Volcengine Iac

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.2

Overview

This Volcengine Terraform skill has powerful but expected cloud-infrastructure access, with disclosed handling of sensitive Terraform outputs and no evidence of hidden exfiltration or persistence.

Install only if you are comfortable letting an agent operate Terraform against your Volcengine account. Review every plan before apply or destroy, do not use the reference snippets' auto-approve commands in real environments, keep Terraform state and .volcengine/iac-outputs.json out of version control, and prefer encrypted remote state with strict access controls for shared or production use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (116)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill instructs exporting Terraform outputs to .volcengine/iac-outputs.json, and notes that these outputs may include VKE kubeconfig and other sensitive infrastructure connection data. Even with 0600 permissions, centralizing secrets in a predictable plaintext file materially increases credential exposure risk through downstream skills, accidental reads, backups, logs, or artifact collection.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md

## 7. Outputs for Downstream

`export_outputs.sh` writes `terraform output -json` to `.volcengine/iac-outputs.json` with mode `0600`. Downstream skills commonly consume VPC/subnet/security group IDs, VKE kubeconfig, CR repository data, RDS/Redis endpoints or IDs, and TOS bucket names. Some keys are conditional on which examples/modules were enabled; consumers must use defensive `jq` defaults.

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The instruction to decode kubeconfig and write it to ~/.kube/config can expose or overwrite local Kubernetes credentials. In an IaC skill, this is more concerning because operators may run the steps on privileged admin workstations that already manage multiple clusters.

Content

Scanner excerpt · references/provider-versions.md (reported line 169)May include surrounding context.

md

- `volcenginecc_vepfs_instance` is not verified in the current account because create permissions are denied. See [`volcenginecc-blocked.md`](./volcenginecc-blocked.md) before retrying.
- `volcengine_redis_instance` does not export endpoint/address fields directly. Downstream consumers must use a `data` source or call `ve redis DescribeDBInstanceDetail` after apply. This is a limitation of the provider, not the skill.
- `volcengine_tos_bucket` exports `intranet_endpoint` and `extranet_endpoint`. Always prefer `intranet_endpoint` from compute inside the same region (free, faster).
- `volcengine_vke_cluster.kubeconfig_private` and `kubeconfig_public` are base64-encoded. Pipe through `base64 -d` before writing to `~/.kube/config`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The instruction to decode kubeconfig and write it to ~/.kube/config can expose or overwrite local Kubernetes credentials. In an IaC skill, this is more concerning because operators may run the steps on privileged admin workstations that already manage multiple clusters.

Content

Scanner excerpt · references/provider-versions.md (reported line 169)May include surrounding context.

md

- `volcenginecc_vepfs_instance` is not verified in the current account because create permissions are denied. See [`volcenginecc-blocked.md`](./volcenginecc-blocked.md) before retrying.
- `volcengine_redis_instance` does not export endpoint/address fields directly. Downstream consumers must use a `data` source or call `ve redis DescribeDBInstanceDetail` after apply. This is a limitation of the provider, not the skill.
- `volcengine_tos_bucket` exports `intranet_endpoint` and `extranet_endpoint`. Always prefer `intranet_endpoint` from compute inside the same region (free, faster).
- `volcengine_vke_cluster.kubeconfig_private` and `kubeconfig_public` are base64-encoded. Pipe through `base64 -d` before writing to `~/.kube/config`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The guide writes a raw kubeconfig to ../kubeconfig.yaml, which is a sensitive cluster access artifact. If stored insecurely, copied into repositories, or left on shared systems, it can grant unauthorized access to the VKE cluster depending on its embedded credentials and permissions.

Content

Scanner excerpt · references/volcengine-vke-cr-nginx.md (reported line 45)May include surrounding context.

terraform validate terraform plan -out=tfplan.binary -input=false terraform apply -input=false tfplan.binary terraform output -raw kubeconfig | base64 -d > ../kubeconfig.yaml

text

Apply workload:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The instructions export the kubeconfig path and raw CR username/token into Terraform variables, normalizing direct handling of live credentials in environment variables. These values can leak via shell history, process inspection, debug logs, CI systems, or accidental environment dumps.

Content

Scanner excerpt · references/volcengine-vke-cr-nginx.md (reported line 52)May include surrounding context.

bash

cd ../workload
export TF_VAR_kubeconfig_path="$(cd .. && pwd)/kubeconfig.yaml"
export TF_VAR_registry_endpoint="$(cd ../infra && terraform output -raw registry_endpoint)"
export TF_VAR_repository_uri="$(cd ../infra && terraform output -raw repository_uri)"
export TF_VAR_cr_username="$(cd ../infra && terraform output -raw cr_username)"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcengine-vke-cr-nginx.md (reported line 63)May include surrounding context.

terraform validate terraform plan -out=tfplan.binary -input=false terraform apply -input=false tfplan.binary KUBECONFIG=../kubeconfig.yaml kubectl -n iac-nginx rollout status deploy/nginx KUBECONFIG=../kubeconfig.yaml kubectl -n iac-nginx get svc nginx KUBECONFIG=../kubeconfig.yaml kubectl -n iac-nginx exec deploy/nginx -- wget -qO- http://127.0.0.1/ | sed -n '1,8p'

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcengine-vke-cr-nginx.md (reported line 64)May include surrounding context.

terraform validate terraform plan -out=tfplan.binary -input=false terraform apply -input=false tfplan.binary KUBECONFIG=../kubeconfig.yaml kubectl -n iac-nginx rollout status deploy/nginx KUBECONFIG=../kubeconfig.yaml kubectl -n iac-nginx get svc nginx KUBECONFIG=../kubeconfig.yaml kubectl -n iac-nginx exec deploy/nginx -- wget -qO- http://127.0.0.1/ | sed -n '1,8p'

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcengine-vke-cr-nginx.md (reported line 65)May include surrounding context.

terraform validate terraform plan -out=tfplan.binary -input=false terraform apply -input=false tfplan.binary KUBECONFIG=../kubeconfig.yaml kubectl -n iac-nginx rollout status deploy/nginx KUBECONFIG=../kubeconfig.yaml kubectl -n iac-nginx get svc nginx KUBECONFIG=../kubeconfig.yaml kubectl -n iac-nginx exec deploy/nginx -- wget -qO- http://127.0.0.1/ | sed -n '1,8p'

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 21)May include surrounding context.

text

ServiceNotEnabled: KMS_ServiceNotOpen: KMS service not open yet, please open the service and try again later.
TypeName: Volcengine::KMS::KeyRing
Operation: CREATE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 32)May include surrounding context.

text

ServiceNotEnabled: KMS_ServiceNotOpen: KMS service not open yet, please open the service and try again later.
TypeName: Volcengine::KMS::KeyRing
Operation: CREATE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 43)May include surrounding context.

text

ServiceNotEnabled: KMS_ServiceNotOpen: KMS service not open yet, please open the service and try again later.
TypeName: Volcengine::KMS::KeyRing
Operation: CREATE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 54)May include surrounding context.

text

ServiceNotEnabled: KMS_ServiceNotOpen: KMS service not open yet, please open the service and try again later.
TypeName: Volcengine::KMS::KeyRing
Operation: CREATE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 65)May include surrounding context.

text

ServiceNotEnabled: KMS_ServiceNotOpen: KMS service not open yet, please open the service and try again later.
TypeName: Volcengine::KMS::KeyRing
Operation: CREATE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 89)May include surrounding context.

text

ServiceNotEnabled: KMS_ServiceNotOpen: KMS service not open yet, please open the service and try again later.
TypeName: Volcengine::KMS::KeyRing
Operation: CREATE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 88)May include surrounding context.

text

EventTime: 2026-05-30T15:09:05+08:00
TaskID: task-<id>
InvalidRequest: InvalidKeyringDeletion: Unable to delete keyring [cc-iac-kms-retry]. Please delete [1] keys in the keyring first.
TypeName: Volcengine::KMS::KeyRing
Operation: DELETE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 101)May include surrounding context.

text

EventTime: 2026-05-30T15:09:05+08:00
TaskID: task-<id>
InvalidRequest: InvalidKeyringDeletion: Unable to delete keyring [cc-iac-kms-retry]. Please delete [1] keys in the keyring first.
TypeName: Volcengine::KMS::KeyRing
Operation: DELETE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 88)May include surrounding context.

text

EventTime: 2026-05-30T15:09:05+08:00
TaskID: task-<id>
InvalidRequest: InvalidKeyringDeletion: Unable to delete keyring [cc-iac-kms-retry]. Please delete [1] keys in the keyring first.
TypeName: Volcengine::KMS::KeyRing
Operation: DELETE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 94)May include surrounding context.

text

EventTime: 2026-05-30T15:09:05+08:00
TaskID: task-<id>
InvalidRequest: InvalidKeyringDeletion: Unable to delete keyring [cc-iac-kms-retry]. Please delete [1] keys in the keyring first.
TypeName: Volcengine::KMS::KeyRing
Operation: DELETE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 100)May include surrounding context.

text

EventTime: 2026-05-30T15:09:05+08:00
TaskID: task-<id>
InvalidRequest: InvalidKeyringDeletion: Unable to delete keyring [cc-iac-kms-retry]. Please delete [1] keys in the keyring first.
TypeName: Volcengine::KMS::KeyRing
Operation: DELETE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 101)May include surrounding context.

text

EventTime: 2026-05-30T15:09:05+08:00
TaskID: task-<id>
InvalidRequest: InvalidKeyringDeletion: Unable to delete keyring [cc-iac-kms-retry]. Please delete [1] keys in the keyring first.
TypeName: Volcengine::KMS::KeyRing
Operation: DELETE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 103)May include surrounding context.

text

EventTime: 2026-05-30T15:09:05+08:00
TaskID: task-<id>
InvalidRequest: InvalidKeyringDeletion: Unable to delete keyring [cc-iac-kms-retry]. Please delete [1] keys in the keyring first.
TypeName: Volcengine::KMS::KeyRing
Operation: DELETE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/volcenginecc-blocked.md (reported line 107)May include surrounding context.

text

EventTime: 2026-05-30T15:09:05+08:00
TaskID: task-<id>
InvalidRequest: InvalidKeyringDeletion: Unable to delete keyring [cc-iac-kms-retry]. Please delete [1] keys in the keyring first.
TypeName: Volcengine::KMS::KeyRing
Operation: DELETE
OperationStatus: FAILED

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This section explicitly states that vke_kubeconfig.kubeconfig is stored in Terraform state as a base64 string containing credentials. While the documentation is warning about the risk rather than causing it, the underlying example design creates credential material that can be exposed through unsecured state files, shared backends, logs, or accidental commits.

Content

Scanner excerpt · references/volcenginecc-vke.md (reported line 104)May include surrounding context.

md

6. Node pool passwords are sensitive in Terraform output, but Terraform state still stores sensitive values. Do not commit `terraform.tfstate*`; delete throwaway verification directories after destroy.

7. `vke_kubeconfig.kubeconfig` is a base64 string in state and includes credentials. Treat it as a secret and prefer short `valid_duration` values for examples.

8. `vke_cluster.cluster_config.security_group_ids` is computed after cluster creation. Use it for node pool security groups instead of hardcoding temporary security group IDs.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md

# SPDX-License-Identifier: MIT
# export_outputs.sh — Run `terraform output -json` and write the result to a
# stable path consumed by `volcengine-deploy` (.volcengine/iac-outputs.json by
# default). Sets file mode 0600 because kubeconfig and DB connection strings
# are sensitive.
#
# Usage:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/backend-tos.md (reported line 106)May include surrounding context.

md

# SPDX-License-Identifier: MIT
# export_outputs.sh — Run `terraform output -json` and write the result to a
# stable path consumed by `volcengine-deploy` (.volcengine/iac-outputs.json by
# default). Sets file mode 0600 because kubeconfig and DB connection strings
# are sensitive.
#
# Usage:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/volcenginecc-blocked.md:602

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/volcenginecc-redis-public-address.md:29

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/volcenginecc-redis.md:31