Cloud Architecture Discovery

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:55 AM UTC
• Version: 1.4.0

Overview

This skill needs careful review because it asks for powerful Tencent Cloud credentials, can create or delete cloud roles, has misleading security claims, and includes unrelated batch-publishing materials.

Install only after reviewing the cloud permissions and fixing the security issues. Use a tightly scoped subaccount or temporary credentials, avoid storing long-lived AK/SK values in shell startup files, do not run the batch-publishing materials, require explicit confirmation for IAM or Advisor authorization changes, and treat generated console-login URLs as secrets.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:46

Finding

TLS certificate and hostname verification are disabled when certifi is unavailable

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:90

Finding

Tencent Cloud authentication material can be transmitted to an arbitrary caller-selected host

Content

View full analysis

dict: ``` ```python authorization = ( f"{algorithm} " f"Credential={secret_id}/{credential_scope}, " f"SignedHeaders=content-type;host;x-tc-action, " f"Signature={signature}" ) headers = { "Authorization": authorization, "Content-Type": "application/json; charset=utf-8", "Host": host, "X-TC-Action": action, "X-TC-Timestamp": str(timestamp), "X-TC-Version": version, "X-TC-Region": region, } if token: headers["X-TC-Token"] = token req = Request( f"https://{host}", data=payload_str.encode("utf-8"), headers=headers, method="POST", ) ``` ```python service = args[0] host = args[1] action = args[2] version = args[3] payload_str = args[4] if len(args) > 4 else "{}" region = args[5] if len(args) > 5 else "ap-guangzhou" result = call_api(service, host, action, version, payload, region) ``` ### Technical Analysis The host is accepted directly from command-line arguments or any importing caller. No suffix check, exact allowlist, service-to-host mapping, or URL normalization is performed before the authorization header and optional temporary token are attached. Consequently, the API client is not limited to `*.tencentcloudapi.com`, despite the network restriction declared in `SKILL.md`. A malicious or prompt-influenced invocation can direct a signed request to an attacker-controlled HTTPS server. The long-term SecretKey itself is not directly transmitted. However, the request exposes the SecretId, optio ...[truncated 1376 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create_role.py:43

Finding

Created console-login role receives excessive and inconsistently disclosed full-access policies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: check_env.py:361

Finding

Advertised read-only environment check writes persistent configuration and assumes a cloud role

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/login_url.py:262

Finding

Unrestricted redirect target and active temporary credentials are returned in process output

Content

View full analysis

str: login_timestamp = int(time.time()) login_nonce = random.randint(10000, 100000000) source_string = ( f"GETcloud.tencent.com/login/roleAccessCallback?" f"action=roleLogin" f"&nonce={login_nonce}" f"&secretId={tmp_secret_id}" f"×tamp={login_timestamp}" ) login_signature = base64.b64encode( hmac.new( tmp_secret_key.encode("utf-8"), source_string.encode("utf-8"), hashlib.sha256, ).digest() ).decode("utf-8") login_url = ( f"https://cloud.tencent.com/login/roleAccessCallback?" f"algorithm=sha256" f"&secretId={quote(tmp_secret_id, safe='')}" f"&token={quote(token, safe='')}" f"&nonce={login_nonce}" f"×tamp={login_timestamp}" f"&signature={quote(login_signature, safe='')}" f"&s_url={quote(target_url, safe='')}" ) return login_url ``` ```python target_url = sys.argv[1] ``` ```python print(output_success(login_url, target_url, duration, sts_result["RequestId"])) ``` ### Technical Analysis The Base64 operation is a normal encoding step for an HMAC signature and is not itself covert exfiltration. The security issue is that the resulting URL contains an active temporary SecretId, STS token, timestamp, nonce, and signature, and the complete URL is emitted to stdout. Agent and automation environments commonly capture stdout in transcripts, logs, telemetry, or command histories. The Skill permits validity periods up to 43,200 seconds, increasing the opportunity for replay ...[truncated 1458 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cleanup.py:271

Finding

Noninteractive cleanup can delete an unrelated cloud role based only on a common name

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (77)

Tainted flow: 'req' from os.environ.get (line 228, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/login_url.py (reported line 236)May include surrounding context.

python

)

    ctx = _get_ssl_context()
    with urlopen(req, context=ctx) as resp:
        result = json.loads(resp.read().decode("utf-8"))

    response_body = result.get("Response", {})

Tainted flow: 'req' from os.environ.get (line 186, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tcloud_api.py (reported line 195)May include surrounding context.

python

try:
        ctx = _get_ssl_context()
        with urlopen(req, context=ctx, timeout=30) as resp:
            response_body = resp.read().decode("utf-8")
    except HTTPError as e:
        try:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file is unrelated to the declared skill purpose of cloud architecture discovery and instead focuses on bulk publishing tactics after a supply-chain attack. It normalizes strategies for avoiding platform anti-spam enforcement, which is a strong indicator of deceptive or abusive distribution intent in a package that users would expect to be about Tencent Cloud architecture mapping.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guide explicitly advises token rotation, pacing adjustments, and content changes to work around anti-spam controls. Those recommendations are not justified by the skill's stated functionality and provide operational guidance for bypassing platform abuse protections, increasing the likelihood of large-scale malicious or deceptive skill publication.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file content is materially inconsistent with the declared skill purpose: instead of cloud architecture discovery usage, it documents a batch publishing workflow with token rotation, retry logic, and anti-spam tuning. This mismatch is dangerous because it can mislead users into running unrelated operational scripts and suggests the package may contain repurposed or deceptive content that hides its true behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The security note claims AK/SK are not transmitted over the network, but authenticated Tencent Cloud API calls necessarily use those secrets to produce authorization material sent outbound. Misstating this security property can cause users to make unsafe trust decisions about credential exposure, logging, interception, or review requirements.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill modifies access-management configuration by creating roles, attaching policies, and storing role-related settings, despite being described primarily as an architecture discovery tool. That discrepancy can cause users and platforms to underestimate the privilege level and risk of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill modifies access-management configuration by creating roles, attaching policies, and storing role-related settings, despite being described primarily as an architecture discovery tool. That discrepancy can cause users and platforms to underestimate the privilege level and risk of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill modifies access-management configuration by creating roles, attaching policies, and storing role-related settings, despite being described primarily as an architecture discovery tool. That discrepancy can cause users and platforms to underestimate the privilege level and risk of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill modifies access-management configuration by creating roles, attaching policies, and storing role-related settings, despite being described primarily as an architecture discovery tool. That discrepancy can cause users and platforms to underestimate the privilege level and risk of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill modifies access-management configuration by creating roles, attaching policies, and storing role-related settings, despite being described primarily as an architecture discovery tool. That discrepancy can cause users and platforms to underestimate the privilege level and risk of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill modifies access-management configuration by creating roles, attaching policies, and storing role-related settings, despite being described primarily as an architecture discovery tool. That discrepancy can cause users and platforms to underestimate the privilege level and risk of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill modifies access-management configuration by creating roles, attaching policies, and storing role-related settings, despite being described primarily as an architecture discovery tool. That discrepancy can cause users and platforms to underestimate the privilege level and risk of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill modifies access-management configuration by creating roles, attaching policies, and storing role-related settings, despite being described primarily as an architecture discovery tool. That discrepancy can cause users and platforms to underestimate the privilege level and risk of the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest markets the skill as architecture discovery/viewing, but the documented behavior includes IAM role creation/deletion and service-authorization writes. This is a significant disclosure failure because users may approve installation or execution under the assumption of read-only cloud inventory access.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 90% confidence

Finding

The skill instructs users to persist long-term cloud secrets into shell startup files and user-level environment configuration. Storing AK/SK in persistent profile files increases the chance of credential theft through local compromise, accidental disclosure, backups, shell-history mistakes, or later unrelated processes inheriting the secrets.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

��变量配置密钥：

1.1 必填环境变量

• TENCENTCLOUD_SECRET_ID — 腾讯云 SecretId（必填）
• TENCENTCLOUD_SECRET_KEY — 腾讯云 SecretKey（必填）

密钥获取地址：https://console.cloud.tencent.com/cam/capi

环境变量必须永久写入 shell 配置文件，确保新会话中仍然生效：

Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）：

bash

echo 'export TENCENTCLOUD_SECRET_ID="your-secret-id"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell（写入用户级环境变量）：

powershell

[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")

1.2 角色配置（免密登录需要）

为生成控制台免密登录链接，需要配置 CAM 角色。角色配置分为 检测 和 创建 两个独立步骤，角色创

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md

- 插件必须包含 `SKILL.md` 文件，描述插件的功能、调用方式和输出格式

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is described as a cloud architecture discovery/viewing capability, but this documented operation performs account-level authorization and explicitly enables additional permissions for report interpretation and collaboration. That is a privilege-changing action outside the expected scope of a read-oriented discovery skill, creating a dangerous mismatch that could cause users or agents to grant unnecessary access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

A discovery/mapping skill should ordinarily be limited to read-only inspection, but this API enables Advisor authorization and related permissions, which is not justified by the advertised functionality. If exposed through an agent, this could be abused to expand service access under the guise of inventory or topology discovery.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · check_env.py (reported line 261)May include surrounding context.

python

nd("TENCENTCLOUD_SECRET_ID")
        if not secret_key:
            missing.append("TENCENTCLOUD_SECRET_KEY")
        log_fail(f"未配置以下环境变量: {', '.join(missing)}")
        log_info("")
        log_info("  请将腾讯云 API 密钥永久写入 shell 配置文件：")
        log_info("")
        log_info("  Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）:")
        log_info('    echo \'export TENCENTCLOUD_SECRET_ID="your-secret-id"\' >> ~/.bashrc')
        log_info('    echo \'export TENCENTCLOUD_SECRET_KEY="your-secret-key"\' >> ~/.bashrc')
        log_info("    source ~/.bashrc")
        log_info("")
        log_info("  Windows PowerShell（写入用户级环境变量）:")
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")')
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")')
        log_info("")
        log_info("  密钥获取地址: https:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for discovering and mapping cloud architecture using Tencent Cloud Smart Advisor API, but this file implements local maintenance of a publish_log.json file. Backing up and resetting publish records is not an obvious implementation detail of cloud architecture discovery and represents behavior outside the stated skill purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script is packaged with a skill described as discovery-only, yet it performs destructive local cleanup and can delete a remote CAM role. This mismatch violates least surprise and creates a supply-chain style risk: a user invoking tooling associated with architecture discovery could unintentionally remove credentials, configuration, or cloud IAM resources.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function clean_cloud_role deletes a CAM role named 'advisor' using available AK/SK environment credentials. In the context of a discovery skill, remote IAM deletion is especially dangerous because it exceeds expected read-only behavior and can disrupt access, break automation, or remove security-relevant roles in a user's Tencent Cloud account.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This code creates a CAM role and attaches broad managed policies including QcloudTAGFullAccess and QcloudAdvisorFullAccess, which exceeds the stated discovery-and-mapping functionality of the skill. Because it performs IAM write actions and enables console login, it can silently expand access in the tenant and establish persistent privileged configuration, creating a serious mismatch between declared purpose and actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

When certifi is unavailable, the fallback SSL context disables hostname verification and certificate validation entirely. That allows a man-in-the-middle attacker to intercept or modify STS responses, exposing long-lived credentials in transit context and enabling issuance of attacker-influenced temporary access artifacts.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法 v3.md:779

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: advisor-2020-07-21/调用方式/签名方法.md:484

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/login_url.py:86

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/tcloud_api.py:50