ClawHub
Back to skill

Security audit

volcengine-cli

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Volcengine CLI skill, but it needs Review because its installer and API helper grant broad local and credential-bearing authority with insufficient endpoint and supply-chain constraints.

Review before installing. Prefer the npm/package-manager path or a pinned, verified local installer, avoid pipe-to-shell installation, set VOLCENGINE_CLI_SKIP_SKILLS=1 unless you intend to update skills, and do not use custom API hosts unless you fully trust the endpoint because signed requests and temporary session tokens may be sent there.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:242
Finding

Mutable Remote Installer Is Executed Directly Through a Shell Pipeline

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 242–247
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

bash
**Option 2: CDN installer (no Node.js, or npm unreachable)**

curl -fsSL https://cloudcache.volccdn.com/ve/install.sh | sh
# or
wget -qO- https://cloudcache.volccdn.com/ve/install.sh | sh

Technical Analysis

These commands pass a remotely downloaded installer directly to a shell. The effective script can change after the Skill has been reviewed, and it is executed before the user or Agent can inspect it or verify its integrity.

The archive checksum verification implemented by the downloaded installer does not authenticate the installer itself. TLS reduces network interception risk but does not protect against compromise of the CDN, DNS infrastructure, release-publishing credentials, or the remote installer path.

This behavior exceeds the minimum privileges necessary because the project already contains a reviewable installer at scripts/install_ve.sh. Executing an unaudited remote script is unnecessary when that bundled implementation can be used instead.

Attack Path

  1. An attacker compromises the CDN, publishing account, DNS resolution, or remote install.sh object.
  2. The attacker replaces the installer with a modified shell script.
  3. An Agent follows the documented fallback installation procedure.
  4. curl or wget writes the attacker-controlled response directly to the shell.
  5. The payload executes with all privileges available to the Agent process.
  6. The payload can steal credentials, alter local files, install replacement tools, or establish persistence before installing a legitimate-looking ve binary.

Impact Assessment

Successful exploitation provides arbitrary command execution under the account running the installation. If that account can write to /usr/local/bin, the attacker may als ...[truncated 420 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove both pipe-to-shell examples from SKILL.md.
  2. Prefer the bundled, reviewable installer:
    bash
    sh scripts/install_ve.sh --version 1.1.9
  3. If remote retrieval is unavoidable, download the installer to a file without executing it:
    bash
    curl -fsSLo install_ve.sh https://cloudcache.volccdn.com/ve/install.sh
  4. Verify the installer using a version-pinned checksum or cryptographic signature obtained through an independently trusted channel.
  5. Inspect the verified script before invoking it with sh.
  6. Pin the CLI version instead of automatically consuming a mutable latest pointer.
  7. Document the expected installer digest and release provenance in the Skill.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/call_extend_api.py:703
Finding

Custom API Endpoint Can Receive Locally Resolved Authentication Material and Signed Requests

Content
View full analysis

Vulnerability Details

File Location: scripts/call_extend_api.py, lines 496–566, 703–750, and 782–785
Vulnerability Type: Unrestricted credential-bearing endpoint override
Risk Level: High

Vulnerable Code

python
def prepare_request_shape(entry: dict[str, Any], args: argparse.Namespace) -> dict[str, Any]:
    expected_method = entry["method"].upper()
    if args.method and args.method.upper() != expected_method and not entry.get("free_mode"):
        raise SystemExit(f"{entry['name']} uses method {expected_method}, not {args.method.upper()}")
    method = (args.method or expected_method).upper()

    params = parse_json_value(args.params)
    query_params, body_params = split_query_body(
        params,
        entry.get("query_keys"),
        entry.get("preserve_query_keys_in_body"),
    )
    region = args.region or env("VOLCENGINE_REGION") or DEFAULT_REGION
    host = resolve_host(entry, region, args.host)
    scheme = args.scheme or entry.get("scheme") or "https"
    if scheme != "https":
        raise SystemExit("Only HTTPS endpoints are supported by this helper.")
    content_type = args.content_type or entry.get("content_type") or JSON_CONTENT_TYPE
    return {
        "region": region,
        "host": host,
        "service": entry["service"],
        "version": entry["version"],
        "action": entry["name"],
        "method": method,
        "content_type": content_type,
        "query": query_params,
        "body": body_params,
        "scheme": scheme,
    }
python
def call_api(args: argparse.Namespace) -> int:
    entry = resolve_entry(args)
    shape = prepare_request_shape(entry, args)

    try:
        credentials = resolve_volcengine_credentials(
            profile=args.profile,
            session_token=args.session_token,
            notify=lambda message: print(message, file=sys.stderr),
        )
    except Credenti
...[truncated 3810 chars]
Remediation
View remediation

Remediation Suggestions

  1. Allowlist documented Volcengine API endpoints rather than accepting arbitrary hosts.
  2. Validate endpoints using parsed hostnames, not substring matching. Permit only exact approved names or controlled subdomains such as *.volcengineapi.com.
  3. Reject IP literals, embedded credentials, unexpected ports, malformed internationalized names, and redirect-based endpoint changes.
  4. Disable custom endpoint overrides whenever credentials are loaded automatically from a profile or login cache.
  5. If custom endpoints are necessary for private deployments, require an explicit unsafe/custom-endpoint flag and informed user confirmation.
  6. Do not attach x-security-token or authorization data until endpoint validation succeeds.
  7. Disable automatic HTTP redirects for signed requests or revalidate the destination after every redirect.
  8. Prefer service-specific endpoint mappings in the registry and reject endpoint/service combinations that do not match.
  9. Remove or deprecate the command-line --session-token option because command-line values may be exposed through process listings and shell history.

T08 · Insecure Dependencies

Error
Location
scripts/install_ve.sh:278
Finding

Installer Trust Can Be Redirected to an Attacker-Controlled Binary and Checksum Manifest

Content
View full analysis

Vulnerability Details

File Location: scripts/install_ve.sh, lines 47–48 and 278–324
Vulnerability Type: Same-origin untrusted binary and checksum verification
Risk Level: High

Vulnerable Code

sh
base_url="${VOLCENGINE_CLI_DOWNLOAD_BASE_URL:-$DEFAULT_BASE_URL}"
version="${VE_VERSION:-}"
sh
tmp_dir="$(mktemp -d 2>/dev/null || mktemp -d -t ve-install)"
archive_path="$tmp_dir/$archive_name"
sums_path="$tmp_dir/$sums_name"

log "Downloading $archive_name ..."
fetch_to_file "$archive_url" "$archive_path" \
  || die "Download failed: $archive_url. Please download Volcengine CLI from $RELEASES_URL"
fetch_to_file "$sums_url" "$sums_path" \
  || die "Checksum file not found: $sums_url. Refusing to install an unverified binary; download from $RELEASES_URL"

expected="$(expected_sha256 "$sums_path" "$archive_name")"
[ -n "$expected" ] || die "No entry for $archive_name in $sums_url. Refusing to install an unverified binary."
actual="$(sha256_file "$archive_path")"
if [ "$expected" != "$actual" ]; then
  die "Checksum mismatch for $archive_name: expected $expected, got $actual. The download may have been tampered with. Download from $RELEASES_URL"
fi
log "Checksum OK."

extract_dir="$tmp_dir/extract"
mkdir -p "$extract_dir"
extract_archive "$archive_path" "$extract_dir"
binary="$extract_dir/ve"
if [ ! -f "$binary" ]; then
  binary="$(find "$extract_dir" -type f -name ve | head -n 1)"
fi
[ -n "$binary" ] && [ -f "$binary" ] || die "'ve' binary not found inside $archive_name"

mkdir -p "$target_dir" || die "Cannot create $target_dir (set VE_INSTALL_DIR to a writable directory)"
[ -w "$target_dir" ] || die "$target_dir is not writable (set VE_INSTALL_DIR to a writable directory; this installer never uses sudo)"

staged="$target_dir/.ve.install.$$"
cp "$binary" "$staged"
chmod 755 "$staged"
if [ "$os" = "darwin" ] && have xattr; then
  xattr -d com.appl
...[truncated 2496 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require HTTPS for all remote download sources.
  2. Allowlist the official release host by default and reject arbitrary remote base URLs.
  3. Treat local mirrors as a separate, explicitly enabled development mode rather than inferring them from the absence of a URI scheme.
  4. Pin the expected version and checksum in trusted project metadata.
  5. Verify a cryptographic release signature using a public key bundled with the Skill or obtained through an independent trust channel.
  6. Do not rely on a checksum manifest downloaded from the same source as the executable.
  7. Require an explicit confirmation before using a custom mirror.
  8. Record and display the final resolved host, version, archive digest, and signature identity before execution.
  9. Perform archive structure validation before extraction and reject unexpected files, links, or duplicate binary paths.
  10. Recognize that running the staged binary for a version check is already code execution; authenticate the binary before that step.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (57)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This variant of the mismatch is security-relevant because the skill markets itself as a cloud-management assistant while also embedding software installation behavior that downloads binaries, writes to PATH locations, and updates skills. Users or routing logic may invoke it for ordinary infrastructure tasks without expecting local system modification, increasing the risk of unintended code execution and host changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This variant of the mismatch is security-relevant because the skill markets itself as a cloud-management assistant while also embedding software installation behavior that downloads binaries, writes to PATH locations, and updates skills. Users or routing logic may invoke it for ordinary infrastructure tasks without expecting local system modification, increasing the risk of unintended code execution and host changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This variant of the mismatch is security-relevant because the skill markets itself as a cloud-management assistant while also embedding software installation behavior that downloads binaries, writes to PATH locations, and updates skills. Users or routing logic may invoke it for ordinary infrastructure tasks without expecting local system modification, increasing the risk of unintended code execution and host changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This variant of the mismatch is security-relevant because the skill markets itself as a cloud-management assistant while also embedding software installation behavior that downloads binaries, writes to PATH locations, and updates skills. Users or routing logic may invoke it for ordinary infrastructure tasks without expecting local system modification, increasing the risk of unintended code execution and host changes.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
description: Base URL (or local mirror directory) that scripts/install_ve.sh downloads release archives from; defaults to https://cloudcache.volccdn.com/ve

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
description: Base URL (or local mirror directory) that scripts/install_ve.sh downloads release archives from; defaults to https://cloudcache.volccdn.com/ve

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
description: Base URL (or local mirror directory) that scripts/install_ve.sh downloads release archives from; defaults to https://cloudcache.volccdn.com/ve

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
description: Base URL (or local mirror directory) that scripts/install_ve.sh downloads release archives from; defaults to https://cloudcache.volccdn.com/ve

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
description: Base URL (or local mirror directory) that scripts/install_ve.sh downloads release archives from; defaults to https://cloudcache.volccdn.com/ve

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md
description: Base URL (or local mirror directory) that scripts/install_ve.sh downloads release archives from; defaults to https://cloudcache.volccdn.com/ve

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
description: Seconds scripts/ve_login_remote.sh waits for `ve login` to print its URL (default 30)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
description: Seconds scripts/ve_login_remote.sh waits for `ve login` to print its URL (default 30)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md
description: Seconds scripts/ve_login_remote.sh waits for `ve login` to print its URL (default 30)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.

md
description: Seconds scripts/ve_login_remote.sh waits for `ve login` to print its URL (default 30)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

md
description: Seconds scripts/ve_login_remote.sh waits for `ve login` to print its URL (default 30)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

md
description: Seconds scripts/ve_login_remote.sh waits for `ve login` to print its URL (default 30)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

md
description: Seconds scripts/ve_login_remote.sh waits for `ve login` to print its URL (default 30)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.

md
description: Seconds scripts/ve_login_remote.sh waits for `ve login` to print its URL (default 30)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 609)May include surrounding context.

md
description: Seconds scripts/ve_login_remote.sh waits for `ve login` to print its URL (default 30)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs fetching a remote shell script over the network and piping it directly into sh. That is a classic remote code execution pattern: any compromise of the CDN, TLS termination, mirror, or content pipeline can immediately run arbitrary code on the host with the agent's privileges, and the user never gets a chance to inspect the script first.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

Option 2: CDN installer (no Node.js, or npm unreachable)

bash
curl -fsSL https://cloudcache.volccdn.com/ve/install.sh | sh
# or
wget -qO- https://cloudcache.volccdn.com/ve/install.sh | sh

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping network output directly into a shell is also a chaining-abuse issue because it combines download and execution into one opaque step, preventing review and making interception or substitution immediately exploitable. In an agent context, this pattern defeats many opportunities for policy checks between fetch and execution.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

Option 2: CDN installer (no Node.js, or npm unreachable)

bash
curl -fsSL https://cloudcache.volccdn.com/ve/install.sh | sh
# or
wget -qO- https://cloudcache.volccdn.com/ve/install.sh | sh

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This is the same remote-script execution issue using wget instead of curl. Because the skill is designed for agent execution, the risk is amplified: a misrouted or injected workflow could cause unattended execution of mutable remote code and subsequent installation into user or system PATH.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

bash
curl -fsSL https://cloudcache.volccdn.com/ve/install.sh | sh
# or
wget -qO- https://cloudcache.volccdn.com/ve/install.sh | sh

The same script ships as scripts/install_ve.sh. It reads the latest version from the CDN, downloads the archive for the host's OS/CPU, verifies it against the published SHA256SUMS, installs to /usr/local/bin when writable (else ~/.local/bin, never sudo), removes the macOS quarantine flag, and runs ve skills update. --version <ver>, --install-dir <dir>, --dry-run and the VE_VERSION / VE_INSTALL_DIR / VOLCENGINE_CLI_DOWNLOAD_BASE_URL / VOLCENGINE_CLI_SKIP_SKILLS variables are documented in its header. Windows: use npm or the release page.

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The wget variant has the same chaining-abuse property: it fuses retrieval and execution of remote content into a single command. That materially increases the chance of silent arbitrary code execution if the remote source is compromised or the instruction is triggered unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

bash
curl -fsSL https://cloudcache.volccdn.com/ve/install.sh | sh
# or
wget -qO- https://cloudcache.volccdn.com/ve/install.sh | sh

The same script ships as scripts/install_ve.sh. It reads the latest version from the CDN, downloads the archive for the host's OS/CPU, verifies it against the published SHA256SUMS, installs to /usr/local/bin when writable (else ~/.local/bin, never sudo), removes the macOS quarantine flag, and runs ve skills update. --version <ver>, --install-dir <dir>, --dry-run and the VE_VERSION / VE_INSTALL_DIR / VOLCENGINE_CLI_DOWNLOAD_BASE_URL / VOLCENGINE_CLI_SKIP_SKILLS variables are documented in its header. Windows: use npm or the release page.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 459)May include surrounding context.

md
nvalidated: take them from the user's material, the `volcengine-api` skill, or [references/extend-apis.md](references/extend-apis.md) — never guess them. `find_

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 462)May include surrounding context.

md
nvalidated: take them from the user's material, the `volcengine-api` skill, or [references/extend-apis.md](references/extend-apis.md) — never guess them. `find_