ClawHub
Back to skill

Security audit

Volcengine Tosutil

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed tosutil command wrapper for TOS storage operations, with preview-by-default behavior and explicit execution controls, though users should treat deletion and credential use carefully.

Install only if you intend to manage Volcengine TOS from the local machine. Verify the tosutil binary checksum before installing, prefer short-lived STS credentials, preview commands first, run ls to confirm deletion scope, and avoid logging stdout/stderr from presign or credential-related operations.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill clearly instructs use of shell commands and provides executable command examples, yet no explicit permissions declaration is present. This creates a governance gap where an agent may expose shell-capable behavior without transparent permission scoping or user awareness, increasing the chance of unsafe execution paths.

Unvalidated Output Injection

High
Category
Output Handling
Content
def _run_once(self, spec: CommandSpec) -> ExecutionResult:
        started_at = time.perf_counter()
        try:
            completed = subprocess.run(
                spec.argv,
                capture_output=True,
                text=True,
Confidence
84% confidence
Finding
The service executes user-influenced `tosutil` operations and captures raw stdout/stderr, while this file only redacts argv and does not sanitize command output before returning or surfacing it. A malicious bucket/object name or server-side error message could inject terminal control sequences, misleading text, or sensitive URLs/tokens into downstream logs, agent responses, or operator consoles.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## 输入与输出

- 输入：目标命令（如 `ls/cp/rm/du/setmeta`）+ 最少必要参数（如 `tos://` 地址、本地路径、递归开关）+ 可选公共参数（`endpoint/region/credentials/conf`）。
- 输出：统一 JSON 协议（`ok/code/message/data/ts`），包含 `preview.shell`（脱敏后的可复现命令）、执行摘要、失败时的 `advice.code` 与 `next_actions`。

## 默认行为（降低用户成本 + 安全）
Confidence
91% confidence
Finding
The skill accepts broad, user-influenced command selection plus sensitive operational parameters including credentials, endpoints, config paths, and destructive subcommands like rm/setmeta. Even though the document describes preview-first behavior, this interface materially increases the risk of unsafe command construction, credential misuse, path abuse, and execution of destructive storage operations if downstream code does not strictly validate inputs.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- 对批量上传、下载、复制任务，先确认并发和分片阈值，再执行。
- 对删除类任务，默认给出预检查步骤和回滚提示，不直接跳过确认。
- 遇到高级命令且参数未完全确认时，优先结合 `tosutil help <command>` 校验，不臆造参数。
- 非交互删除使用 `-f`，不是 `-y`。清理部署产物时优先删除受限前缀，例如 `tosutil rm tos://bucket/prefix/ -r -f`，避免漏删测试 artifact 或误删无关对象。

## 标准流程
Confidence
96% confidence
Finding
The guidance explicitly recommends non-interactive force deletion using a pattern like `tosutil rm ... -r -f`, which reduces friction around destructive actions and normalizes bypassing interactive safeguards. In a shell-capable skill handling cloud storage, this is dangerous because small mistakes in bucket/prefix selection can cause irreversible mass deletion of objects.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
p_cp.add_argument("--threshold", help="分片阈值（-threshold）")
    p_cp.add_argument("--part-size", help="分片大小（-ps）")

    p_rm = sub.add_parser("rm", help="删除桶/对象/前缀（破坏性）", parents=parents)
    p_rm.add_argument("--cloud-url", required=True, help="tos://bucket 或 tos://bucket/prefix")
    p_rm.add_argument("--recursive", action="store_true", help="递归删除（-r）")
    p_rm.add_argument("--force", action="store_true", help="强制删除（-f，跳过交互确认）")
Confidence
95% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.