreateDocProcessBucket` | `delete-doc-process-bucket` | `DELETE /docbucket`，CAM `ci:DeleteDocProcessBucket` | | 媒体处理 | `create-media-bucket` | `POST /mediabucket`，CAM `ci:CreateMediaBucket` | `delete-media-bucket` | `DELETE /mediabucket`，CAM `ci:DeleteMediaBucket` | | 智能语音 | `create-asr-bucket` | `POST /asrbucket`，CAM `ci:CreateAsrBucket` | `delete-asr-bucket` | `DELETE /asrbucket`，CAM `ci:DeleteAsrBucket` | | 文件处理 | `create-file-process-bucket` | `POST /file_bucket`，CAM `ci:CreateFileProcessBucket` | `delete-file-process-bucket` | `DELETE /file_bucket`，CAM `ci:DeleteFileProcessBucket` | 请求域名均为 `https://<bucket>.ci.<region>.myqcloud.com`。所有 `delete-*` action 在严格模式下隐藏并拒绝执行；其中 `delete-ci-bucket` 虽使用 `PUT`，仍按解绑删除语义保护。

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api_reference.md (reported line 162)May include surrounding context.
md
| 文档处理 | `create-doc-process-bucket` | `POST /docbucket`,CAM `ci:CreateDocProcessBucket` | `delete-doc-process-bucket` | `DELETE /docbucket`,CAM `ci:DeleteDocProcessBucket` | | 媒体处理 | `create-media-bucket` | `POST /mediabucket`,CAM `ci:CreateMediaBucket` | `delete-media-bucket` | `DELETE /mediabucket`,CAM `ci:DeleteMediaBucket` | | 智能语音 | `create-asr-bucket` | `POST /asrbucket`,CAM `ci:CreateAsrBucket` | `delete-asr-bucket` | `DELETE /asrbucket`,CAM `ci:DeleteAsrBucket` | | 文件处理 | `create-file-process-bucket` | `POST /file_bucket`,CAM `ci:CreateFileProcessBucket` | `delete-file-process-bucket` | `DELETE /file_bucket`,CAM `ci:DeleteFileProcessBucket` | 请求域名均为 `https://<bucket>.ci.<region>.myqcloud.com`。所有 `delete-*` action 在严格模式下隐藏并拒绝执行;其中 `delete-ci-bucket` 虽使用 `PUT`,仍按解绑删除语义保护。

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/ci_client.mjs:42

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

Tp4

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Credential Access

默认模式：凭证仅存于当前 session，关闭终端后需重新 export

持久化模式：凭证写入项目本地 .env 文件，下次自动读取

Credential Access

Credential Access

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Static analysis

Environment variable access combined with network send.