TencentCloud Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:45 AM UTC
• Version: 1.2.0

Overview

This Tencent Cloud management skill is coherent, but it asks users to grant broad cloud-changing access and handle long-lived secrets in ways that need careful review.

Install only if you are comfortable reviewing and narrowing the Tencent Cloud CAM policy first. Use a dedicated sub-user, restrict permissions to specific resources or buckets where possible, avoid printing or sharing .env contents, keep credentials out of Git, and prefer a virtual environment with pinned dependencies instead of --break-system-packages.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:157
• Finding: Unpinned Dependencies Installed into the System Python Environment## Vulnerability Details **File Location**: `SKILL.md:157-161` and `docs/quick-reference.md:9-13` **Vulnerability Type**: Unsafe dependency installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install --break-system-packages \ tencentcloud-sdk-python \ cos-python-sdk-v5 \ python-dotenv ``` ### Technical Analysis The installation instructions retrieve third-party packages from the configured Python package index without pinning package versions or validating integrity hashes. Consequently, the dependency code installed and executed can change after the Skill has been reviewed. The `--break-system-packages` option bypasses protections for externally managed Python environments. This can modify or overwrite packages used by the host operating system or other applications. Installation scripts and imported package code execute with the privileges of the user running `pip3`. The dependency names are consistent with the declared Tencent Cloud functionality, and no evidence indicates that the named packages are intentionally malicious. The risk arises from mutable, unverified supply-chain content and installation into a shared system environment. ### Attack Path 1. A user follows the documented setup instructions. 2. `pip3` resolves the latest available versions from the configured package index. 3. An attacker compromises a dependency release, its maintainer account, the package index, or the dependency-resolution path. 4. The compromised package or transitive dependency executes installation or import-time code. 5. The code gains the privileges of the user running `pip3` and may modify the shared Python environment. 6. Because the Skill later receives Tencent Cloud credentials through environment variables, malicious imported dependency code could potentially access those credentials when the Skill runs. ### Impact Assessment Successful exploitation could execute a ...[truncated 266 chars]
• Remediation: ## Remediation Suggestions 1. Remove `--break-system-packages` from all installation instructions. 2. Require installation inside a dedicated virtual environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 3. Pin every direct and transitive dependency to a reviewed version. 4. Record cryptographic hashes and install with `--require-hashes`. 5. Use a trusted or organization-controlled package index. 6. Add automated dependency vulnerability and provenance scanning. 7. Document the reviewed dependency versions in both `SKILL.md` and `docs/quick-reference.md`.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: docs/permission-policy.md:9
• Finding: Recommended Cloud Policies Grant Account-Wide Resource Access## Vulnerability Details **File Location**: `docs/permission-policy.md:9-35` and `SKILL.md:91-144` **Vulnerability Type**: Excessive cloud authorization and failure to enforce least privilege **Risk Level**: High ### Vulnerable Code ```json { "version": "2.0", "statement": [ { "effect": "allow", "action": [ "cvm:Describe*", "cvm:RunInstances", "cvm:StartInstances", "cvm:StopInstances", "cvm:RestartInstances", "cvm:ModifyInstancesAttribute", "cvm:RenewInstances", "vpc:DescribeSecurityGroups", "vpc:CreateSecurityGroup", "lighthouse:Describe*", "lighthouse:CreateInstance", "lighthouse:StartInstances", "lighthouse:StopInstances", "lighthouse:RestartInstances", "lighthouse:ModifyInstancesAttribute", "lighthouse:RenewInstance", "name/cos:GetBucket", "name/cos:PutBucket", "name/cos:ListBucket", "name/cos:GetObject", "name/cos:PutObject", "name/cos:DeleteObject", "name/cos:PutBucketLifecycle", "name/cos:GetBucketLifecycle" ], "resource": "*" } ] } ``` ### Technical Analysis The recommended “Resource Administrator” policy grants broad mutation and data-access permissions against `"resource": "*"`. It includes wildcard enumeration through `cvm:Describe*` and `lighthouse:Describe*`, instance creation and operational control, security-group creation, COS object reading and deletion, and lifecycle modification. The project recommends a sub-user rather than a primary account, which is a useful boundary. Nevertheless, the policy allows that sub-user to operate across all matching resources in the account instead of restricting it to the instances, buckets, regions, tags, or resource prefix managed by this Skill. This exceeds minimum privilege for common workflows such as status monitoring, promotion lookup, or management of a limited resource set. The specialist templates also retain `"resource": "*"` an ...[truncated 1631 chars]
• Remediation: ## Remediation Suggestions 1. Replace `"resource": "*"` with explicit resource identifiers wherever Tencent CAM supports resource-level authorization. 2. Restrict COS permissions to specifically approved bucket and object prefixes. 3. Restrict compute operations using instance identifiers, regions, project boundaries, tags, or a validated resource-prefix condition. 4. Separate credentials and policies by role: - Read-only inventory and monitoring. - Resource provisioning. - Instance start, stop, and restart. - COS upload and download. - Destructive operations such as object deletion. 5. Exclude `name/cos:GetObject` and `name/cos:DeleteObject` unless the exact workflow requires them. 6. Exclude renewal, creation, attribute modification, and security-group creation permissions from operational roles unless explicitly needed. 7. Require short-lived credentials or role assumption instead of long-lived static keys where supported. 8. Add policy examples scoped to development and production resources separately. 9. Document that the broad administrator template is exceptional rather than recommended. 10. Enable Tencent Cloud audit monitoring and alerts for resource creation, destructive COS operations, lifecycle changes, and unusual instance-control activity.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cp skills/tencentcloud-manager/config/.env.example \
   skills/tencentcloud-manager/config/.env

vim skills/tencentcloud-manager/config/.env
```

• Confidence: 84% confidence
• Finding: The instructions direct users to create and edit a local .env file for cloud API secrets, which establishes a plaintext credential storage pattern. In the context of a cloud-resource management skill with create/modify permissions, stolen credentials could allow unauthorized provisioning, data access, or service disruption.

Credential Access

High

• Category: Privilege Escalation

Content

cp skills/tencentcloud-manager/config/.env.example \
   skills/tencentcloud-manager/config/.env

vim skills/tencentcloud-manager/config/.env
```

```bash

• Confidence: 83% confidence
• Finding: Referencing editing of the .env file reinforces handling secrets in a locally editable plaintext file without accompanying safeguards. Because the skill manages Tencent Cloud resources, exposure of these credentials could enable unauthorized instance and storage operations with financial and operational impact.

Credential Access

High

• Category: Privilege Escalation

Content

✅ **使用子用户密钥**：
```python
from dotenv import load_dotenv
load_dotenv('config/.env')
SECRET_ID = os.getenv('TENCENT_SECRET_ID')
```

• Confidence: 86% confidence
• Finding: The example `load_dotenv('config/.env')` normalizes reading secrets from a plaintext file but does not mention protections against disclosure. In a cloud admin skill, any accidental exposure of that file can directly translate into credential compromise and unauthorized cloud operations.

Credential Access

High

• Category: Privilege Escalation

Content

### 问题 1: 凭证验证失败

```bash
cat config/.env
python3 src/verify_config.py
```

• Confidence: 94% confidence
• Finding: The troubleshooting step advises `cat config/.env`, which encourages displaying secrets in clear text during debugging. This is especially risky because terminal output may be recorded in shell history, screen sharing, logs, or support transcripts, directly exposing cloud credentials.

Credential Access

High

• Category: Privilege Escalation

Content

4. Enter policy name, click "OK"
5. Visit https://console.cloud.tencent.com/cam/user to create sub-user
6. Associate policy to sub-user
7. Copy SecretId and SecretKey to .env file

---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

4. Enter policy name, click "OK"
5. Visit https://console.cloud.tencent.com/cam/user to create sub-user
6. Associate policy to sub-user
7. Copy SecretId and SecretKey to .env file

---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

4. Enter policy name, click "OK"
5. Visit https://console.cloud.tencent.com/cam/user to create sub-user
6. Associate policy to sub-user
7. Copy SecretId and SecretKey to .env file

---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cp skills/tencentcloud-manager/config/.env.example \
   skills/tencentcloud-manager/config/.env
```

Edit `.env` file and fill in SecretId and SecretKey.

• Confidence: 78% confidence
• Finding: This documentation explicitly instructs users to create a .env file and populate it with long-lived SecretId and SecretKey credentials. While common in developer documentation, this pattern increases the likelihood of credential theft through source control leakage, local compromise, backup exposure, or accidental sharing; if compromised, the attacker could access and manage Tencent Cloud resources.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to copy secrets into a local .env file but does not warn that the file contains highly sensitive cloud credentials that must be access-controlled and excluded from source control, logs, and screenshots. This can lead to credential leakage through accidental commits, local disclosure, or unsafe troubleshooting practices.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill includes concrete examples for creating servers, buckets, lifecycle rules, and bulk start/stop operations, but does not place an explicit warning near these workflows that they can incur charges, affect availability, or make destructive changes. In a cloud-management skill, omission of transactional safeguards and user-facing warnings increases the chance of accidental costly or service-impacting actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The quick reference instructs users to place Tencent Cloud SecretId and SecretKey into a local .env file without any warning about secure storage, least-privilege credentials, or excluding the file from version control. This can lead to accidental credential exposure through commits, logs, shared filesystems, or insecure workstation handling, enabling unauthorized cloud access.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The resource-creation examples directly show how to create Lighthouse instances and COS buckets but omit any warning that these are billable operations and may provision Internet-reachable infrastructure. Users may unintentionally incur costs or deploy exposed services without understanding the security and financial consequences.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The COS examples demonstrate uploading local data to cloud storage and changing lifecycle policies without warning about data sensitivity, retention, or archival side effects. Misuse could expose sensitive files, alter retention expectations, or trigger availability and recovery issues through lifecycle transitions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The create_resource method can create CVM instances, Lighthouse instances, or COS buckets, which may incur cost and alter the user's cloud environment. Although the method has an internal docstring and optional audit logging, it provides no user-facing disclosure, confirmation prompt, or visible warning at the point of execution.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The start_resource, stop_resource, and restart_resource methods directly invoke cloud instance power actions. These are operationally significant changes, but the code only records them in an optional audit log and does not surface a user-facing warning, confirmation, or notice before execution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The upload_to_cos method uploads a local file path to Tencent COS, which is a network transmission of user or system data. The method lacks any user-facing warning, confirmation, or explanatory notice beyond an internal docstring and optional audit entry after the upload succeeds.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

key: str = None,
                     storage_class: str = None) -> Dict:
        """上传文件到 COS"""
        result = self.cos.upload_file(
            bucket=bucket,
            local_path=local_path,
            key=key,

• Confidence: 55% confidence
• Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The natural-language instructions, headings, and usage guidance are all presented in Chinese, and the document does not indicate that this language choice is optional or region-specific by policy. Under the stated rule, forcing a specific language without user opt-in is a language/locale policy issue.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The natural-language description is written only in Chinese ("腾讯云资源统一管理") with no indication that language selection is optional or that the skill is intended solely for a Chinese-speaking or region-specific audience. Under the policy rule, a fixed language presentation can be a locale-policy concern when no opt-in or justification is provided.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The module description and command-line messages are written in Chinese, and there is no indication that the skill is region- or language-specific or that users can opt into another language. This creates a natural-language locale constraint that is imposed by default rather than offered as a documented choice.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The set_cos_lifecycle method modifies bucket lifecycle rules, which can affect retention and automated transitions or deletions of stored data depending on the supplied rules. The code performs the action silently except for optional audit logging, so users are not explicitly warned that storage behavior may change.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The docstring and method name state that the function '设置定时关机' configures scheduled shutdown behavior, which implies an operational effect on cloud resources. In reality, the code only logs the request and prints a suggestion to use crontab or cloud functions, so the documented intent contradicts the actual no-op implementation.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The export_audit_log method writes audit data to a specified file path, which is a local file write operation. While it prints after completion, there is no warning or notice before the write occurs, and the audit contents may include operational metadata the user should know is being persisted.

Static analysis

No suspicious patterns detected.