EdgeOne Pages Deploy

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:23 AM UTC
• Version: 1.0.0

Overview

This EdgeOne deployment skill is mostly purpose-aligned, but it handles account-level tokens and credentialized deployment URLs in ways users should review before installing.

Install only if you are comfortable with the agent handling EdgeOne credentials. Prefer browser login when possible, avoid saving account-level tokens in the project, rotate any token you expose, verify `.edgeone/.token` and `.env` are not committed or synced, and treat printed deployment URLs with `eo_token` or `eo_time` as sensitive links.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Mutable Unpinned CLI Dependency Installed Globally

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:137

Finding

Account-Level Token Passed Through Command-Line Arguments

Content

View full analysis

# New project edgeone pages deploy -n -t ``` The same unsafe pattern is also included in the command reference at line 271: ```bash edgeone pages deploy -t ``` ### Technical Analysis The workflow interpolates an account-level API token directly into the CLI argument vector. Command-line arguments are not a secure secret transport mechanism. Depending on the execution environment, they may be exposed through: - Process inspection interfaces while the deployment command is running. - Agent execution traces, terminal logs, or CI job logs. - Shell history if commands are issued through an interactive shell. - Monitoring, debugging, crash-reporting, or telemetry systems that record command arguments. The document explicitly states that the token has account-level permissions. Consequently, disclosure is more consequential than exposure of a narrowly scoped, single-deployment credential. ### Attack Path 1. The user provides an EdgeOne API token to the agent. 2. The agent constructs a deployment command containing the token after the `-t` option. 3. The complete token becomes part of the process argument vector. 4. A local process observer, logging service, CI trace, terminal recorder, or other actor with access to execution metadata captures the command. 5. The attacker extracts the token and submits it to EdgeOne before it expires or is revoked. 6. The attacker performs deployments or other actions permitted by that token. ### Impact Assessment An attacker who obtains the token can authenticate with the permissions assigned to it. Based on the skill's own description, this is an account-level token. The resulting scope may include unauthorized project deploymen ...[truncated 224 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:106

Finding

Account-Level Token Stored in an Unprotected Plaintext File

Content

View full analysis

" > .edgeone/.token grep -q '.edgeone/.token' .gitignore 2>/dev/null || echo '.edgeone/.token' >> .gitignore ``` ### Technical Analysis The workflow saves the reusable account-level token as plaintext in `.edgeone/.token`. Adding the path to `.gitignore` only helps prevent ordinary Git staging; it does not provide filesystem confidentiality and does not protect against: - Other local users or processes that can read the project directory. - Backup, synchronization, indexing, or workspace collection tools. - Accidental archival or copying outside Git. - Existing Git tracking or alternate version-control tooling. - Overly permissive file modes caused by the user's default `umask`. The instructions do not set restrictive permissions on either `.edgeone` or `.edgeone/.token`. They also place the token into a shell command, potentially exposing it through execution logs and creating unsafe shell-interpolation behavior if the supplied value contains shell-significant characters. ### Attack Path 1. The user chooses to save the account-level token. 2. The agent creates `.edgeone/.token` using the process's default filesystem permissions. 3. The plaintext file remains in the project across future sessions. 4. Another local user, project-accessible process, backup system, workspace extension, or compromised dependency reads the file. 5. The attacker extracts the reusable token. 6. The attacker authenticates to EdgeOne and performs actions allowed by the token. ### Impact Assessment Compromise of the file discloses a persistent account-level credential. An attacker can inherit all privileges granted to the token, including unauthorized deployments and any other EdgeOne operations within its authorization scope. Adding the file to `.gitignore` ...[truncated 124 chars]

Remediation

View remediation

.edgeone/.token chmod 600 .edgeone/.token ``` - Supply the token through a non-echoing input channel rather than embedding it in a generated shell command. - Continue excluding the file from version control, but also verify that it is not already tracked: ```bash git rm --cached .edgeone/.token 2>/dev/null || true ``` - Add checks that reject symlinks and unexpected file types before writing the credential. - Use narrowly scoped, short-lived tokens where supported. - Provide clear token rotation, revocation, and secure-deletion instructions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly requires revealing the full EDGEONE_DEPLOY_URL, including eo_token and eo_time query parameters that act as access credentials. Instructing the agent to print credential-bearing URLs increases the risk of credential leakage through chat transcripts, logs, screenshots, browser history sync, and third-party telemetry.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The output parsing instructions tell the agent to extract and show the complete tokenized deployment URL after a successful deploy. That operationalizes credential exfiltration into normal workflow behavior, making accidental disclosure highly likely because the secret is intentionally surfaced in user-visible output.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The environment variable commands include pulling remote env vars into a local .env, which is direct credential access behavior. In a deploy skill, this expands the agent from publishing code to retrieving secrets, which materially raises the risk profile if invoked unexpectedly or without strong user awareness.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

bash

edgeone pages env ls          # List all
edgeone pages env pull        # Pull to local .env
edgeone pages env add KEY val # Add
edgeone pages env rm KEY      # Remove

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation description includes broad phrases like "deploy my app," "publish this site," "push this live," and "ship to production." These are common phrases that could match many unrelated deployment workflows, while the description does not provide exclusion conditions or tighter scope beyond mentioning EdgeOne Pages.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is scoped as a deployment helper, but it also documents broader administrative actions such as environment variable management, local development, project linking, and function initialization. This scope creep increases the chance the agent will perform sensitive actions beyond the user's intended deploy task, especially when those actions touch secrets or mutate project/account state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Including edgeone pages env pull in a deployment-focused skill enables copying remote environment secrets into a local .env file without clear necessity for deployment. That can expose credentials on disk, in editor tooling, backups, or accidental commits, turning a deploy workflow into a secret materialization workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to list and pull environment variables into a local file without an explicit warning that those values are sensitive. Pulling secrets locally can expose them to logs, shell history, IDE indexing, accidental sharing, or source control if .env protections are incomplete.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The instructions require the agent to ask the user to choose between China and Global sites and then route behavior based on that region selection. This imposes a locale/regional handling policy in the skill, and while documented, it does not clearly explain that the choice is purely service-endpoint selection rather than a broader language/locale preference.

Content

No source excerpt is available for this finding.