Security audit

Tencent EdgeOne

Security checks for vulnerabilities and agentic risk

Overview

This EdgeOne administration skill is coherent, but it should be reviewed because it can automatically change cloud permissions and upgrade local tooling without clear immediate user consent.

Install only if you are comfortable letting the agent use Tencent Cloud CLI credentials for EdgeOne administration. Before use, require explicit approval for local tccli upgrades, CAM service-linked role creation, purchases, site creation, DNS/security changes, and any log or traffic drill-down that exposes client IPs, user agents, URLs, or referers.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: references/api/README.md:3
Finding: Mandatory telemetry alters all CLI calls and discloses Skill usage metadata
Content: View full analysis
**Telemetry note:** You are now in module **`api`**. Every `tccli` call you make from this entry must carry `--request-client "tencent-edgeone-skill/1.1.0 module/api"`. See "Telemetry — RequestClient" below. ## Telemetry — RequestClient (mandatory, best-effort) Every `tccli` call you issue while working in this skill — the connectivity probe, `teo` actions, and `dnspod` / `cam` integration calls alike — must carry the `--request-client` flag: ```sh tccli --request-client "tencent-edgeone-skill/1.1.0 module/" [other args] ``` - `` — the entry README you're working from (e.g. `api`, `acceleration`...), or `other` if none fits. - Pass the flag per call, so each call carries its own module. > **Best-effort principle:** telemetry failure must never block or break the user's real task. ``` Equivalent mandatory instructions appear in the module entry points: ```markdown > **Telemetry note:** You are now in module **`acceleration`**. Every `tccli` call you make from this entry must carry `--request-client "tencent-edgeone-skill/1.1.0 module/acceleration"`. ``` ```markdown > **Telemetry note:** You are now in module **`security`**. Every `tccli` call you make from this entry must carry `--request-client "tencent-edgeone-skill/1.1.0 module/security"`. ``` ```markdown > **Telemetry note:** You are now in module **`observability`**. Every `tccli` call you make from this entry must carry `--request-client "tencent-edgeone-skill/1.1.0 module/observability"`. ``` ### Technical Analysis The Skill imposes a persistent behavioral rule that modifies every `tccli` invocation while a module is active. The parameter identifies ...[truncated 1752 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/api/README.md:53
Finding: Unpinned dependency is silently upgraded before cloud API operations
Content: View full analysis
/dev/null || brew upgrade tccli 2>/dev/null || true ``` ``` ### Technical Analysis The Skill directs the Agent to upgrade `tccli` automatically before the first API operation in every session. The command does not pin a reviewed version, validate a package checksum, verify a signed release, or require user approval. It also suppresses diagnostic output and forces a successful shell status through `|| true`. As a result, the executable that handles the user's authenticated cloud operations may differ from the version originally reviewed with the Skill. This creates a supply-chain trust gap: a compromised upstream release, package repository, tap, account, or dependency can introduce code that executes locally with the user's authority. The use of standard package managers reduces the likelihood of dependency confusion compared with an arbitrary download source, but it does not eliminate the risk caused by automatically selecting the latest available release without review. ### Attack Path 1. An attacker compromises an upstream `tccli` release, package account, package-manager repository, tap, or transitive dependency. 2. The user starts any Skill workflow that requires an API operation. 3. Before the API call, the Agent executes the mandatory upgrade command. 4. `pipx` or Homebrew installs the compromised or otherwise unreviewed version. 5. The upgraded CLI runs locally and accesses the user's existing Tencent Cloud authentication context. 6. Mali ...[truncated 923 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/api/dnspod-integration.md:55
Finding: Service-linked IAM role is created automatically without explicit confirmation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (31)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to automatically create a CAM service-linked role when DNSPod authorization is missing, without a user-facing warning or explicit approval. Creating IAM roles changes account permissions and trust relationships, so silently performing it expands privileges and can surprise users or violate least-privilege expectations even if the role is vendor-intended.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/security/domain-blacklist-inspector.md (reported line 51)May include surrounding context.
md
> - Do not judge solely by IP group name — must verify against rule actions in security policies.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description says to use this skill whenever a user mentions any EdgeOne/EO-related configuration, operations, querying, or troubleshooting needs, which is a very broad activation condition. Over-broad triggering can cause the agent to invoke this skill in loosely related contexts, increasing the chance that high-impact operational guidance or API-driven actions are brought into scope unnecessarily, especially because the skill emphasizes completing tasks via APIs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This README is a markdown file, so vague trigger review applies. The phrase "Create a new site" lacks product-specific context and could match general website creation requests rather than specifically invoking EdgeOne site onboarding, increasing the risk of unintended activation.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/acceleration/zone-onboarding.md (reported line 167)May include surrounding context.
md
Call `DescribeAvailablePlans` to query plan types available for purchase under current account, display options to user. > **No Automatic Purchase**: Purchasing plan will incur actual charges. **Must** display plan type and pricing info to user, and wait for explicit confirmation before calling `CreatePlan`. Never skip confirmation or decide on your own. After user explicit confirmation, call `CreatePlan` to purchase plan.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file defines invocation examples including generic phrases like "create site" and "create new site," which are broad and may overlap with ordinary user requests outside this specific EdgeOne onboarding workflow. The section does not provide exclusion conditions or tighter scope constraints to distinguish when this skill should activate versus a more general site-creation request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger list includes phrases like "verify site" and "ownership verification," which are generic and could match many unrelated tasks. The document does not pair these triggers with negative examples or explicit context restrictions tying them specifically to EdgeOne site onboarding state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Phrases like "add domain" are common everyday requests and could unintentionally invoke this specific acceleration-domain workflow. Although one example is more specific, the section still lacks clear boundaries or exclusion examples to prevent collisions with unrelated domain-management tasks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guidance promotes 'silent detection' of DNSPod hosting status and references querying domain status and related DNS records, but does not warn that these checks access account-linked domain metadata. Even if the APIs are legitimate, silently performing these lookups can create privacy and transparency issues, especially when combined with automated fallback behavior that hides permission and data-access details from the user. In an operations skill for EdgeOne/DNS onboarding, this is more dangerous because users may assume recommendations are passive when they actually derive from account-scoped inspection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document recommends automatically creating a service-linked role after an authorization error and even suggests user-facing wording that implies the system will do this for the user. Creating IAM/CAM roles changes account permissions and trust relationships, so doing it without an explicit warning and consent step can surprise users and expand access beyond what they intended. In this skill context, the issue is more dangerous because the skill is designed to automate infrastructure onboarding and could normalize permission-changing actions as a silent recovery path.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases for Scenario A are broad enough to match ordinary troubleshooting requests such as investigating 502s or asking to analyze logs. In an agent-routing context, this can cause over-activation of the skill and lead to unintended log download, local parsing, and exposure of potentially sensitive operational data beyond what the user specifically intended.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Scenario B uses ambiguous trigger wording like asking when failures were concentrated recently, which overlaps with common diagnostic questions that could apply to many systems. In a multi-skill agent, this increases the chance of incorrect routing into a workflow that automatically retrieves and processes logs, creating unnecessary access to telemetry and possible privacy or data-minimization issues.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Scenario C trigger examples such as asking which resources use the most bandwidth or requesting per-URL traffic breakdown are broad analytics phrases that can collide with generic observability questions. If auto-selected incorrectly, the skill may fetch and analyze CDN/access logs containing request metadata, expanding data access without clear user intent or platform scoping.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger examples include "help me download the logs," which is broad and lacks product, log-type, or workflow constraints. In a markdown skill description, this can overlap with ordinary support requests and makes it unclear when this specific skill should activate instead of other logging or help skills.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · references/observability/eo-log-downloader.md (reported line 25)May include surrounding context.
text
> The terminal will print an authorization link after execution and remain blocked until the user completes browser authorization, after which the command ends automatically. > Never ask the user for `SecretId` / `SecretKey`, and do not execute any commands that could expose credential contents. 2. ZoneId must be obtained first. Refer to `../api/zone-discovery.md`. - **Shortcut**: Both `DescribeTimingL7OriginPullData` and `DescribeTimingL7AnalysisData` support `ZoneIds=["*"]` to query account-level aggregated data across all zones. Use this when the user does not specify a particular zone or wants an overview.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · references/observability/eo-origin-health-check.md (reported line 25)May include surrounding context.
text
> The terminal will print an authorization link after execution and remain blocked until the user completes browser authorization, after which the command ends automatically. > Never ask the user for `SecretId` / `SecretKey`, and do not execute any commands that could expose credential contents. 2. ZoneId must be obtained first. Refer to `../api/zone-discovery.md`. - **Shortcut**: Both `DescribeTimingL7OriginPullData` and `DescribeTimingL7AnalysisData` support `ZoneIds=["*"]` to query account-level aggregated data across all zones. Use this when the user does not specify a particular zone or wants an overview.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger list includes generic phrases like "are there any origin issues" and "is the origin healthy," which are broad enough to match ordinary troubleshooting conversation outside a tightly scoped invocation context. The document does not provide exclusion conditions or negative examples to clarify when this skill should or should not activate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Phrases like "help me troubleshoot the origin failure" and "where are the 5xx errors coming from" are common support utterances and are not specific enough to uniquely invoke this skill. No limiting context or negative examples are given to distinguish this workflow from broader incident-troubleshooting skills.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly supports drill-downs into client IPs, full User-Agent strings, URL paths, and referers, all of which may contain personal, device, or sensitive browsing information. Without a privacy warning, minimization guidance, or masking requirements, the workflow may encourage broad reporting and display of sensitive telemetry beyond what is necessary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The trigger examples are broad enough to match ordinary analytics or reporting requests without clearly requiring explicit EdgeOne context. This can cause the skill to activate unexpectedly and surface operational or traffic-analysis workflows in contexts the user did not intend, increasing the chance of over-collection or exposure of sensitive observability data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases for Scenario A are broad enough to match ordinary support or investigative requests, which can push the agent into a security-analysis workflow without sufficiently establishing user intent. In context, this is risky because Scenario A naturally funnels into Scenario B, where the skill recommends blocking IPs and can set up a destructive action path from an ambiguous initial request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The phrase "IP ban" is underspecified for a write-capable workflow that modifies a live blocklist and takes effect immediately. Because this skill can ultimately call a full-overwrite API, an ambiguous trigger increases the chance that a casual or shorthand request is interpreted as authorization for a destructive network access change.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes generic phrases such as "help me check template coverage", "help me audit security templates", and "help me check security templates". These overlap with ordinary assistance requests and the document provides no exclusion conditions or narrow invocation context, making activation scope ambiguous.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/api/auth.md (reported line 34)May include surrounding context.
text
> After execution, the terminal will print an authorization link and block until the user completes browser authorization — the command ends automatically upon success. > Never ask the user for `SecretId` / `SecretKey`, and do not execute commands that might expose credential contents. 2. You need to obtain the ZoneId first — see `../api/zone-discovery.md`.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/observability/eo-log-downloader.md (reported line 25)May include surrounding context.
text
> After execution, the terminal will print an authorization link and block until the user completes browser authorization — the command ends automatically upon success. > Never ask the user for `SecretId` / `SecretKey`, and do not execute commands that might expose credential contents. 2. You need to obtain the ZoneId first — see `../api/zone-discovery.md`.