Tencent Cloud COS

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:44 AM UTC
• Version: 1.1.6

Overview

The skill appears intended for Tencent Cloud storage work, but it exposes high-impact cloud and credential operations with weak scoping and limited safeguards.

Install only if you specifically need Tencent COS/CI automation and are comfortable granting it access to your Tencent Cloud resources. Use short-lived or least-privilege credentials, avoid plaintext .env persistence, review any delete or ci-request action before running it, and do not use it for broad knowledge-base or cloud-storage requests unless Tencent Cloud is explicitly intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to run shell commands (`setup.sh`, `node`, `export`, npm-backed installation) but does not declare shell permission. This creates a capability transparency problem: reviewers and runtime policy may underestimate the skill's ability to modify the local environment, install packages, and access secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The public description emphasizes Tencent Cloud storage/CI features, but the documented behavior also includes local environment inspection, npm installation, credential persistence in `.env`, `.gitignore` modification, and connectivity verification. This mismatch can mislead users and reviewers about the skill's local system impact and secret-handling behavior, increasing the chance of unsafe execution with sensitive credentials.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The document claims credentials are ephemeral by default, but in the same setup flow it encourages optional persistence to a local `.env` and later auto-loading from disk. Conflicting security guarantees can cause operators to believe secrets are memory-only when they may actually remain recoverable on disk, leading to accidental exposure on shared hosts or backups.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The skill states that bucket deletion and bucket-emptying are prohibited, yet it also exposes a generic `ci-request` endpoint for arbitrary CI API calls. Broad escape hatches weaken the credibility of stated restrictions because users and reviewers cannot rely on the documented guardrails if undeclared or future endpoints can bypass them.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The generic `ci-request` action allows callers to invoke arbitrary CI API paths and methods, effectively bypassing the skill's intended action-level safety boundaries. In a skill context, this becomes dangerous because any upstream agent or prompt that can trigger the skill can reach undocumented or more sensitive CI capabilities, including destructive or privacy-impacting operations not explicitly reviewed.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The code advertises that bucket deletion and emptying are forbidden, but still exposes `delete-multiple`, which can be used iteratively to empty a bucket's contents. This mismatch creates a false sense of safety and enables destructive data loss despite the stated safeguard.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger phrases are extremely broad and include generic cloud-storage and credential-protection requests, making the skill likely to activate in situations where the user did not specifically intend Tencent COS operations. Over-triggering is dangerous here because activation can lead to credential collection prompts, local setup commands, package installation, and cloud-side actions with billing and data exposure consequences.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The knowledge-base trigger language is ambiguous ('build a knowledge base', 'search the knowledge base') without scoping to a specific provider, dataset, or prior setup state. This can cause unintended activation of a skill that uploads user files, creates buckets/datasets, and runs retrieval workflows against a paid cloud service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The generic ci-request entrypoint allows arbitrary method, path, query, and body data to be sent to remote Tencent CI APIs, effectively exposing a raw exfiltration and data-submission channel. In an agent skill context, this is more dangerous because user-provided or model-derived content could be forwarded off-platform, including sensitive documents, moderation content, or credentials embedded in request bodies, without clear warnings or guardrails.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: `encrypt-env` and `decrypt-env` directly rewrite, create, and delete local credential files without any confirmation prompt or explicit warning at the action entry point. In an agent skill, this can unexpectedly alter credential state, expose plaintext secrets onto disk, or destroy the only plaintext copy, causing both secrecy and availability issues.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Single-object deletion is performed immediately when `delete` is invoked, with no confirmation, dry-run, or user-facing warning. In a tool callable by an agent, this increases the risk of accidental or prompt-induced destructive actions against cloud-stored data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Bulk deletion accepts an arbitrary JSON list of keys and deletes them without confirmation or guardrails, making mass data loss easy if the action is triggered incorrectly or maliciously. Because this skill is designed for natural-language triggering, the absence of friction materially raises the blast radius of mistakes.

Credential Access

High

• Category: Privilege Escalation

Content

| | `upload` → 指向知识库桶 | "上传到知识库" → 上传文档 |
| | `hybrid-search` → 指向知识库数据集 | "查询知识库" → 语义检索文档内容 |
| **🚫 禁止** | ~~deleteBucket~~ | **不允许删除/清空存储桶** |
| **🔐 凭证管理** | `encrypt-env` | 加密 .env → .env.enc 并删除明文 |
| | `decrypt-env` | 解密 .env.enc → .env 还原明文 |

## 安全注意事项

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

| | `hybrid-search` → 指向知识库数据集 | "查询知识库" → 语义检索文档内容 |
| **🚫 禁止** | ~~deleteBucket~~ | **不允许删除/清空存储桶** |
| **🔐 凭证管理** | `encrypt-env` | 加密 .env → .env.enc 并删除明文 |
| | `decrypt-env` | 解密 .env.enc → .env 还原明文 |

## 安全注意事项

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

- 密钥派生：`SHA-256(hostname + username + 项目绝对路径)`
- **加密文件绑定当前机器和用户**，拷贝到其他机器/用户无法解密
- 如需还原明文：`node scripts/cos_node.mjs decrypt-env`
- 清理凭证：`rm -f .env .env.enc`

**其他安全要求**：
- **永远不要在对话中回显** SecretId/SecretKey

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

const encBuffer = encryptEnv(plaintext);
  writeFileSync(envEncPath, encBuffer);
  chmodSync(envEncPath, 0o600);
  // 删除明文 .env
  unlinkSync(envPath);

  // 确保 .gitignore 包含 .env.enc

• Confidence: 84% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

output({
    success: true,
    action: 'decrypt-env',
    message: '凭证已解密还原为 .env 文件（权限 600）。加密文件 .env.enc 保留。',
    envFile: envPath,
    note: '如需删除加密文件：rm -f .env.enc',
  });

• Confidence: 87% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

#
# 安全默认行为:
#   - 默认凭证仅存于当前 shell session 环境变量，不写入磁盘
#   - --persist 将凭证写入项目本地 .env 文件（权限 600），下次脚本自动读取
#   - npm 包安装到项目本地 node_modules/，不使用全局安装

set -e

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

[ -n "$TENCENT_COS_PROTOCOL" ] && echo "TENCENT_COS_PROTOCOL='$TENCENT_COS_PROTOCOL'"
  } > "$ENV_FILE"
  chmod 600 "$ENV_FILE"
  ok ".env 文件已写入（权限 600）"

  # 确保 .gitignore 包含 .env
  local GITIGNORE="$BASE_DIR/.gitignore"

• Confidence: 98% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

# 4. 持久化凭证（如果指定 --persist）
  echo ""
  if $PERSIST; then
    echo "--- 步骤 4: 持久化凭证到 .env ---"
    write_env_file
  else
    echo "--- 步骤 4: 凭证模式 ---"

• Confidence: 91% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

echo ""
  if $PERSIST; then
    info "凭证已持久化到 $ENV_FILE，下次运行脚本自动读取"
    warn "⚠️ .env 文件包含明文敏感凭证，建议加密："
    info "  node $BASE_DIR/scripts/cos_node.mjs encrypt-env"
    info "清理凭证：rm -f $ENV_FILE $BASE_DIR/.env.enc"
  else

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

echo "    从已有环境变量读取凭证并安装依赖（默认不持久化）"
    echo ""
    echo "  $0 --from-env --persist"
    echo "    从已有环境变量读取凭证 + 写入项目本地 .env 文件（权限 600）"
    echo "    下次运行脚本时自动从 .env 读取凭证，无需重新 export"
    echo ""
    echo "安全默认行为："

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

echo ""
    echo "  $0 --from-env --persist"
    echo "    从已有环境变量读取凭证 + 写入项目本地 .env 文件（权限 600）"
    echo "    下次运行脚本时自动从 .env 读取凭证，无需重新 export"
    echo ""
    echo "安全默认行为："
    echo "  • 默认凭证不写入磁盘，仅存于当前 session 环境变量"

• Confidence: 90% confidence
• Finding: .env

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.