T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:17- Finding
Unverified Remote Executable Download and Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
ucloud cli
Security checks for vulnerabilities and agentic risk
Overview
This UCloud skill mostly matches its cloud-operations purpose, but it needs review because it can install a CLI, use local cloud profiles, create public billable resources by default, and expose login credentials.
Review this skill before installing. Use it only with a least-privilege UCloud profile and a non-production project where possible. Require explicit confirmation before any create, update, delete, EIP binding, or public exposure; verify the UCloud CLI release yourself before installation; avoid fixed shared temporary files for API payloads; and do not allow host passwords or other login credentials to be printed in chat summaries. If any credential has already been displayed, rotate it.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:91- Finding
Predictable Shared Temporary File for Cloud API Payloads
- Content
View full analysis
/tmp/ucloud-request.json << 'EOF' { "Action": "DescribeULB", "ULBId": "ulb-xxxx" } EOF ucloud --profile prod-account api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json ``` A second documented payload demonstrates that the same predictable file may contain credentials: ```bash cat > /tmp/ucloud-request.json << 'EOF' { "Action": "CreateUHostInstance", "Region": "cn-bj2", "Zone": "cn-bj2-05", "ImageId": "uimage-xxx", "LoginMode": "Password", "Password": "GENERATED_PASSWORD" } EOF ucloud --profile prod-account api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json ``` ### Technical Analysis The Skill repeatedly uses the fixed path `/tmp/ucloud-request.json`. Shared temporary directories are normally writable by other local users. Shell redirection does not create the file with exclusive semantics and follows symbolic links. An attacker can pre-create the predictable path as a symbolic link to another file writable by the victim, causing the redirection to overwrite that target. The attacker may also monitor, read, replace, or modify the payload between creation and CLI consumption, depending on file ownership, permissions, and local race conditions. The examples do not set a restrictive `umask`. Consequently, the resulting file permissions depend on the ambient process configuration and may expose payload contents to other local users. This is especially serious because the documented payload format may include generated instance passwords and mutation actions. The fixed name also causes collisions between concurrent Skill executions. One invocation can overwrite ...[truncated 1633 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/deployment.md:7- Finding
Cloud Host Login Credentials Included in User-Facing Summaries
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/products/eip.md:3- Finding
Automatic Creation and Binding of a Public IP Address
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## 凭据约定 官方 CLI 将 profile 存储在 `~/.ucloud/config.json` 和 `~/.ucloud/credential.json` 中。 将 profile 作为本技能的主要凭据来源。 CLI 提供 `ucloud auth login`、`ucloud init`、`ucloud config add`、`ucloud config update` 和 `ucloud config list`。优先使用 OAuth 登录处理交互式人工授权；AK/SK 初始化和配置变更是敏感操作，因为 `config add/update` 的 flag 包含 public key 和 private key。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"Action":"ListRegions"} EOF ucloud api --local-file /tmp/ucloud-request.json rm -f /tmp/ucloud-request.json # ListZones（需要 Region） cat > /tmp/ucloud-request.json << 'EOF'
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the agent to display sensitive access details, including login credentials, after resource creation. In a cloud operations context, exposing credentials in normal output can leak secrets through chat history, logs, screenshots, downstream tool telemetry, or to unintended viewers, enabling unauthorized access to newly created infrastructure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Displaying newly created resource login credentials in plain-language output is a direct secret disclosure risk. Because this skill performs real UCloud resource operations, any leaked initial password could allow immediate compromise of the instance or service, especially if the account is privileged and the credential persists beyond first use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The top-level description says the skill should be used whenever a user wants to deploy a web app or put a service online, even if they did not explicitly ask for a cloud product. That broad trigger can cause the agent to select a real cloud-operation skill for vague deployment discussions, raising the risk of unintended infrastructure actions against a live account.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The 'strong trigger signal' list contains broad natural-language phrases like deploying a web program, putting a service online, or opening public access, without boundary conditions. In a high-impact cloud skill, such ambiguous activation logic can misroute ordinary planning requests into a tool that performs live infrastructure operations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
L136 规定“默认使用简洁的 Markdown”并配合固定标签，但全文整体以中文指令强约束输出行为，未见向用户提供语言选择或在用户偏好非中文时切换的说明。对语言/locale 的默认强制如果没有用户选择机制，可能违反语言选择相关组织政策。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill includes a generic shell recipe to generate passwords using /dev/urandom, which is not necessary for operating UCloud resources and expands the skill into unrelated secret-generation behavior. In an agent setting, this can encourage the model to create or handle credentials outside the cloud platform’s managed flows, increasing the chance of insecure secret handling or inappropriate use in unrelated contexts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON eval file contains all prompts, expectations, and assertions exclusively in Chinese and implicitly evaluates the skill in that language. There is no natural-language indication that language selection is optional or user-driven, so the file enforces a specific locale without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
标题及全文均以中文编写，未见提供语言/locale 选择、用户 opt-in，或说明该技能仅适用于特定中文场景。根据规则，强制特定语言而无选择属于自然语言策略违规。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The markdown describes activation based on broad phrases such as “部署我的 WEB 服务” and “把这个站点上线”, then generalizes to WEB or generic application deployment requests. It does not define clear exclusions or negative examples, so ordinary conversational deployment requests could ambiguously trigger this skill in unintended contexts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file title and all user-facing guidance are written in Chinese, with no indication that the user can choose another language or that the skill is restricted to a Chinese-speaking context. This creates a natural-language policy issue because it effectively imposes a locale on users without opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file’s title and all operational instructions are written only in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language context. This creates a natural-language policy concern because it implicitly enforces a locale/language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file content is entirely in Chinese and provides operational guidance without indicating that language selection is optional or limited to a region-specific use case. This creates a natural-language policy concern because it effectively imposes a locale on users without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file is written entirely as Chinese-only product rules and maps product terminology in Chinese, but it does not indicate that the language restriction is optional or limited to a region-specific use case. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language fields
short_descriptionanddefault_promptare written only in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative language is offered. The file does not document that the skill is region-specific or that Chinese is an intentional, justified locale constraint.- Content
Static analysis
No suspicious patterns detected.