Architecture Dashboard & Risk Review

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:53 AM UTC
• Version: 1.4.0

Overview

This skill is related to Tencent Cloud Advisor, but it asks for powerful cloud access and includes under-scoped behaviors that should be reviewed before installation.

Review this skill carefully before installing. Use only narrowly scoped Tencent Cloud credentials, avoid writing long-lived AK/SK values into shell startup files, and do not run role creation or cleanup unless you understand the exact CAM permissions and deletion behavior. The generic API client and TLS fallback should be fixed before use in sensitive environments.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:44

Finding

TLS Certificate Verification Is Silently Disabled

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:172

Finding

Generic API Client Sends Cloud Authentication Material to Arbitrary Hosts

Content

View full analysis

[payload] [region]" ))) sys.exit(1) service = args[0] host = args[1] action = args[2] version = args[3] payload_str = args[4] if len(args) > 4 else "{}" region = args[5] if len(args) > 5 else "ap-guangzhou" try: payload = json.loads(payload_str) except json.JSONDecodeError: payload = payload_str result = call_api(service, host, action, version, payload, region) ``` ### Technical Analysis The client accepts arbitrary `host`, `service`, `action`, version, and payload values. It then creates an authorization header using the user's Tencent Cloud credentials and sends that header, the SecretId, request body, and optional `X-TC-Token` to the supplied host. No runtime allowlist requires the host to be an approved Tencent Cloud API domain. Metadata declares a restricted network scope, but the executable code does not enforce that restriction itself. This exceeds the Skill's Advisor-focused functionality. The long-term SecretK ...[truncated 1133 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create_role.py:42

Finding

Console-Login Role Receives Unnecessary Full-Access Policies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Users Are Directed to Persist Long-Lived Cloud Credentials in Plaintext

Content

View full analysis

> ~/.bashrc echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc source ~/.bashrc ``` Windows PowerShell（写入用户级环境变量）： ```powershell [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User") [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User") ``` ``` ### Technical Analysis The Skill makes permanent persistence of long-lived Tencent Cloud SecretId and SecretKey values mandatory. On Unix-like systems, it recommends placing the credentials directly into plaintext shell startup files. Shell profiles are frequently included in workstation backups, diagnostic archives, home-directory migrations, dotfile repositories, and support bundles. They may also be readable by other processes operating under the same user account. Permanent plaintext storage is not technically required for the API calls. The cleanup script only generates commands that unset variables in the current shell. It explicitly requires users to remove persisted lines manually, making incomplete credential removal likely. ### Attack Path 1. The user follows the mandatory setup instructions. 2. Long-lived cloud credentials are appended to `.bashrc` or `.zshrc`. 3. The file is copied into a backup, support archive, dotfile repository, or compromised by another local process. 4. An attacker extracts the SecretId and SecretKey. 5. The attacker authenticates directly to Tencent Cloud with all permissions assigned to those credentials. ### Impact Assessment Exposure of a long-lived AK/SK pair can grant persistent Tencent ...[truncated 203 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/login_url.py:275

Finding

Unvalidated Login Redirect Target and Full Temporary Login URL Exposure

Content

View full analysis

str: """ 第二步：使用临时凭证生成免密登录 URL 签名方式：HMAC-SHA256 + Base64（与官方文档一致） """ login_timestamp = int(time.time()) login_nonce = random.randint(10000, 100000000) source_string = ( f"GETcloud.tencent.com/login/roleAccessCallback?" f"action=roleLogin" f"&nonce={login_nonce}" f"&secretId={tmp_secret_id}" f"×tamp={login_timestamp}" ) ``` The generated URL contains temporary session material and the unrestricted redirect: ```python login_url = ( f"https://cloud.tencent.com/login/roleAccessCallback?" f"algorithm=sha256" f"&secretId={quote(tmp_secret_id, safe='')}" f"&token={quote(token, safe='')}" f"&nonce={login_nonce}" f"×tamp={login_timestamp}" f"&signature={quote(login_signature, safe='')}" f"&s_url={quote(target_url, safe='')}" ) ``` It is then returned in full through standard output: ```python login_url = generate_login_url( sts_result["TmpSecretId"], sts_result["TmpSecretKey"], sts_result["Token"], target_url, ) print(output_success(login_url, target_url, duration, sts_result["RequestId"])) ``` ### Technical Analysis The script accepts any non-empty command-line string as `target_url`. It does not require the HTTPS scheme, the `console.cloud.tencent.com` hostname, or an Advisor path. This permits creation of a trusted-looking Tencent Cloud role-login URL whose post-login destination is attacker-controlled. The entire generated URL is printed as JSON. That URL includes a temporary SecretId, STS token, nonce, timesta ...[truncated 1102 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: check_env.py:329

Finding

Mandatory “Read-Only” Environment Check Writes Configuration and Assumes a Role

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: PUBLISH_GUIDE.md:24

Finding

Unrelated Publication Guide Recommends Anti-Abuse Evasion Techniques

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (66)

Tainted flow: 'req' from os.environ.get (line 228, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/login_url.py (reported line 236)May include surrounding context.

python

)

    ctx = _get_ssl_context()
    with urlopen(req, context=ctx) as resp:
        result = json.loads(resp.read().decode("utf-8"))

    response_body = result.get("Response", {})

Tainted flow: 'req' from os.environ.get (line 186, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tcloud_api.py (reported line 195)May include surrounding context.

python

try:
        ctx = _get_ssl_context()
        with urlopen(req, context=ctx, timeout=30) as resp:
            response_body = resp.read().decode("utf-8")
    except HTTPError as e:
        try:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file content is unrelated to the declared architecture dashboard/risk review purpose and instead provides operational guidance for bulk skill publishing after an anti-abuse crackdown. This mismatch is dangerous because it suggests the skill package contains hidden, off-purpose instructions that could facilitate platform abuse and supply-chain style distribution of many skills under the guise of a benign tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions explicitly describe token rotation, batching, timing, and staged rollout for publishing many skills while minimizing detection, which is unjustified for an architecture review skill. In context, these steps can be used to scale distribution of unwanted or malicious packages and to work around platform anti-abuse mechanisms.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README documents capabilities that materially exceed the stated skill scope, including passwordless console login, environment inspection, and role-management workflows. Scope expansion is dangerous in an agent skill because users may grant trust and credentials based on the manifest description while the skill actually enables privileged access paths and account changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The generic API invocation pattern (tcloud_api.py ... <Action> ... [region]) suggests the skill may support broader Tencent Cloud API access than the narrow dashboard framing implies. That creates a capability-expansion risk where a seemingly limited skill can be repurposed for wider authenticated cloud operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The generic API invocation pattern (tcloud_api.py ... <Action> ... [region]) suggests the skill may support broader Tencent Cloud API access than the narrow dashboard framing implies. That creates a capability-expansion risk where a seemingly limited skill can be repurposed for wider authenticated cloud operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The generic API invocation pattern (tcloud_api.py ... <Action> ... [region]) suggests the skill may support broader Tencent Cloud API access than the narrow dashboard framing implies. That creates a capability-expansion risk where a seemingly limited skill can be repurposed for wider authenticated cloud operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The generic API invocation pattern (tcloud_api.py ... <Action> ... [region]) suggests the skill may support broader Tencent Cloud API access than the narrow dashboard framing implies. That creates a capability-expansion risk where a seemingly limited skill can be repurposed for wider authenticated cloud operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The generic API invocation pattern (tcloud_api.py ... <Action> ... [region]) suggests the skill may support broader Tencent Cloud API access than the narrow dashboard framing implies. That creates a capability-expansion risk where a seemingly limited skill can be repurposed for wider authenticated cloud operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The generic API invocation pattern (tcloud_api.py ... <Action> ... [region]) suggests the skill may support broader Tencent Cloud API access than the narrow dashboard framing implies. That creates a capability-expansion risk where a seemingly limited skill can be repurposed for wider authenticated cloud operations.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 86% confidence

Finding

The skill instructs users to permanently store cloud secrets in shell startup files or persistent user environment variables. While not malware in context, this creates credential persistence that increases exposure to local compromise, accidental leakage through shell history/config backups, and misuse by other processes running as the user.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

��变量配置密钥：

1.1 必填环境变量

• TENCENTCLOUD_SECRET_ID — 腾讯云 SecretId（必填）
• TENCENTCLOUD_SECRET_KEY — 腾讯云 SecretKey（必填）

密钥获取地址：https://console.cloud.tencent.com/cam/capi

环境变量必须永久写入 shell 配置文件，确保新会话中仍然生效：

Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）：

bash

echo 'export TENCENTCLOUD_SECRET_ID="your-secret-id"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell（写入用户级环境变量）：

powershell

[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")

1.2 角色配置（免密登录需要）

为生成控制台免密登录链接，需要配置 CAM 角色。角色配置分为 检测 和 创建 两个独立步骤，角色创

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md

- 插件必须包含 `SKILL.md` 文件，描述插件的功能、调用方式和输出格式

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module header explicitly states the script is detection-only and will not modify configuration, yet later code auto-saves role configuration when an existing role is found. Security-sensitive tooling must be truthful about side effects; otherwise operators may run it in restricted or audited environments expecting no persistence.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script claims to be read-only, but save_config() creates ~/.tencent-cloudq, writes persistent role metadata, and changes filesystem permissions. That mismatch is dangerous because users and higher-level agents may grant trust or execute it under false assumptions, causing unauthorized state changes and persistence on the host.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · check_env.py (reported line 261)May include surrounding context.

python

nd("TENCENTCLOUD_SECRET_ID")
        if not secret_key:
            missing.append("TENCENTCLOUD_SECRET_KEY")
        log_fail(f"未配置以下环境变量: {', '.join(missing)}")
        log_info("")
        log_info("  请将腾讯云 API 密钥永久写入 shell 配置文件：")
        log_info("")
        log_info("  Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）:")
        log_info('    echo \'export TENCENTCLOUD_SECRET_ID="your-secret-id"\' >> ~/.bashrc')
        log_info('    echo \'export TENCENTCLOUD_SECRET_KEY="your-secret-key"\' >> ~/.bashrc')
        log_info("    source ~/.bashrc")
        log_info("")
        log_info("  Windows PowerShell（写入用户级环境变量）:")
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")')
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")')
        log_info("")
        log_info("  密钥获取地址: https:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file implements a destructive cleanup utility for local configuration, cache, environment-variable handling, and optional cloud role deletion, which does not align with an architecture dashboard and risk review skill. Capability/description mismatch is dangerous because it can hide privileged or destructive behavior behind an unrelated skill label, increasing the chance a user or reviewer grants trust or execution they otherwise would not.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script can delete a Tencent Cloud CAM role named "advisor" using available AK/SK credentials, which is a privileged IAM action unrelated to a dashboard viewer/reviewer workflow. In the context of this skill, that creates unnecessary authority and can lead to identity/authorization disruption, service breakage, or abuse if the script is invoked in an environment where credentials are present.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script creates a CAM role, enables console login, and attaches broad managed policies, which is privileged IAM provisioning behavior unrelated to a stated architecture dashboard/risk review function. In an agent skill context, this is dangerous because it can silently expand access in the user's Tencent Cloud account and establish persistent privileged access beyond what users would expect from a dashboard feature.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script generates passwordless Tencent Cloud console login links by consuming cloud credentials and assuming roles, which is unrelated to a dashboard/risk-review skill's declared purpose. That mismatch is dangerous because it can covertly expand the skill into a credential-powered access broker, enabling unauthorized or unexpected console access under the guise of benign architecture tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

When certifi is unavailable, the SSL context disables hostname checking and certificate verification, making HTTPS requests vulnerable to man-in-the-middle interception. Because this script sends cloud API requests and receives temporary credentials, an attacker on the network path could tamper with responses or capture sensitive authentication material.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code materially exceeds the skill's stated dashboard/risk-review scope by performing credential-based AssumeRole operations and producing federated console access URLs. In context, this is more dangerous because a user expecting passive analysis tooling may unknowingly run code that creates interactive access paths into their cloud account.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/setup_role.py (reported line 44)May include surrounding context.

python

if platform.system() == "Windows":
        # Windows 10+ 的 cmd/PowerShell 支持 ANSI（需 VT100）
        try:
            os.system("")  # 激活 VT100 模式
            return True
        except Exception:
            return False

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This setup script can create a new CAM role and attach policies, which exceeds the stated purpose of an architecture dashboard/risk review skill and materially changes account security posture. Even with a prompt, bundling IAM modification into a monitoring-oriented skill expands blast radius and can normalize over-privileged setup flows, especially when users provide high-privilege API credentials via environment variables.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

If certifi is unavailable, the fallback SSL context disables hostname verification and certificate validation entirely before sending signed HTTPS requests. That enables man-in-the-middle interception or modification of requests and responses, potentially exposing signed cloud API traffic and allowing tampering with risk-review results or abuse of privileged cloud credentials in transit.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法 v3.md:779

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法.md:484

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/login_url.py:86

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/tcloud_api.py:50