Cloud Storage Manager Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.0

Overview

The cloud-storage purpose is legitimate, but the skill asks an agent to run an unspecified CLI with cloud credentials and has mismatched activation/scoping instructions.

Review before installing. Only use this skill after verifying the exact `csm` executable source, version, checksum/signature, and path. Prefer provider-native credential chains, OS keychains, or secret managers; avoid passing secrets on command lines, use least-privilege short-lived credentials, and confirm where any local credential files or scheduled sync state will be written.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:163

Finding

Cloud credentials are exposed through command-line arguments

Content

View full analysis

.r2.cloudflarestorage.com ``` ### Technical Analysis The documented commands expand credential-bearing environment variables into command-line arguments. After shell expansion, the access keys and secret keys become part of the `csm` process argument vector. Depending on the operating system, process isolation, logging configuration, and execution environment, command arguments may be exposed through: - Process inspection utilities and operating-system process interfaces. - Agent or terminal command telemetry. - Shell tracing, debugging, and audit systems. - Process supervisors, command wrappers, or endpoint-monitoring products. - Crash diagnostics or error reporting that records the complete command. Passing credentials this way is unnecessary for the declared cloud-storage functionality. Provider-native credential chains, protected standard input, operating-system secret stores, or securely permissioned configuration files can supply the same credentials without placing them in the argument vector. ### Attack Path 1. A user or Agent follows the documented `csm config add` command. 2. The shell replaces variables such as `$AWS_SECRET_ACCESS_KEY` and `$R2_SECRET_KEY` with their plaintext values. 3. The expanded values are passed to `csm` as process arguments. 4. A local process, monitoring component, audit facility, or command-logging integration captures the argument vector. 5. An attacker with access to that captured information extracts the cloud credentials. 6. The attack ...[truncated 891 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:163

Finding

Unverified executable receives cloud credentials and file access

Content

View full analysis

.r2.cloudflarestorage.com ``` The same unspecified `csm` command is also used throughout the Skill for transfers, uploads, downloads, synchronization, and configuration operations. ### Technical Analysis The project does not include the `csm` executable and does not identify a verified package, publisher, installation source, version, checksum, signature, or absolute executable path. Consequently, an Agent following the instructions must execute whichever program named `csm` is resolved first through the current `PATH`. This creates a tool-spoofing boundary because the selected executable is entrusted with: - AWS, Cloudflare R2, Azure, and OAuth credentials. - Read access to local files selected for upload. - Write access to local download destinations and checkpoint files. - Access to remote cloud objects. - Potential deletion or synchronization capabilities. The behavior exceeds a safe minimum-trust design because the Skill asks the Agent to send highly sensitive material to an executable whose provenance is not established. ### Attack Path 1. An attacker places a malicious executable named `csm` in a writable directory. 2. That directory appears before the legitimate installation directory in the user's or Agent's `PATH`. This can occur through a compromised project environment, shell configuration, package installation, or writable working directory included in `PATH`. 3. The user asks the Agent to configure or operate cloud storage through this Skill. 4. The Agent invoke ...[truncated 1334 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:358

Finding

AWS CLI installation uses an unpinned package and unverified dependency chain

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Overly broad and unrelated trigger conditions can cause an agent to invoke this skill outside its intended storage-management scope. In an agent ecosystem with read/write/exec privileges, misrouting increases the chance of inappropriate file operations, credential handling, or command execution in contexts where the user did not intend storage actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill explicitly defines a local credentials file containing cloud access keys, OAuth client secrets, refresh tokens, and connection strings. Even though environment-variable placeholders are shown, encouraging centralized plaintext credential material in a predictable filesystem location materially increases the risk of secret exposure through local compromise, backups, logs, accidental sharing, or overly permissive file handling.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

凭据配置文件

yaml

# ~/.csm/credentials.yaml
providers:
  s3:
    access_key: ${AWS_ACCESS_KEY_ID}

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L054将免费版限制写为“单次单源单目标”，但L114-L120示例中的 --targets azure-blob://...,b2://... 明确表示一次操作可同时写入两个目标。该冲突会误导用户对技能实际能力边界的理解，属于文档意图与所描述行为直接矛盾。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

整个文档将技能定位为多云存储上传、下载、同步与成本核算工具，但L157却写明“需要项目管理、任务规划、进度跟踪、团队协作时使用”。这不是单纯信息缺失，而是对技能适用场景的直接误述，和前文声明的存储管理用途相冲突。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill describes handling provider credentials and storing data locally, but it does not present a prominent warning or consent flow for sensitive secrets and filesystem writes. In a skill with read/write/exec tools, unclear disclosure increases the risk that users expose tokens, persist secrets insecurely, or allow writes to local paths without understanding the security implications.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

--endpoint https://.r2.cloudflarestorage.com

text

凭据存储在`~/.csm/credentials/`（已chmod 600）。

### Step 2：列出所有已配置Provider

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

L379称免费版聚焦“单源单目标场景”，并在L381否定“批量跨云迁移（多源多目标并发）”；但前文L054列出多Provider接入，L114-L120还给出单次双目标备份示例。用户无法从文档判断免费版究竟是否允许一次多目标跨云写入，构成明显的意图-行为说明不一致。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.