Security audit
Security checks for vulnerabilities and agentic risk
This cloud-listing skill needs review because it can misdirect authentication tokens, weakens package-download security, and requires poorly documented telemetry.
Keep this version in Review until authenticated requests enforce approved endpoints and safe redirects, package installation preserves TLS verification, and telemetry becomes optional with clear data-handling disclosures. Avoid wrapping credential checks. Use narrowly scoped cloud credentials and treat resource and access-code output as private. The remote telemetry executable was not bundled, so its actual collection behavior remains unverified.
scripts/ensure_env.pyDependency installation disables TLS certificate verification
An active network attacker can substitute SDK packages, obtaining code execution during package installation or subsequent import. Such code would execute in the same account used for cloud queries.
Sending an authentication token to Huawei Cloud is expected, but the REST fallback interpolates the unvalidated --region value into the URL before attaching X-Auth-Token. A region such as attacker.example/ changes the destination to https://aom.attacker.example/, allowing an attacker controlling that host to capture the token when the REST fallback is reached; read-only operation restrictions do not prevent credential theft.
request.add_header("X-Auth-Token", token)
request.add_header("Content-Type", "application/json")
try:
with urllib.request.urlopen(request, timeout=60) as response:
body = response.read().decode("utf-8")
except urllib.error.HTTPError as exc:
if exc.code in (401, 403):
The supplied script is an installer for skill-quality-cli, not an AOM resource-name query implementation. Its persistent software installation and unrelated release-service access are substantial undeclared capabilities, not merely internal details of the stated read-only query workflow. SHA256 verification and archive checks mitigate installation risks but do not resolve the purpose mismatch. This assessment is limited to the supplied chunk; it does not establish whether other files implement the declared AOM functionality.
The supplied chunk implements an installer, not an AOM query backend or a necessary implementation detail of the described listing behavior. Its persistent filesystem writes and unrelated software download are not disclosed by the read-only, stdout-only purpose. SHA-256 verification and archive checks provide safeguards but do not remove this mismatch. The code comments describe manual invocation, so the chunk does not establish that installation happens automatically or that the downloaded program is executed.
Installing a required AOM backend could be a supporting implementation detail, but this excerpt targets skill-quality-cli rather than hcloud or the declared AOM SDK. Its installation and upgrade workflow is unrelated to the stated purpose. The installer script bodies are not supplied, so their exact behavior cannot be verified; the mismatch is based on the commands and their documented function.
The readiness example places credential-profile inspection inside a reporting-capable wrapper, unnecessarily exposing potentially sensitive profile output to another executable. Actual collection or transmission is not demonstrated, and credentials may be masked, but this is an avoidable exposure boundary in a credential-bearing cloud workflow.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
The mandatory wrapper introduces an additional executable and reporting trust boundary into otherwise read-only cloud queries. Its collection behavior and data handling are not specified, so the workflow exposes cloud-query execution to unnecessary instrumentation without an informed opt-in.
The guide requires every hcloud call to pass through an unrelated quality-reporting executable rather than making instrumentation optional. This expands access to cloud command execution and potentially its inputs and outputs; the reporting-disable variable does not establish that the wrapper itself is bypassed.
The guide acknowledges telemetry and provides an opt-out, but does not describe the data collected, reporting destination, retention, or treatment of sensitive command output. Mandatory wrapping without those disclosures creates a privacy risk, although the supplied source does not prove that secrets are transmitted.
When invoked, this readiness helper automatically installs a remotely selected latest executable into the user's persistent executable directory without a separate approval step. SHA256 validation and archive checks reduce risk, but do not establish independent publisher authenticity because the download location and expected hash come from the same manifest.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
The manifest describes read-only AOM resource-name queries using KooCLI, the AOM SDK, or REST, not installation of a separate skill-quality tool. This script retrieves a remote package manifest, downloads an archive, and installs executable files under ~/.local/bin; manual invocation and checksum validation do not make that capability necessary for the declared AOM query purpose.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=HCLOUD_TIMEOUT, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=HCLOUD_TIMEOUT, universal_newlines=True,
)
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
if isinstance(response, dict):
payload = response.get(key)
else:
payload = getattr(response, key, None)
payload = to_plain(payload)
if kind == "single":
return payload if payload is not None else {}
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
"credentials": core_credentials.BasicCredentials,
"region": core_region.Region,
"http_config": core_http.HttpConfig,
"client": getattr(package, spec["sdk_client"]),
"request": getattr(package, spec["request"]),
"region_catalog": getattr(region_module, "AomRegion"),
"spec": spec,
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
"region": core_region.Region,
"http_config": core_http.HttpConfig,
"client": getattr(package, spec["sdk_client"]),
"request": getattr(package, spec["request"]),
"region_catalog": getattr(region_module, "AomRegion"),
"spec": spec,
}
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
raise ConfigError("SDK 初始化失败（region=%s）：%s" % (region, exc))
request = build_sdk_request(category, loader, params)
try:
response = getattr(client, spec["sdk_method"])(request)
except Exception as exc:
low = str(exc).lower()
if any(p in low for p in _AUTH_PATTERNS):