ClawHub
Back to skill

Security audit

Architecture Visualization & Governance

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate Tencent Cloud Advisor purpose, but it asks for sensitive cloud credentials and includes overbroad, under-scoped cloud authority that users should review carefully.

Install only if you are comfortable granting this skill access to Tencent Cloud credentials and IAM operations. Use a dedicated least-privilege sub-account, avoid putting long-lived AK/SK values in shell profiles, review or restrict the API wrapper to Tencent Cloud Advisor endpoints, and do not generate or share console login links unless you understand they act like temporary access material.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/tcloud_api.py:39
Finding

TLS Certificate Verification Is Disabled When certifi Is Unavailable

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/tcloud_api.py:159
Finding

Unrestricted Destination Host Can Receive Credential-Bearing Requests

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/create_role.py:39
Finding

Console Login Role Is Granted Unnecessary Full-Access Policies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/login_url.py:286
Finding

Temporary Console Login Credentials Are Exposed Through Standard Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:24
Finding

Installation Instructions Require Long-Lived Cloud Keys in Plaintext Shell Profiles

Content
View full analysis
> ~/.bashrc echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc source ~/.bashrc ``` The Windows instructions similarly persist the credentials as user-level environment variables: ```powershell [Environment]::SetEnvironmentVariable( "TENCENTCLOUD_SECRET_ID", "your-secret-id", "User" ) [Environment]::SetEnvironmentVariable( "TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User" ) ``` ### Technical Analysis The Skill instructs users to store Tencent Cloud AK/SK credentials permanently in plaintext shell startup files or persistent user environment variables. Shell profiles are not dedicated secret stores. They may be: - Read by other local processes running as the same user. - Included in home-directory backups. - Copied into troubleshooting bundles. - Accidentally committed to source control. - Exposed by terminal configuration synchronization. - Inherited by every child process launched from the shell. The instructions explicitly characterize permanent storage as mandatory, despite the same Skill recommending temporary STS credentials for production. This increases credential lifetime and unnecessarily broadens the number of processes that can access the credentials. ### Attack Path 1. A user follows the mandatory setup instructions. 2. The user substitutes real Tencent Cloud credentials into the command. 3. The SecretId and SecretKey are appended in plaintext to a shell startup file or persistent user environment. 4. A local process, backup reader, synchronized configuration service, support tool, or other same-user application reads the credential. 5. The attacker uses the stolen AK/SK pair to authenticate to Tencent Cloud. 6. The attacker exercises every permission assigne ...[truncated 509 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (61)

Tainted flow: 'req' from os.environ.get (line 228, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/login_url.py (reported line 236)May include surrounding context.

python
)

    ctx = _get_ssl_context()
    with urlopen(req, context=ctx) as resp:
        result = json.loads(resp.read().decode("utf-8"))

    response_body = result.get("Response", {})

Tainted flow: 'req' from os.environ.get (line 186, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tcloud_api.py (reported line 195)May include surrounding context.

python
try:
        ctx = _get_ssl_context()
        with urlopen(req, context=ctx, timeout=30) as resp:
            response_body = resp.read().decode("utf-8")
    except HTTPError as e:
        try:

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill exposes generic authenticated Tencent Cloud API access through a reusable API wrapper, which is broader than the stated visualization/dashboard purpose. Broad API mediation combined with credential handling increases the blast radius if companion docs, plugins, or future changes extend actions beyond the currently listed advisor endpoints.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill exposes generic authenticated Tencent Cloud API access through a reusable API wrapper, which is broader than the stated visualization/dashboard purpose. Broad API mediation combined with credential handling increases the blast radius if companion docs, plugins, or future changes extend actions beyond the currently listed advisor endpoints.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill exposes generic authenticated Tencent Cloud API access through a reusable API wrapper, which is broader than the stated visualization/dashboard purpose. Broad API mediation combined with credential handling increases the blast radius if companion docs, plugins, or future changes extend actions beyond the currently listed advisor endpoints.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill exposes generic authenticated Tencent Cloud API access through a reusable API wrapper, which is broader than the stated visualization/dashboard purpose. Broad API mediation combined with credential handling increases the blast radius if companion docs, plugins, or future changes extend actions beyond the currently listed advisor endpoints.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill exposes generic authenticated Tencent Cloud API access through a reusable API wrapper, which is broader than the stated visualization/dashboard purpose. Broad API mediation combined with credential handling increases the blast radius if companion docs, plugins, or future changes extend actions beyond the currently listed advisor endpoints.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill exposes generic authenticated Tencent Cloud API access through a reusable API wrapper, which is broader than the stated visualization/dashboard purpose. Broad API mediation combined with credential handling increases the blast radius if companion docs, plugins, or future changes extend actions beyond the currently listed advisor endpoints.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
84% confidence
Finding

The skill instructs users to persist cloud secrets into shell startup files and user-level environment storage, creating long-lived credential exposure on disk. Those files are commonly readable by local processes, included in backups, and sometimes accidentally shared, so encouraging permanent storage of AK/SK materially increases credential-compromise risk.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

��变量配置密钥：

1.1 必填环境变量

  • TENCENTCLOUD_SECRET_ID — 腾讯云 SecretId（必填）
  • TENCENTCLOUD_SECRET_KEY — 腾讯云 SecretKey（必填）

密钥获取地址：https://console.cloud.tencent.com/cam/capi

环境变量必须永久写入 shell 配置文件，确保新会话中仍然生效：

Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）：

bash
echo 'export TENCENTCLOUD_SECRET_ID="your-secret-id"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell（写入用户级环境变量）：

powershell
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")

1.2 角色配置（免密登录需要）

为生成控制台免密登录链接，需要配置 CAM 角色。角色配置分为 检测 和 创建 两个独立步骤，角色创

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md
- 插件必须包含 `SKILL.md` 文件，描述插件的功能、调用方式和输出格式

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · check_env.py (reported line 261)May include surrounding context.

python
nd("TENCENTCLOUD_SECRET_ID")
        if not secret_key:
            missing.append("TENCENTCLOUD_SECRET_KEY")
        log_fail(f"未配置以下环境变量: {', '.join(missing)}")
        log_info("")
        log_info("  请将腾讯云 API 密钥永久写入 shell 配置文件：")
        log_info("")
        log_info("  Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）:")
        log_info('    echo \'export TENCENTCLOUD_SECRET_ID="your-secret-id"\' >> ~/.bashrc')
        log_info('    echo \'export TENCENTCLOUD_SECRET_KEY="your-secret-key"\' >> ~/.bashrc')
        log_info("    source ~/.bashrc")
        log_info("")
        log_info("  Windows PowerShell（写入用户级环境变量）:")
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")')
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")')
        log_info("")
        log_info("  密钥获取地址: https:

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script explicitly advertises destructive behavior: deleting local configuration/cache and optionally deleting a cloud CAM role. Those actions are materially different from the declared skill purpose of architecture visualization/governance, so they expand the trust boundary and create a risky hidden administration capability. In a skill package, this mismatch is dangerous because users may install it expecting read-oriented assessment features but receive code that can remove credentials, state, and cloud identities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code can call Tencent Cloud APIs to query and delete a CAM role named advisor using available AK/SK credentials. Deleting IAM/CAM roles is a privileged administrative mutation that can disrupt access, break automation, or remove security controls, and it is not justified by the stated architecture visualization/governance purpose. In context, the mismatch makes the capability more suspicious and more dangerous because users may not expect identity-destructive actions from this skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This script creates an IAM/CAM role and attaches powerful policies, which materially exceeds a skill advertised for architecture visualization and governance dashboards. Even though the file comments say it should only run with explicit user consent, the code itself performs privileged write operations that can expand account access and persist that access by saving the created role details locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code provisions a console-login role and attaches broad managed permissions unrelated to a read-oriented visualization/dashboard use case. A console-accessible role with expansive rights increases the blast radius of misuse, credential compromise, or accidental abuse, especially because the skill context does not justify creating a privileged interactive identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

When certifi is unavailable, the code disables hostname checking and sets verify_mode to CERT_NONE, which fully disables TLS certificate validation. That allows man-in-the-middle interception of the STS request and response, potentially exposing temporary credentials or letting an attacker tamper with security-sensitive authentication flows.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/setup_role.py (reported line 44)May include surrounding context.

python
if platform.system() == "Windows":
        # Windows 10+ 的 cmd/PowerShell 支持 ANSI（需 VT100）
        try:
            os.system("")  # 激活 VT100 模式
            return True
        except Exception:
            return False

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

If certifi is unavailable, the fallback SSL context disables hostname checking and certificate validation entirely. This enables man-in-the-middle attacks against signed cloud API requests and responses, allowing interception or tampering with sensitive metadata, tokens, and governance data despite using HTTPS.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

This module is a generic Tencent Cloud API client, while the skill is described as architecture visualization and governance. That scope mismatch is dangerous because any component able to supply service, host, action, and payload can repurpose the skill to perform unrelated cloud operations, potentially including sensitive read/write actions far beyond the stated user expectation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code permits arbitrary cloud API operations by accepting caller-controlled service, host, action, version, region, and payload values and signing them with account credentials. In the context of a governance/visualization skill, this substantially increases danger because the same mechanism could invoke destructive, privilege-management, or data-access APIs if misused by the surrounding agent or prompt flow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction "请严格按照" is written entirely in Chinese and directs contributors to follow the referenced contribution rules, implying a language-specific requirement without offering any user language choice. This can violate locale or language policy when no opt-in or justification for restricting the skill to Chinese is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide explicitly recommends rotating multiple tokens during bulk publishing, which can facilitate bypassing platform anti-abuse throttling and encourages risky credential practices. Even if framed operationally, this normalizes use of multiple credentials to continue behavior the platform is actively restricting.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This section provides a concrete, stepwise playbook for reducing detection while continuing high-volume publication, including batching, staged testing, and timing around anti-spam controls. Because the platform's stricter checks were introduced after a supply-chain attack, instructions for progressively working around those controls materially increase abuse enablement risk.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The recommendations collectively normalize modifying content for uniqueness, rotating tokens, and retrying after enforcement events in order to keep publishing. In context, this is not neutral documentation: it teaches users how to adapt behavior to avoid anti-abuse signals on a marketplace hardened after a malicious campaign.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Telling users to retry with another token directly suggests switching credentials to continue an action after failure, which can enable circumvention of enforcement and poor secret-handling practices. This is especially risky in a publication workflow because it operationalizes account/token hopping after anti-spam friction.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
advisor-2020-07-21/调用方式/签名方法 v3.md:779

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
advisor-2020-07-21/调用方式/签名方法.md:484

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/login_url.py:86

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/tcloud_api.py:50