Volcengine Vefaas

• Outcome: Review
• Latest audit: Jun 25, 2026 · 6:15 PM UTC
• Version: 1.0.2

Overview

This is a coherent veFaaS deployment helper, but it repeatedly encourages non-interactive cloud changes and handling secrets without enough safety warnings.

Review this skill before installing if it may be used against production Volcengine resources. Prefer SSO or secret-managed credentials, avoid pasting AK/SK into chat or shell history, remove --yes unless the target app/region/gateway is confirmed, and redact debug logs and environment values before sharing them.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly documents `vefaas login --accessKey <AK> --secretKey <SK>` but provides no warning that these values are highly sensitive credentials that may be exposed through shell history, logs, screenshots, or copied transcripts. In an AI-agent context, users may paste real secrets into prompts or commands, increasing the chance of credential leakage and subsequent unauthorized access to Volcengine resources.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation recommends `vefaas deploy ... --yes`, which suppresses confirmation prompts and can cause immediate creation or modification of remote serverless resources without an explicit user acknowledgment of the changes. In an agent-driven workflow, this makes accidental deployment, billing impact, configuration drift, or overwriting existing resources more likely because safety interlocks are removed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to pass long-lived secrets directly on the command line and notes that credentials are stored locally, but it does not warn that CLI arguments may be exposed through shell history, process listings, CI logs, or debugging output. In an authentication guide for a deployment tool, this increases the chance of credential leakage and subsequent unauthorized access to veFaaS resources.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The cookbook gives a one-line deployment command with --yes that performs packaging, upload, and remote application creation/modification without explicitly warning the user that local code will be built and sent to the platform and that cloud resources may be changed. In an agent skill context, terse copy-pasteable commands increase the chance of unintended remote actions, cost incurrence, or deployment of sensitive code.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The environment variable examples include database credentials and API keys and instruct users to set/import them without stating that these secrets will be transmitted to and stored by the deployment platform as application configuration. In a deployment skill, this can lead users to upload production secrets or commit secret-bearing .env files to unsafe locations under the mistaken assumption they remain purely local.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The cookbook gives direct commands to modify live function code, environment variables, and configuration, but does not warn that these actions can immediately affect production behavior or overwrite existing settings. In an agent skill context, concise imperative instructions like `deploy`, `env set`, and `env import` increase the chance of accidental high-impact changes, including secret replacement, service outage, or deployment of unreviewed code.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The cookbook recommends `vefaas deploy ... --yes`, which suppresses confirmation prompts and immediately creates or updates live cloud resources. In a quickstart context this can cause accidental deployment, unexpected spend, or unreviewed production changes, especially when copied verbatim by users in CI or interactive shells.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly demonstrates commands that print all environment variables and individual secret values directly to terminal output, including credentials like DATABASE_URL and API_KEY, without any warning about exposure in shell history, shared terminals, CI logs, or screen recordings. In a deployment-management skill centered on serverless infrastructure, this increases the chance that operators will unintentionally reveal production secrets during routine use or troubleshooting.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The troubleshooting guide explicitly encourages users to collect and share full debug logs and full JSON responses, while earlier stating that debug mode captures HTTP request/response data, framework details, shell execution, and saved logs. In a deployment/authentication CLI context, those logs can easily contain access tokens, request signatures, environment variables, project metadata, file paths, and other sensitive operational data, so asking users to share them without redaction guidance creates a real data-exposure risk.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

import os

db_url = os.environ["DATABASE_URL"]
api_key = os.environ["API_KEY"]

# With default value
port = int(os.environ["PORT"]) if "PORT" in os.environ else 8000

• Confidence: 24% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Instruction Override

High

• Category: Prompt Injection

Content

# Troubleshooting Reference

## Enable Debug Mode

When encountering issues, first enable debug mode with `--debug` or `-d`:

• Confidence: 21% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Static analysis

No suspicious patterns detected.