Cloud Architecture Discovery

• Analyzed: May 10, 2026, 6:39 AM
• Findings: 1
• Version: 1.4.0
• Hash: 3f965fb746d531846a7a86a1c2ba2b8da9ba7b0735a005cea89ca26ae8233a64
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains instructions and scripts that perform high-risk operations, most notably directing the AI agent in `SKILL.md` to permanently write Tencent Cloud credentials (SecretId/SecretKey) in plaintext to the user's shell configuration files (~/.bashrc, ~/.zshrc). While intended for convenience, this creates a persistent security vulnerability. Additionally, `scripts/create_role.py` performs IAM write operations to create CAM roles and attach policies, and `check_env.py` executes external shell commands (`clawhub`) for version checking. Although these behaviors are documented and aligned with the stated purpose of cloud architecture management, the practice of plaintext secret persistence and IAM manipulation via an AI agent is inherently risky.