Architecture Inventory & Risk Assessment

Key points to consider before installing or running this skill: - The skill legitimately needs Tencent Cloud AK/SK to call the Advisor APIs, but do NOT paste your long‑lived SecretKey into shell startup files unless you understand and accept the risk. Prefer using short‑lived STS credentials or a dedicated minimal‑scope API key. - The skill includes scripts that can create and delete CAM roles and attach policies. The SKILL.md says role creation requires explicit consent — before consenting, open and review scripts/create_role.py and scripts/setup_role.py to confirm exactly which policies/trust relationships will be created. - There are contradictory statements about policy scope (some text says 'read‑only', other sections list 'FullAccess' policies and QcloudTAGFullAccess). Confirm which exact managed policies will be attached; avoid granting more than necessary. - The repository includes extra tooling (publish/start_publish.sh, PUBLISH_GUIDE.md, batch publish helpers) unrelated to inventory/risk assessment. These scripts may reference publishing tokens (CLAWHUB_TOKEN) or automate mass publishing; treat those as separate tools and do not run them unless you intend to use them and have audited them. - Version check calls out to a clawhub CLI (subprocess). If you run check_env.py, it may attempt to call local 'clawhub' to inspect the registry; this is benign if clawhub is trusted, but you can run check_env.py with --skip-update to avoid remote/CLI interactions. - If you plan to proceed: (1) audit create_role.py and tcloud_api.py to verify no unexpected network endpoints; (2) prefer to set credentials in a temporary session (export in shell only in a session) or use STS temporary credentials (TENCENTCLOUD_TOKEN) rather than writing permanent exports to ~/.bashrc; (3) run check_env.py with --quiet/--skip-update in an isolated environment first; (4) after testing, delete any created role and rotate or revoke any keys you provided. What would change this assessment: seeing that create_role.py only creates a narrowly scoped, read‑only role (and documentation/policy names are corrected), and explicit removal of instructions to persist long‑lived AK/SK in shell RC files would raise confidence to 'benign'. Conversely, discovery that any script uploads secrets to non‑Tencent endpoints, hardcodes external upload URLs, or silently exfiltrates data would make this clearly malicious.