Architecture Inventory & Risk Assessment

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:55 AM UTC
• Version: 1.4.0

Overview

The skill has a real Tencent Cloud advisor purpose, but it asks for broad cloud credentials and permissions, weakens network safety, and includes unrelated bulk-publishing material that users should review carefully.

Install only after reviewing the cloud permissions and unrelated publishing files. Use a dedicated least-privilege Tencent Cloud sub-account, avoid storing long-lived SecretKeys in shell profiles, do not share generated login links, and remove or constrain the generic API runner, insecure TLS fallback, broad role policies, and bulk-publishing artifacts before trusting this skill in a sensitive account.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:44

Finding

TLS Certificate and Hostname Verification Disabled When certifi Is Unavailable

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:166

Finding

Caller-Controlled Host Receives Authenticated Tencent Cloud Request Headers

Content

View full analysis

4 else "{}" region = args[5] if len(args) > 5 else "ap-guangzhou" result = call_api(service, host, action, version, payload, region) ``` ### Technical Analysis The command-line caller controls the request hostname, service, action, version, payload, and region. The implementation does not verify that `host` belongs to `tencentcloudapi.com`, nor does it enforce a valid mapping between approved services and their official endpoints. Before sending the request, the script reads credentials from the environment and constructs an `Authorization` header containing the SecretId and request signature. If temporary credentials are configured, it also attaches `TENCENTCLOUD_TOKEN` as `X-TC-Token`. These values are then sent to the caller-selected HTTPS endpoint. This behavior exceeds the declared network scope, which limits the Skill to Tencent Cloud API and console domains. The risk is amplified by the separate TLS-verification weakness. ### Attack Path 1. An attacker influences an Agent command, wrapper script, copied command, or other invocation of `tcloud_api.py`. 2. The attacker supplies a controlled hostname in the second positional argument. 3. The script reads Tencent Cloud credentials from env ...[truncated 860 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create_role.py:42

Finding

Created Console Role Receives Full Tag and Advisor Access Beyond Minimum Requirements

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Documentation Requires Persistent Plaintext Storage of Long-Lived Cloud Credentials

Content

View full analysis

> ~/.bashrc echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc source ~/.bashrc ``` ```powershell [Environment]::SetEnvironmentVariable( "TENCENTCLOUD_SECRET_ID", "your-secret-id", "User" ) [Environment]::SetEnvironmentVariable( "TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User" ) ``` ### Technical Analysis The Skill explicitly instructs users to persist Tencent Cloud SecretIds and SecretKeys in shell startup files or user-level environment variables. Shell configuration files are plaintext and are commonly included in backups, dotfile repositories, support archives, home-directory synchronization, and diagnostic collection. Every process running under the same user can generally read inherited environment variables. Startup-file storage also makes credential exposure persist across sessions, increasing the useful lifetime of a local compromise. The cleanup script cannot automatically remove credentials from shell profiles and only advises users to edit them manually. ### Attack Path 1. The user follows the mandatory setup instructions and stores a long-lived SecretId and SecretKey in a shell profile or user environment. 2. The credentials remain available in future sessions. 3. Local malware, another process running as the user, an exposed backup, a mistakenly published dotfile repository, or a support bundle accesses the configuration. 4. The attacker retrieves the long-lived AK/SK pair. 5. The attacker calls Tencent Cloud APIs with every permission assigned to that identity until the key is revoked or rotated. ### Impact Assessment Compromise exposes durable Tencent Cloud API credentials rather than a narrowly scoped, short-lived session. The resulting privileges are tho ...[truncated 227 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/login_url.py:289

Finding

Passwordless Console Login URL Permits an Unrestricted Post-Login Redirect

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (79)

Tainted flow: 'req' from os.environ.get (line 228, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/login_url.py (reported line 236)May include surrounding context.

python

)

    ctx = _get_ssl_context()
    with urlopen(req, context=ctx) as resp:
        result = json.loads(resp.read().decode("utf-8"))

    response_body = result.get("Response", {})

Tainted flow: 'req' from os.environ.get (line 186, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The code disables TLS certificate verification when certifi is unavailable by setting check_hostname = False and verify_mode = ssl.CERT_NONE, then sends signed Tencent Cloud requests over that connection. Because the request includes attacker-influenced host and secrets-backed authorization headers, a man-in-the-middle or redirected endpoint could intercept requests and responses, defeating transport security and exposing sensitive cloud API interactions.

Content

Scanner excerpt · scripts/tcloud_api.py (reported line 195)May include surrounding context.

python

try:
        ctx = _get_ssl_context()
        with urlopen(req, context=ctx, timeout=30) as resp:
            response_body = resp.read().decode("utf-8")
    except HTTPError as e:
        try:

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file is wholly unrelated to the declared architecture inventory/risk assessment purpose and instead provides operational guidance for bulk skill publishing after a known supply-chain incident. That mismatch is dangerous because it can conceal unauthorized distribution workflow content inside an unrelated skill, increasing the chance the package is being used to facilitate mass publication or evade platform scrutiny.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation gives instructions for staged bulk publication, monitoring anti-spam triggers, retrying failed uploads, and using alternate tokens, none of which are justified by the stated skill purpose. In context, this appears to normalize anti-abuse evasion behavior and suggests the repository may support deceptive or unauthorized mass distribution activity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guidance explicitly recommends token rotation and tuned publication pacing to avoid triggering platform anti-spam controls. Those are classic anti-detection tactics and are especially suspicious in a skill that should be focused on cloud architecture assessment rather than distribution automation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file content is materially unrelated to the declared skill purpose of architecture inventory and risk assessment, and instead documents batch publishing automation. This mismatch is dangerous because it suggests the repository may contain repurposed or concealed operational content that could mislead reviewers, mask unauthorized functionality, or facilitate bulk distribution workflows under an unrelated skill identity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented API runner takes service, host, action, and version as parameters, indicating a generic authenticated cloud API invocation mechanism rather than a narrowly constrained advisor-only client. With environment-provided secrets, that broad capability could be repurposed for unintended Tencent Cloud actions if exposed through the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented API runner takes service, host, action, and version as parameters, indicating a generic authenticated cloud API invocation mechanism rather than a narrowly constrained advisor-only client. With environment-provided secrets, that broad capability could be repurposed for unintended Tencent Cloud actions if exposed through the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented API runner takes service, host, action, and version as parameters, indicating a generic authenticated cloud API invocation mechanism rather than a narrowly constrained advisor-only client. With environment-provided secrets, that broad capability could be repurposed for unintended Tencent Cloud actions if exposed through the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented API runner takes service, host, action, and version as parameters, indicating a generic authenticated cloud API invocation mechanism rather than a narrowly constrained advisor-only client. With environment-provided secrets, that broad capability could be repurposed for unintended Tencent Cloud actions if exposed through the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented API runner takes service, host, action, and version as parameters, indicating a generic authenticated cloud API invocation mechanism rather than a narrowly constrained advisor-only client. With environment-provided secrets, that broad capability could be repurposed for unintended Tencent Cloud actions if exposed through the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented API runner takes service, host, action, and version as parameters, indicating a generic authenticated cloud API invocation mechanism rather than a narrowly constrained advisor-only client. With environment-provided secrets, that broad capability could be repurposed for unintended Tencent Cloud actions if exposed through the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented API runner takes service, host, action, and version as parameters, indicating a generic authenticated cloud API invocation mechanism rather than a narrowly constrained advisor-only client. With environment-provided secrets, that broad capability could be repurposed for unintended Tencent Cloud actions if exposed through the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented API runner takes service, host, action, and version as parameters, indicating a generic authenticated cloud API invocation mechanism rather than a narrowly constrained advisor-only client. With environment-provided secrets, that broad capability could be repurposed for unintended Tencent Cloud actions if exposed through the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented API runner takes service, host, action, and version as parameters, indicating a generic authenticated cloud API invocation mechanism rather than a narrowly constrained advisor-only client. With environment-provided secrets, that broad capability could be repurposed for unintended Tencent Cloud actions if exposed through the skill.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 85% confidence

Finding

The YARA match is overbroad, but the underlying behavior is still risky: the skill instructs permanent persistence of cloud secrets and role config into shell startup files. In this skill context, that is more dangerous because the stored credentials are powerful Tencent Cloud API keys used for authenticated administrative and console-access workflows.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

��变量配置密钥：

1.1 必填环境变量

• TENCENTCLOUD_SECRET_ID — 腾讯云 SecretId（必填）
• TENCENTCLOUD_SECRET_KEY — 腾讯云 SecretKey（必填）

密钥获取地址：https://console.cloud.tencent.com/cam/capi

环境变量必须永久写入 shell 配置文件，确保新会话中仍然生效：

Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）：

bash

echo 'export TENCENTCLOUD_SECRET_ID="your-secret-id"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell（写入用户级环境变量）：

powershell

[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")

1.2 角色配置（免密登录需要）

为生成控制台免密登录链接，需要配置 CAM 角色。角色配置分为 检测 和 创建 两个独立步骤，角色创

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md

- 插件必须包含 `SKILL.md` 文件，描述插件的功能、调用方式和输出格式

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module docstring states the script is read-only and will not modify configuration, but the code writes a config file when it discovers an existing role. This mismatch is dangerous because users and reviewers may grant trust or run the script under false assumptions about side effects.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · check_env.py (reported line 261)May include surrounding context.

python

nd("TENCENTCLOUD_SECRET_ID")
        if not secret_key:
            missing.append("TENCENTCLOUD_SECRET_KEY")
        log_fail(f"未配置以下环境变量: {', '.join(missing)}")
        log_info("")
        log_info("  请将腾讯云 API 密钥永久写入 shell 配置文件：")
        log_info("")
        log_info("  Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）:")
        log_info('    echo \'export TENCENTCLOUD_SECRET_ID="your-secret-id"\' >> ~/.bashrc')
        log_info('    echo \'export TENCENTCLOUD_SECRET_KEY="your-secret-key"\' >> ~/.bashrc')
        log_info("    source ~/.bashrc")
        log_info("")
        log_info("  Windows PowerShell（写入用户级环境变量）:")
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")')
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")')
        log_info("")
        log_info("  密钥获取地址: https:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script performs local release-state manipulation by backing up and then clearing a publish log, which is unrelated to the declared architecture inventory and risk-assessment purpose of the skill. In a skill ecosystem, mismatched capabilities are dangerous because they can reset auditability, hide prior publish outcomes, or enable republishing workflows without an obvious business need.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file is a destructive cleanup utility that deletes local configuration, cached data, environment-variable cleanup helpers, and optionally a cloud CAM role. That behavior is materially unrelated to the skill’s stated purpose of architecture inventory and risk assessment, so including it expands the skill’s privileges and creates a path for destructive actions if a user runs the script.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This function can call Tencent CAM APIs to delete a cloud role named advisor using available AK/SK credentials. Deleting IAM/CAM roles is an administrative, potentially disruptive action that is unjustified for an inventory/risk-assessment skill and could break dependent automations or access paths.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This script creates a CAM role and attaches broad permissions, which is an IAM write capability unrelated to a skill advertised for architecture inventory and risk assessment. In this context, introducing account-modifying behavior expands privileges and can be abused to establish persistent access or alter the cloud security posture under the guise of assessment setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

When certifi is unavailable, the code disables certificate validation and hostname verification entirely, allowing man-in-the-middle interception of requests to STS. Because those requests carry long-lived SecretId/SecretKey-derived authorization and return temporary credentials, an active network attacker could steal or tamper with authentication flows and obtain cloud access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file implements console access bootstrapping by deriving a role ARN, assuming that role, and producing a direct login URL, despite the surrounding skill being described as inventory and risk assessment. In this context, granting browser-console entry is more dangerous because it enables interactive access beyond passive assessment and can be abused to browse or modify cloud resources under an assessment pretext.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法 v3.md:779

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法.md:484

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/login_url.py:86

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/tcloud_api.py:50