ClawHub
Back to skill

Security audit

Tencent COS

Security checks across malware telemetry and agentic risk

Overview

This Tencent Cloud skill is coherent, but it gives an agent broad cloud authority with weak guardrails around deletion, raw API calls, broad activation, and credential persistence.

Install only if you intentionally want Tencent COS/CI access through this skill. Use a least-privilege Tencent sub-account or temporary STS credentials, avoid root or broad permanent keys, do not persist secrets unless necessary, and manually confirm provider, bucket, file paths, signed-link expiry, knowledge-base indexing, ci-request calls, and any delete or bulk-delete action before allowing the agent to run them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly instructs execution of shell commands (`setup.sh`, `node`, `export`, `rm`) and local package installation, yet the metadata does not declare shell/code execution permissions. This creates a capability transparency gap: users or orchestrators may authorize a cloud-storage skill without realizing it will also execute local commands that modify the environment and filesystem.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The advertised purpose is Tencent Cloud storage/CI operations, but the documented behavior also includes dependency installation, credential persistence to `.env`, encryption/decryption of secrets, `.gitignore` modification, and environment checks. This mismatch is dangerous because it broadens the trusted behavior of the skill beyond user-visible expectations, increasing the chance of unintended local state changes and secret handling.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
文档公开了一个通用 `ci-request` 入口，可对 CI API 发起任意方法、路径、请求体和查询参数的调用，等于绕过了前面按功能封装的最小权限操作边界。对于一个面向代理调用的技能，这会显著扩大可执行面，可能被用于访问未审计的高风险接口、处理敏感数据或触发意外的数据修改/外传。

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The generic `ci-request` entry point lets callers invoke essentially arbitrary CI API paths and methods, which expands the skill far beyond its declared, reviewed feature set. In an agent context, this becomes a dangerous capability-escalation primitive: a prompt can steer the skill into unreviewed write, delete, or admin-style operations against cloud resources using the configured credentials.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The code comment claims deletion and bucket emptying are forbidden, but the enforcement only blocks `deleteBucket` and still exposes single and bulk object deletion. This mismatch creates a false sense of safety for downstream agents or reviewers, increasing the chance that destructive operations are invoked under the assumption they were prohibited.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger list includes broad everyday phrases like '把文件传到云上', '生成下载链接', and knowledge-base related requests, which can cause the skill to activate for ambiguous user intents. In this skill, mis-triggering is more dangerous than usual because activation can lead to credential solicitation, shell setup steps, cloud uploads, and indexing of user content.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The knowledge-base upload flow tells the operator to upload files and notes that indexing will occur, but it does not require an explicit user confirmation that documents will be transmitted to Tencent Cloud and processed for search/indexing. This can expose sensitive documents or regulated data to third-party cloud storage and retrieval pipelines without sufficiently informed consent.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
文档列出了上传、下载、删除、签名 URL 等会产生真实副作用或数据传输的操作，但没有要求显式用户确认、说明覆盖/删除风险、也未提示签名链接可能造成数据分享暴露。对代理型技能而言，这类缺失会增加误操作、越权分享和敏感数据出云的风险。

Missing User Warnings

High
Confidence
97% confidence
Finding
通用 `ci-request` 不仅允许任意 API 调用，还支持自定义 body、content-type 和 query，文档却未警告可能涉及内容审核、文件处理、任务查询等敏感数据处理与网络发送场景。这在技能上下文中更危险，因为该技能本身覆盖存储、媒体、知识库和审核等多种高敏感业务，任意请求入口可能被用来扩大访问范围并处理用户未预期的数据。

Missing User Warnings

Medium
Confidence
93% confidence
Finding
`deleteObject` performs irreversible deletion immediately based only on a provided key, with no confirmation, preview, or secondary approval. In an agent-driven workflow, prompt mistakes or malicious instructions could cause unintended data loss using the skill's cloud privileges.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
`deleteMultipleObjects` enables bulk irreversible deletion from a JSON-supplied key list without any warning or confirmation step. Because it can remove many objects in one call, a prompt injection or operator mistake could rapidly empty large portions of a bucket.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
`decrypt-env` restores secrets from `.env.enc` into a plaintext `.env` file on disk without an upfront warning or stronger guardrail. That increases the exposure window for cloud credentials to local compromise, accidental commits, backups, or misuse by other tools on the host.

Credential Access

High
Category
Privilege Escalation
Content
| | `upload` → 指向知识库桶 | "上传到知识库" → 上传文档 |
| | `hybrid-search` → 指向知识库数据集 | "查询知识库" → 语义检索文档内容 |
| **🚫 禁止** | ~~deleteBucket~~ | **不允许删除/清空存储桶** |
| **🔐 凭证管理** | `encrypt-env` | 加密 .env → .env.enc 并删除明文 |
| | `decrypt-env` | 解密 .env.enc → .env 还原明文 |

## 安全注意事项
Confidence
94% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
| | `hybrid-search` → 指向知识库数据集 | "查询知识库" → 语义检索文档内容 |
| **🚫 禁止** | ~~deleteBucket~~ | **不允许删除/清空存储桶** |
| **🔐 凭证管理** | `encrypt-env` | 加密 .env → .env.enc 并删除明文 |
| | `decrypt-env` | 解密 .env.enc → .env 还原明文 |

## 安全注意事项
Confidence
94% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
- 密钥派生：`SHA-256(hostname + username + 项目绝对路径)`
- **加密文件绑定当前机器和用户**，拷贝到其他机器/用户无法解密
- 如需还原明文：`node scripts/cos_node.mjs decrypt-env`
- 清理凭证：`rm -f .env .env.enc`

**其他安全要求**：
- **永远不要在对话中回显** SecretId/SecretKey
Confidence
96% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
[ -n "$TENCENT_COS_PROTOCOL" ] && echo "TENCENT_COS_PROTOCOL='$TENCENT_COS_PROTOCOL'"
  } > "$ENV_FILE"
  chmod 600 "$ENV_FILE"
  ok ".env 文件已写入（权限 600）"

  # 确保 .gitignore 包含 .env
  local GITIGNORE="$BASE_DIR/.gitignore"
Confidence
93% confidence
Finding
.env

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.