ClawHub
Back to skill

Security audit

volcengine-compliance

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Volcengine compliance assistant, but its deployment path can create resource-modifying cloud rules while presenting the workflow as audit-only.

Use the read-only recommend and overview paths normally, but review the apply path carefully before installation in a real account. Do not confirm deployment unless every rule effect is visible and Audit-only, and treat generated CSV reports as untrusted spreadsheet input. Cloud recorders, conformance packs, and custom rules can persist after the skill run.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/compliance.py:226
Finding

Audit-Only Deployment Can Silently Enable Resource Modification

Content
View full analysis

Vulnerability Details

File Location: scripts/compliance.py, lines 226–227
Vulnerability Type: Unsafe fallback to a resource-modifying rule effect
Risk Level: High

Vulnerable Code

python
allowed = rt.get("AllowedEffects", []) or []
effect = "Audit" if "Audit" in allowed else (allowed[0] if allowed else "")

Technical Analysis

The deployment plan prefers the non-modifying Audit effect, but if Audit is unavailable, it silently selects the first value in AllowedEffects. If that value is Modify, the resulting conformance-pack rule may automatically change cloud-resource configurations.

This behavior contradicts the documented security boundary that deployment defaults to audit-only operation and does not trigger automatic remediation. It also violates fail-safe design: when the safe effect is unavailable, the operation should be rejected rather than downgraded to an effect with greater impact.

The dry-run response only reports the pack name, template ID, and rule count. It does not expose each selected effect, so the user may confirm deployment without knowing that one or more rules use Modify.

Attack Path

  1. A selected conformance-pack template contains a rule for which AllowedEffects does not include Audit.
  2. The rule permits Modify, either as the first or only allowed effect.
  3. build_plan() silently assigns Modify to that rule.
  4. The dry-run output presents only a pack summary and does not reveal the modifying effect.
  5. The user supplies --confirm, believing the operation will only deploy compliance checks.
  6. CreateConformancePack receives the generated rule overrides.
  7. The platform may execute the modification behavior defined by the rule against resources in scope.

Impact Assessment

Successful exploitation or accidental triggering can cause unauthorized or unexpected changes to cloud resources covered by the deployed conformance pack. The exact scope depends on the selected rule tem ...[truncated 590 chars]

Remediation
View remediation

Remediation Suggestions

  1. Enforce audit-only behavior by rejecting any rule that does not explicitly support Audit:
python
allowed = rt.get("AllowedEffects", []) or []
if "Audit" not in allowed:
    raise RuntimeError(
        f"Rule template {rid} does not support the required Audit effect"
    )
effect = "Audit"

  1. Never automatically fall back to Modify or another higher-impact effect.

  2. Include every rule template ID and selected effect in the dry-run result so users can review the complete deployment plan.

  3. If modification support is introduced later, implement it as a separate command or mode with:

    • An explicit option such as --allow-modify.
    • A second confirmation describing affected rules and resource scopes.
    • Clear per-rule disclosure in dry-run output.
    • Least-privilege permission requirements.
    • Audit logging and rollback guidance.

  4. Add regression tests covering:

    • AllowedEffects=["Audit"].
    • AllowedEffects=["Audit", "Modify"].
    • AllowedEffects=["Modify"].
    • Missing or empty AllowedEffects.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/compliance.py:529
Finding

Spreadsheet Formula Injection in Generated CSV Reports

Content
View full analysis

Vulnerability Details

File Location: scripts/compliance.py, lines 529–539
Vulnerability Type: CSV/spreadsheet formula injection
Risk Level: Medium

Vulnerable Code

python
for f in findings:
    rows = f["Resources"] or [None]
    for r in rows:
        w.writerow([
            f["Severity"], f["RiskLevel"], f["Category"], f["Source"],
            f["RuleId"], f["RuleName"], f["ConformancePackId"],
            r["AccountId"] if r else "",
            r["ResourceId"] if r else f"({f['NonCompliantCount']} non-compliant)",
            r["ResourceType"] if r else "",
            r["Region"] if r else "",
            (r["Annotation"] or "").replace("\n", " ") if r else "",
        ])

Technical Analysis

The report generator writes externally sourced cloud metadata directly into CSV cells. Relevant fields include rule names, resource identifiers, account identifiers, regions, resource types, conformance-pack identifiers, and evaluation annotations.

The csv.writer class correctly escapes CSV structure, but CSV quoting does not prevent spreadsheet applications from treating cells beginning with characters such as =, +, -, or @ as formulas. Tabs and carriage returns may also be interpreted as formula prefixes by some spreadsheet software.

An attacker who can influence a resource identifier, custom rule name, or annotation can inject spreadsheet expressions into the generated report. The payload is activated later when an operator opens the CSV in a formula-capable spreadsheet application.

Attack Path

  1. An attacker gains control over, or can influence, a cloud metadata field included in compliance results, such as a custom rule name, resource identifier, or annotation.
  2. The attacker sets that field to a spreadsheet formula payload beginning with a formula-triggering character.
  3. The overview command retrieves the value from the Volcengine API.
  4. render_csv() writes the value into the report without formula neutr ...[truncated 1183 chars]
Remediation
View remediation

Remediation Suggestions

  1. Neutralize every externally sourced CSV cell before passing it to csv.writer.

  2. Prefix cells that begin with =, +, -, @, tab, or carriage return with an apostrophe or another application-appropriate neutralization character:

python
def safe_csv_cell(value):
    text = "" if value is None else str(value)
    text = text.replace("\r", " ").replace("\n", " ")
    if text.startswith(("=", "+", "-", "@", "\t", "\r")):
        text = "'" + text
    return text

  1. Apply the helper consistently to all text fields, not only Annotation. Resource identifiers and custom rule names may also be attacker-controlled.

  2. Keep csv.writer for structural escaping; formula neutralization is an additional control and does not replace CSV quoting.

  3. Consider generating an XLSX report with cells explicitly typed as text if spreadsheet interoperability is required.

  4. Add regression tests for values beginning with each dangerous prefix, including values containing leading whitespace before a formula character.

  5. Document that existing reports generated before the fix should be treated as untrusted when opened in spreadsheet applications.

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/compliance.py (reported line 334)May include surrounding context.

python
"RuleTemplateId": r.get("RuleTemplateId", ""),
                "Effect": r.get("Effect", ""),
            }
    return rules


def build_category_index():

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill invokes shell commands (python3 scripts/compliance.py, ve config) and produces output artifacts, but it does not declare an explicit tool scope such as allowed tools or permissions. That omission weakens containment because an agent/runtime may grant broader shell or file capabilities than the skill actually needs, increasing the chance of unintended command execution or file writes if the skill is modified, misused, or prompt-injected through its inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing instructions exclusively in Chinese and does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown reference forces a specific language/locale for all instructions and examples, and there is no indication that the user can choose another language. The policy for SQP-3 applies to all file types and flags language constraints unless they are explicitly optional or justified as region-specific.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compliance.py (reported line 65)May include surrounding context.

python
payload = json.dumps(body, ensure_ascii=False)
    last_err = None
    for attempt in range(RETRY + 1):
        proc = subprocess.run(
            ["ve", "config", action, "--body", payload],
            capture_output=True,
            text=True,