ClawHub
Back to skill

Security audit

volcengine-cli

Security checks across malware telemetry and agentic risk

Overview

This Volcengine cloud-management skill is mostly disclosed and purpose-related, but it grants very broad authenticated cloud authority with inconsistent credential-safety instructions and several high-impact extension APIs that deserve user review.

Install only if you are comfortable giving an agent broad authenticated control over Volcengine resources. Prefer temporary or least-privilege credentials, review any extension API call before approving it, and be especially careful with billable operations, domain registration, IoT/device actions, and any login flow that may replace an existing session.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill exposes powerful capabilities (shell, network, file read, environment access) without an explicit permission declaration or visible scoping, which increases the chance that the agent can perform sensitive actions without clear review boundaries. In a cloud-management skill that also handles authentication and resource operations, this lack of declared permissions materially raises the risk of unintended command execution, credential access, or infrastructure changes.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill description presents broad, ordinary CLI-based cloud management, but the documented behavior includes additional sensitive mechanisms: interactive OAuth orchestration, helper-script state management, direct HTTPS extension API calls with custom signing, and remote documentation/API search fetches. This mismatch is dangerous because users and policy systems may authorize the skill under a narrower mental model than what it actually does, enabling unexpected credential handling or network actions.

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
The documentation says the agent must never read the Volcengine CLI config because it may contain long-lived credentials and session tokens, yet nearby metadata and helper behavior indicate credential fallback may depend on that same config path. That contradiction can lead implementers to read sensitive credential stores indirectly or normalize unsafe credential access during troubleshooting.

Context-Inappropriate Capability

Medium
Confidence
79% confidence
Finding
The documented extension surface includes `sec_agent` workflow execution APIs that are unrelated to the stated purpose of managing Volcengine resources via CLI. Broadening the skill to include security-analysis workflows increases capability scope and could enable processing of sensitive alert, PCAP, screenshot, URL, or text inputs beyond user expectations, raising data exposure and misuse risk.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
Including `RegisterDomain` exposes a billable registrar operation outside the skill's core cloud-resource CLI scope. Even with confirmation language in the docs, adding purchase-capable APIs expands the blast radius of accidental or manipulated use and can lead to unauthorized charges or unwanted domain registrations.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The helper is framed as an API caller, but it also probes local `ve` login state and later resolves credentials from environment variables, CLI config, and login cache. In an agent skill context, undisclosed local credential discovery and auth-state inspection expands the trust boundary and can expose sensitive environment details or enable unintended authenticated actions without the user's informed consent.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The registry includes capabilities well beyond the stated skill scope of cloud resource management, including security workflows, trademark/domain operations, and IoT control. In an agent setting, this scope creep increases the chance of unintended high-impact calls, weakens user expectations about what the skill may do, and broadens the attack surface available through a single helper.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script sends user-supplied parameters over the network together with derived authentication headers, but it provides no user-facing confirmation that data will be transmitted to remote Volcengine endpoints under the user's credentials. In an agent skill, that can cause silent exfiltration of sensitive prompt data or unintended authenticated mutations against cloud resources.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The credential resolution logic automatically reads sensitive values from environment variables, CLI config, and console-login cache without a prominent warning. In a local agent execution context, silently harvesting available credentials can violate user expectations and enable privileged API calls using secrets the user did not explicitly intend to expose to this helper.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
cat "$log_file" >&2 || true
      exit 8
    fi
    # Auto-confirm session replacement if prompted.
    if [[ "$replied_replace" == false ]] && grep -q 'Replace the existing login_session' "$log_file" 2>/dev/null; then
      printf 'y\n' > "$fifo" 2>/dev/null || true
      replied_replace=true
Confidence
92% confidence
Finding
Auto-confirm

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.