tencentcloud-api-skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed Tencent Cloud CLI helper that can manage cloud resources, with real cloud-operation risk but no evidence of hidden, deceptive, or unrelated behavior.

Install tccli only from trusted Tencent Cloud sources, prefer least-privilege CAM credentials, review every create/modify/delete command for cost and production impact before approving it, and avoid exposing or printing local credential files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/install.md:7

Finding

Unpinned and Mutable TCCLI Installation Sources

Content

View full analysis

Vulnerability Details

File Location: references/install.md, lines 7–20
Vulnerability Type: Unpinned third-party dependencies and mutable source installation
Risk Level: Medium

Complete Code Snippet:

sh

# Method 1: pip (recommended for Windows / macOS / Linux)
pip install tccli

# When upgrading from a version earlier than 3.0.252.3:
# pip uninstall tccli jmespath && pip install tccli

# Method 2: macOS Homebrew
brew tap tencentcloud/tccli
brew install tccli
# Update: brew upgrade tccli

# Method 3: source installation
# git clone https://github.com/TencentCloud/tencentcloud-cli.git && cd tencentcloud-cli && python setup.py install

Technical Analysis

The documented installation methods retrieve mutable upstream content without pinning a reviewed package version, source commit, dependency lock file, checksum, or cryptographic signature. pip install tccli may also retrieve and execute build or installation logic from transitive dependencies. The Homebrew commands trust the current state of an external tap, while the source method clones the repository's current default branch and runs its setup script.

The source-installation command is commented documentation rather than automatically executed code. Its URL points to the TencentCloud GitHub organization, not a personal pastebin or code-hosting account. Nevertheless, a user following the instruction would download and execute mutable remote code.

These installation privileges are not intrinsically required for every invocation of the Skill. Installation should be a separate, explicit prerequisite performed with ordinary user privileges and verified artifacts. The Skill does not instruct users to run the commands as root, which limits but does not eliminate the risk.

Attack Path

1. An attacker compromises an upstream package release, GitHub repository branch, Homebrew tap, maintainer account, or transiti ...[truncated 1307 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin TCCLI to a reviewed version, such as pip install tccli==<approved-version>.
2. Publish and verify SHA-256 hashes or trusted package signatures before installation.
3. Pin all transitive dependencies with a reviewed lock file and hash verification, such as pip's --require-hashes.
4. For source installation, use a reviewed immutable commit or signed release tag rather than the default branch.
5. Replace the deprecated python setup.py install workflow with a verified wheel or standards-based build and installation process.
6. Pin the Homebrew formula or document the exact reviewed release instead of relying on the tap's current mutable state.
7. Perform installation in an isolated virtual environment under a non-administrative account.
8. Keep installation separate from normal Skill execution and require explicit user approval before downloading or installing software.
9. Advise users to apply least-privilege Tencent Cloud CAM policies so compromise of a local credential cannot expose unrelated cloud resources.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly supports creating, modifying, and deleting cloud resources, which can cause destructive changes, outages, or unexpected charges if invoked without strong user confirmation or a clear warning. In a cloud automation context this is more dangerous because the commands operate against real production resources and billing-bearing APIs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The display name, description, keywords, and prompt template are entirely in Chinese, indicating a fixed language/locale expectation. The file does not offer opt-in language selection or explain that the skill is intentionally limited to Chinese-speaking users for a documented regional or compliance reason.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest frames this as a skill to call Tencent Cloud APIs for cloud automation and resource management. Line L098 instructs the agent to run tccli auth login, which launches a local port and waits for browser OAuth interaction; that is an account-authentication capability rather than direct cloud resource API invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.