tencentcloud-oceanus-ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.0.1

Overview

This Oceanus operations skill is not evidently malicious, but it should be reviewed because it can change TencentCloud resources and has under-scoped credential and upload paths.

Review before installing. Use least-privilege and preferably short-lived TencentCloud credentials, avoid storing permanent keys in shell profiles, do not set OCEANUS_ENDPOINT unless you fully trust the destination, validate any COS upload/download URLs before sharing or using them, and manually confirm every resource-changing operation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/client.py:32

Finding

Unvalidated API Endpoint Override Exposes Credential Material and Workload Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/resource_management.py:221

Finding

Local Files Can Be Uploaded to an Unvalidated Presigned URL

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/credential-setup.md:33

Finding

Long-Lived Cloud Credentials Are Persisted in Plaintext

Content

View full analysis

> ~/.zshrc <<'EOF' # TencentCloud Oceanus credentials export TENCENTCLOUD_SECRET_ID="" export TENCENTCLOUD_SECRET_KEY="" # export TENCENTCLOUD_SECURITY_TOKEN="" EOF chmod 600 ~/.zshrc source ~/.zshrc ``` ```bash cat >> ~/.bashrc <<'EOF' # TencentCloud Oceanus credentials export TENCENTCLOUD_SECRET_ID="" export TENCENTCLOUD_SECRET_KEY="" # export TENCENTCLOUD_SECURITY_TOKEN="" EOF chmod 600 ~/.bashrc source ~/.bashrc ``` The guide also recommends persistent user-level environment variables on Windows: ```powershell [Environment]::SetEnvironmentVariable( "TENCENTCLOUD_SECRET_ID", "", "User" ) [Environment]::SetEnvironmentVariable( "TENCENTCLOUD_SECRET_KEY", "", "User" ) ``` ```cmd setx TENCENTCLOUD_SECRET_ID "" setx TENCENTCLOUD_SECRET_KEY "" ``` The placeholder values above represent the credential placeholders in the audited guide; no real credential values were present in the repository. ### Technical Analysis The instructions persist reusable TencentCloud credentials in plaintext shell initialization files or user-level operating-system environment configuration. Restricting a Unix startup file to mode `0600` reduces exposure to other local users, but it does not encrypt the credentials or protect them from: - Malware or compromised applications running under the same account. - Accidental inclusion in backups or support bundles. - Developer tools and extensions that can read user files. - Processes that inherit the environment. - Diagnostic collection and process inspection. - Unintended disclosure of shell co ...[truncated 1674 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (47)

Tainted flow: 'req' from os.environ.get (line 196, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The request destination is derived from the OCEANUS_ENDPOINT environment variable and then used to build the signed request URL and Host header. In an agent or automation context, environment variables are part of the execution trust boundary; if an attacker can influence them, they can redirect requests to an arbitrary host and receive authenticated API payloads and headers, enabling SSRF-style egress and possible credential/signature misuse against a malicious endpoint.

Content

Scanner excerpt · scripts/client.py (reported line 202)May include surrounding context.

python

headers=headers,
            method="POST",
        )
        resp = urlopen(req, timeout=max(connect_timeout, read_timeout))
        resp_body = json.loads(resp.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

- `scripts/unit_test.py` — offline unit tests for pure-logic helpers (no network / no credentials). Run via `python scripts/unit_test.py` or `python -m unittest

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 96% confidence

Finding

The phrase 'bypass safety check' explicitly instructs the operator to override a protective control for mutation/destructive operations. In an operational skill that can create, modify, run, and stop production Oceanus jobs, normalizing safety-bypass language increases the chance that an agent or user treats confirmation as a mere formality rather than a deliberate authorization step.

Content

Scanner excerpt · references/command-map.md (reported line 86)May include surrounding context.

For mutation/destructive operations

text

--confirm                  # Required flag to bypass safety check

Safety Level Definitions

Instruction Override

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

This wording functions like an instruction to override a safety mechanism by presenting --confirm as the way to get past protections. Even though it is documentation rather than executable code, agent skills use such mappings operationally, so this can steer downstream automation to append --confirm routinely and suppress meaningful human-in-the-loop checks.

Content

Scanner excerpt · references/command-map.md (reported line 86)May include surrounding context.

For mutation/destructive operations

text

--confirm                  # Required flag to bypass safety check

Safety Level Definitions

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/command-map.md (reported line 86)May include surrounding context.

For mutation/destructive operations

text

--confirm                  # Required flag to bypass safety check

Safety Level Definitions

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/credential-setup.md (reported line 25)May include surrounding context.

md

| `TENCENTCLOUD_SECRET_KEY`       | Yes              | Matching secret key |
| `TENCENTCLOUD_SECURITY_TOKEN`   | Only for STS     | Temporary credential token |

Get keys from the [腾讯云 CAM 控制台](https://console.cloud.tencent.com/cam/capi).

## Persistent configuration templates by OS

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

"不用确认草稿". Implied urgency or convenience is NOT sufficient.
2. When the draft summary is displayed, you MUST present it to the user and
   **wait for explicit approval** ("确认发布", "OK", "没问题", "发布吧")
   before proceeding. Do NOT auto-approve on behalf of the user.
3. If the CLI outputs the draft to a temporary file, read and display the
   key changes (SQL diff / resource changes / config deltas) to the user.
4. Violation of this gate is a **critical protocol breach** — equivalent to

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

3. If the CLI outputs the draft to a temporary file, read and display the
   key changes (SQL diff / resource changes / config deltas) to the user.
4. Violation of this gate is a **critical protocol breach** — equivalent to
   executing a destructive operation without consent.

- `--skip_draft_confirm`: skip the review (**automation-only flag**; agent
  must NEVER use it unless user explicitly opted out of review).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

1. NEVER read, print, or echo their values (no `echo $TENCENTCLOUD_*`,
   `env | grep TENCENT`, `printenv`, …).
2. NEVER ask the user to paste keys into chat. Have them configure locally.
3. Never embed credentials in command arguments or generated files. The CLI
   reads them from the environment.
4. If a tool result accidentally surfaces a credential value, redact it

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The protocol classifies check_sql as both a read operation and a write operation that modifies draft state, creating ambiguity about whether side effects occur. In an agentic execution setting, that inconsistency can cause the agent to run a state-changing command under weaker safeguards than intended, leading to unauthorized or unexpected modifications.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agent-operating-protocol.md (reported line 21)May include surrounding context.

md

- Folder: `describe_folder`, `query_folder`
- Resource: `describe_tree_resources`, `create_presigned_url`

**Rule**: Execute immediately without confirmation.

### Mutation Operations (create/modify resources)
- Job: `create_job`, `create_job_config`, `run_jobs`, `trigger_savepoint`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Treating a broad direct-imperative phrase like "帮我创建" as implicit approval weakens the explicit confirmation barrier for mutation operations. An attacker or ambiguous prompt can trigger resource creation without a distinct consent step, especially in multi-turn conversations where user intent may be inferred incorrectly.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The protocol explicitly allows modify_draft and check_sql to execute without confirmation because they are considered safe, even though at least one of them modifies draft state. Removing confirmation for state-changing actions enables silent changes to user assets or configurations, which is especially risky in an agent that may act on ambiguous user instructions.

Content

Scanner excerpt · references/agent-operating-protocol.md (reported line 30)May include surrounding context.

md

**Rule**: Require `--confirm` flag. If user gives direct imperative ("帮我创建"), treat as approved.

### Write Operations (safe, no confirmation needed)
- `modify_draft`, `check_sql`

**Rule**: Execute directly (no `--confirm`). These modify draft state but are safe / idempotent.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file documents the delete_folders command as destructive but does not include any user-facing warning, safeguard note, or confirmation requirement in the description. For markdown files, destructive behaviors that could affect user data or system integrity should be accompanied by explicit warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The stop_jobs command is marked as destructive, but the catalog entry does not warn users that stopping running jobs may interrupt workloads or affect system state. In markdown documentation, potentially disruptive operations should include clear user warnings.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/credential-setup.md (reported line 43)May include surrounding context.

export TENCENTCLOUD_SECRET_KEY="你的SecretKey"

export TENCENTCLOUD_SECURITY_TOKEN="你的Token" # 仅临时凭证需要

EOF chmod 600 ~/.zshrc source ~/.zshrc

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/credential-setup.md (reported line 57)May include surrounding context.

export TENCENTCLOUD_SECRET_KEY="你的SecretKey"

export TENCENTCLOUD_SECURITY_TOKEN="你的Token" # 仅临时凭证需要

EOF chmod 600 ~/.zshrc source ~/.zshrc

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/credential-setup.md (reported line 70)May include surrounding context.

export TENCENTCLOUD_SECRET_KEY="你的SecretKey"

export TENCENTCLOUD_SECURITY_TOKEN="你的Token" # 仅临时凭证需要

EOF chmod 600 ~/.zshrc source ~/.zshrc

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The fish-shell template persists long-lived cloud credentials to disk in a shell startup file, which increases the exposure window if the local account, backups, dotfile sync, or developer tooling are compromised. Although the file recommends restrictive permissions and never pasting secrets into chat, persistent plaintext storage of access keys is still a real security concern in an ops skill context.

Content

Scanner excerpt · references/credential-setup.md (reported line 64)May include surrounding context.

Linux / macOS with fish shell — ~/.config/fish/conf.d/tencentcloud.fish

fish

mkdir -p ~/.config/fish/conf.d
cat > ~/.config/fish/conf.d/tencentcloud.fish <<'EOF'
set -gx TENCENTCLOUD_SECRET_ID "你的SecretId"
set -gx TENCENTCLOUD_SECRET_KEY "你的SecretKey"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The section is explicitly titled 'Reusable Chinese reply template' and mandates a Chinese response template for the agent. This is a natural-language locale constraint, but the file does not offer user opt-in or explain a justified region-specific requirement, which fits the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/error-handling.md (reported line 84)May include surrounding context.

md

| Code | Meaning | Recovery |
|------|---------|----------|
| MissingCredentials | Env vars not set | **Stop execution** and guide the user to persist credentials in a shell/OS config file based on their OS (macOS → `~/.zshrc`; Linux bash → `~/.bashrc`; fish → `~/.config/fish/conf.d/*.fish`; Windows → `setx` / `[Environment]::SetEnvironmentVariable(... "User")`). Never ask the user to paste secrets into chat, never echo/print env vars, and never write keys to repo files. See `references/credential-setup.md` for the full per-OS template and the `MissingCredentials` recovery flow. |
| ValidationError | Required parameter missing | Add the missing --parameter |
| SafetyCheckRequired | Mutation without --confirm | Add --confirm flag |
| Cancelled | User cancelled interactively | Re-run with --confirm if intended |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown file uses Chinese throughout its operational instructions, examples, and error guidance, which effectively forces a specific language for users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; that justification is not stated here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The playbook instructs users to generate pre-signed COS download URLs for job logs but does not warn that these URLs confer temporary direct access to potentially sensitive operational data and can be shared or leaked via terminals, chat, tickets, or shell history. In an observability/ops context, logs often contain stack traces, identifiers, endpoints, and occasionally secrets, so omission of handling guidance materially increases the chance of unintended disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains user-facing operational instructions in Chinese and does not indicate that language selection is optional. The policy explicitly calls for flagging language or locale constraints when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.