tencentcloud-oceanus-ops

• Outcome: Review
• Latest audit: Jul 24, 2026 · 6:55 AM UTC
• Version: 1.0.1

Overview

The skill appears purpose-built for TencentCloud Oceanus operations, but it needs Review because it can make real cloud changes and has under-scoped credential and data-exposure paths.

Install only for trusted Oceanus operators using least-privilege TencentCloud CAM credentials. Keep OCEANUS_ENDPOINT unset unless you have verified it is an official trusted TencentCloud endpoint, review every draft summary before publishing, and avoid sharing outputs that contain workspace variable values or COS log download URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tainted flow: 'req' from os.environ.get (line 196, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers=headers,
            method="POST",
        )
        resp = urlopen(req, timeout=max(connect_timeout, read_timeout))
        resp_body = json.loads(resp.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: resp = urlopen(req, timeout=max(connect_timeout, read_timeout))

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill explicitly authorizes Bash/Read/Write and instructs the agent to execute a Python CLI that reads credentials from environment variables and makes live TencentCloud API calls. This creates effective shell, file, environment, and network capabilities without a precise permission model or operation-level sandbox, so prompt-triggered misuse could lead to unauthorized cloud mutations or data exposure.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The protocol classifies `check_sql` as both a read-only operation and a write operation that modifies draft state, creating ambiguity about whether side effects occur. This can cause an agent to invoke a state-changing action under relaxed approval rules, leading to unintended draft modification or unsafe automation assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The command returns workspace variable records including the Value field for Type=VISIBLE variables and emits them directly in output. In an agent skill context, that broadens the data exposure surface to include configuration secrets or sensitive runtime parameters that users may not realize are being disclosed, especially if variables are reused for credentials, endpoints, or tokens.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This catalog exposes destructive and high-impact operational commands such as stopping jobs and deleting folders without any adjacent warning, confirmation, or operator-safety guidance. In an ops skill for production streaming workloads, that omission increases the chance an agent or user will invoke service-affecting actions too casually, leading to outages, data loss, or disruption of running pipelines.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This workflow shows a direct publish step for JAR job changes without an explicit requirement to present the final draft summary and obtain user approval immediately beforehand. In an operational skill that can change production streaming jobs, this increases the risk of accidental or unauthorized configuration publication, especially if an agent executes the playbook mechanically.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The resource update/removal workflows proceed from draft modification or SQL check to publishing without an explicit user-approval gate in those scenario sections. Because modify_draft fully overrides ResourceRefs, an agent following this playbook could accidentally remove or alter dependencies and publish disruptive changes to running data-processing jobs without a final human verification step.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The command enumerates COS log files and automatically generates presigned download URLs for each object, then returns them directly in output. Job logs often contain sensitive operational data, stack traces, credentials, tokens, or user data; exposing ready-to-use download links increases the chance of accidental disclosure through terminal history, logs, chat transcripts, or downstream tooling, even if the caller is otherwise authenticated.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The trigger_savepoint command performs a real state-changing runtime action by calling TriggerJobSavepoint after only checking job status, with no confirmation gate like the destructive runtime operations elsewhere in the file. In an agent/CLI context, this increases the chance of unintended operational changes, unnecessary checkpoint/savepoint generation, storage/resource consumption, and workflow disruption from a misinterpreted or overly broad user request.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code retrieves and prints variable values without any user-facing warning or confirmation that sensitive contents may be exposed. In a conversational or tool-using agent setting, this increases the risk of accidental secret disclosure into chat transcripts, logs, or downstream tools, making the skill context more dangerous than a local admin-only CLI.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Rule**: Require `--confirm` flag. If user gives direct imperative ("帮我创建"), treat as approved.

### Write Operations (safe, no confirmation needed)
- `modify_draft`, `check_sql`

**Rule**: Execute directly (no `--confirm`). These modify draft state but are safe / idempotent.

• Confidence: 91% confidence
• Finding: no confirmation

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/credential-setup.md:84

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/unit_test.py:118