Cloud Architecture Holistic View

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:52 AM UTC
• Version: 1.4.0

Overview

This skill is mostly a Tencent Cloud architecture helper, but it asks for sensitive cloud credentials and includes broad IAM, login-link, and cleanup powers that are under-scoped for a viewing tool.

Review this skill carefully before installing. Use only a least-privilege Tencent Cloud sub-account, avoid storing long-lived AK/SK credentials in shell startup files, do not run role creation or cleanup unless you understand the exact CAM impact, and treat generated console login links as sensitive credentials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:46

Finding

TLS Certificate Verification Is Disabled When certifi Is Unavailable

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:107

Finding

Unrestricted API Host Receives Credential-Bearing Authorization Headers

Content

View full analysis

dict: ``` ```python headers = { "Authorization": authorization, "Content-Type": "application/json; charset=utf-8", "Host": host, "X-TC-Action": action, "X-TC-Timestamp": str(timestamp), "X-TC-Version": version, "X-TC-Region": region, } if token: headers["X-TC-Token"] = token req = Request( f"https://{host}", data=payload_str.encode("utf-8"), headers=headers, method="POST", ) ``` ```python service = args[0] host = args[1] action = args[2] version = args[3] ``` ### Technical Analysis The API client accepts the service, hostname, action, and version directly from command-line arguments. It does not verify that: - The host is an approved Tencent Cloud API endpoint. - The host ends with a trusted Tencent-controlled suffix. - The service corresponds to the supplied host. - The action is required by the Skill. - The host is not an IP literal, local address, or attacker-controlled domain. The client then sends an authorization header containing the SecretId and signature to the supplied host. If a temporary token is configured, it also sends the complete `X-TC-Token`. Although the signature does not directly reveal the SecretKey, authentication identifiers and temporary-session data are still sensitive. The unrestricted client also broadens the Skill beyond its declared Advisor functionality and can sign arbitrary Tencent Cloud API actions. ### Attack Path 1. An attacker influences an agent prompt, wrapper script, or direct invocation of `tcloud_api.py`. 2. The attacker supp ...[truncated 979 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create_role.py:42

Finding

Console Role Is Granted Excessive Full-Access Policies

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/cleanup.py:269

Finding

Cleanup Can Delete an Unrelated Pre-Existing CAM Role Without Confirmation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: check_env.py:80

Finding

Mandatory “Read-Only” Environment Check Performs Persistent Writes and Role Assumption

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:24

Finding

Long-Lived Cloud Credentials Are Directed Into Plaintext Shell Startup Files

Content

View full analysis

> ~/.bashrc echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc source ~/.bashrc ``` The Skill further states that all environment variables must be permanently written to shell configuration so that they survive new sessions. ### Technical Analysis Shell startup files are plaintext configuration files. Persisting a long-lived Tencent Cloud SecretId and SecretKey in these files exposes credentials to: - Any process running as the user. - Malware and malicious local tools. - Support bundles and diagnostic collection. - Home-directory backups and synchronization services. - Accidental terminal or configuration-file sharing. - Overly permissive file modes. - Child processes launched from the shell. Environment variables are also inherited by child processes, unnecessarily expanding the number of processes that can access the credentials. Requiring permanent persistence conflicts with the project's own recommendation to use temporary STS credentials in production. ### Attack Path 1. The user follows the mandatory setup instructions. 2. The long-lived SecretId and SecretKey are appended to `.bashrc`, `.zshrc`, or user-level environment storage. 3. The credentials persist across sessions and are inherited by future shell processes. 4. A malicious local process, compromised development tool, leaked backup, or exposed dotfile reads the values. 5. The attacker authenticates to Tencent Cloud with the stolen AK/SK. 6. The attacker exercises every permission assigned to that credential until it is revoked or rotated. ### Impact Assessment Compromise affects all Tencent Cloud resources accessible to the configured AK/SK, not only Smart Advisor. If an administrator o ...[truncated 214 chars]

Remediation

View remediation

other

Warning

• Location: PUBLISH_GUIDE.md:24

Finding

Unrelated Publishing Guide Recommends Anti-Abuse Evasion Techniques

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (68)

Tainted flow: 'req' from os.environ.get (line 228, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/login_url.py (reported line 236)May include surrounding context.

python

)

    ctx = _get_ssl_context()
    with urlopen(req, context=ctx) as resp:
        result = json.loads(resp.read().decode("utf-8"))

    response_body = result.get("Response", {})

Tainted flow: 'req' from os.environ.get (line 186, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tcloud_api.py (reported line 195)May include surrounding context.

python

try:
        ctx = _get_ssl_context()
        with urlopen(req, context=ctx, timeout=30) as resp:
            response_body = resp.read().decode("utf-8")
    except HTTPError as e:
        try:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This guide explicitly discusses bulk publishing, anti-spam avoidance, and token rotation in response to platform defenses introduced after a supply-chain attack. That behavior is unrelated to the advertised cloud-architecture viewing purpose and instead facilitates scaling distribution while reducing detection, which is a strong indicator of abusive publication infrastructure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document recommends operational tactics such as timed intervals, batch sizing, and switching tokens after several publishes to work around anti-spam controls. Guidance focused on evading platform abuse safeguards materially increases the ability to mass-distribute potentially harmful skills and is especially concerning in light of the referenced prior supply-chain attack.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README's security statement is misleading: AK/SK-authenticated API calls necessarily involve cryptographic use of the secret to produce signed requests sent over the network. Even if the raw secret key is not directly transmitted, the claim can cause users to underestimate credential exposure and trust guarantees, which is dangerous in a security-sensitive cloud skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documentation describes a generic authenticated API wrapper with host, service, action, payload, and optional region parameters, creating the potential to invoke Tencent Cloud APIs beyond the seven listed architecture-related actions. Combined with live credentials from the environment, this expands the attack surface from a narrow viewer into a broader cloud API execution capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documentation describes a generic authenticated API wrapper with host, service, action, payload, and optional region parameters, creating the potential to invoke Tencent Cloud APIs beyond the seven listed architecture-related actions. Combined with live credentials from the environment, this expands the attack surface from a narrow viewer into a broader cloud API execution capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documentation describes a generic authenticated API wrapper with host, service, action, payload, and optional region parameters, creating the potential to invoke Tencent Cloud APIs beyond the seven listed architecture-related actions. Combined with live credentials from the environment, this expands the attack surface from a narrow viewer into a broader cloud API execution capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documentation describes a generic authenticated API wrapper with host, service, action, payload, and optional region parameters, creating the potential to invoke Tencent Cloud APIs beyond the seven listed architecture-related actions. Combined with live credentials from the environment, this expands the attack surface from a narrow viewer into a broader cloud API execution capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation describes a generic authenticated API wrapper with host, service, action, payload, and optional region parameters, creating the potential to invoke Tencent Cloud APIs beyond the seven listed architecture-related actions. Combined with live credentials from the environment, this expands the attack surface from a narrow viewer into a broader cloud API execution capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation describes a generic authenticated API wrapper with host, service, action, payload, and optional region parameters, creating the potential to invoke Tencent Cloud APIs beyond the seven listed architecture-related actions. Combined with live credentials from the environment, this expands the attack surface from a narrow viewer into a broader cloud API execution capability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims secrets are not written to files, yet it explicitly instructs users to append long-lived TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY values to shell startup files or persistent user environment storage. Persisting cloud API credentials in plaintext configuration files increases the risk of credential theft, lateral movement, and accidental disclosure through backups, dotfile syncing, or local compromise.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 91% confidence

Finding

The matched shell commands establish persistence for cloud credentials by appending exports to ~/.bashrc, which resembles persistence behavior flagged by malware heuristics even if the apparent purpose is setup convenience. In this skill context, persisting long-lived API secrets on disk is genuinely dangerous because it creates a durable credential foothold and conflicts with the claim that secrets are not stored.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

��变量配置密钥：

1.1 必填环境变量

• TENCENTCLOUD_SECRET_ID — 腾讯云 SecretId（必填）
• TENCENTCLOUD_SECRET_KEY — 腾讯云 SecretKey（必填）

密钥获取地址：https://console.cloud.tencent.com/cam/capi

环境变量必须永久写入 shell 配置文件，确保新会话中仍然生效：

Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）：

bash

echo 'export TENCENTCLOUD_SECRET_ID="your-secret-id"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell（写入用户级环境变量）：

powershell

[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")

1.2 角色配置（免密登录需要）

为生成控制台免密登录链接，需要配置 CAM 角色。角色配置分为 检测 和 创建 两个独立步骤，角色创

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md

- 插件必须包含 `SKILL.md` 文件，描述插件的功能、调用方式和输出格式

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document exposes an operation that enables Advisor authorization and also turns on report interpretation and cloud architecture collaboration permissions, which are write/admin-affecting capabilities. That exceeds the skill’s stated read-oriented purpose of providing a holistic architecture view, creating a scope mismatch that could lead an agent or user to perform unintended account-level permission changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

A capability to grant or enable cloud permissions is not justified by a skill whose description is limited to viewing diagrams, directories, and risk assessments. This mismatch is dangerous because it expands the agent’s effective authority beyond user expectations and increases the risk of privilege changes being triggered under the guise of a read-only architecture-view workflow.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 83% confidence

Finding

The script instructs users to permanently append cloud API secrets to shell startup files such as ~/.bashrc, creating long-lived credential persistence on disk. While presented as setup guidance rather than malware, this increases exposure to local compromise, accidental disclosure, and reuse of powerful credentials beyond the immediate task.

Content

Scanner excerpt · check_env.py (reported line 261)May include surrounding context.

python

nd("TENCENTCLOUD_SECRET_ID")
        if not secret_key:
            missing.append("TENCENTCLOUD_SECRET_KEY")
        log_fail(f"未配置以下环境变量: {', '.join(missing)}")
        log_info("")
        log_info("  请将腾讯云 API 密钥永久写入 shell 配置文件：")
        log_info("")
        log_info("  Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）:")
        log_info('    echo \'export TENCENTCLOUD_SECRET_ID="your-secret-id"\' >> ~/.bashrc')
        log_info('    echo \'export TENCENTCLOUD_SECRET_KEY="your-secret-key"\' >> ~/.bashrc')
        log_info("    source ~/.bashrc")
        log_info("")
        log_info("  Windows PowerShell（写入用户级环境变量）:")
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")')
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")')
        log_info("")
        log_info("  密钥获取地址: https:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script is a destructive cleanup utility that removes local configuration, cache, environment-variable cleanup artifacts, and can optionally delete a cloud CAM role, yet the skill is described as providing a read-only holistic architecture view. This mismatch materially increases risk because users or automated runners may trust the skill as observational while it performs state-changing actions on both the workstation and cloud account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The function can delete a Tencent Cloud CAM role named advisor using live AK/SK credentials from environment variables. In the context of an architecture-view skill, IAM deletion is unjustified and dangerous because it can disrupt access paths, break integrations, or remove security-relevant roles under the guise of a non-destructive viewer.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script performs IAM write actions by creating a CAM role, enabling console login, and persisting the resulting role configuration, even though the skill is described as providing a read-only holistic architecture view. That mismatch is dangerous because users may authorize or run the skill expecting inventory/visibility behavior, while it actually modifies identity infrastructure and creates a new access path in the account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script attaches broad managed policies (QcloudTAGFullAccess and QcloudAdvisorFullAccess) to a newly created role and enables ConsoleLogin, which grants substantially more capability than is justified by a read-oriented architecture visualization skill. In the context of this skill, these permissions expand the blast radius of compromise or misuse and can normalize over-privileged access under a misleading feature description.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

When certifi is unavailable, the fallback SSL context disables hostname checking and certificate validation entirely. This allows man-in-the-middle interception or modification of the STS response, potentially exposing temporary credentials or causing the tool to generate login URLs based on attacker-controlled network traffic.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script reads long-lived cloud credentials from environment variables and uses them to discover account identity and assume roles, which is not justified by a tool advertised as an architecture-view capability. In this context, the code can transform ambient secrets into broader console access, increasing the blast radius if the skill is invoked unexpectedly or by a confused user.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This skill claims to provide a holistic architecture view, but the code generates privileged console login URLs by assuming a role and minting a federated access link. That materially expands capability from read/display into account access enablement, creating a dangerous mismatch between declared purpose and actual behavior.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/setup_role.py (reported line 44)May include surrounding context.

python

if platform.system() == "Windows":
        # Windows 10+ 的 cmd/PowerShell 支持 ANSI（需 VT100）
        try:
            os.system("")  # 激活 VT100 模式
            return True
        except Exception:
            return False