Security audit
Security checks for vulnerabilities and agentic risk
This CDN exporter needs review because its setup weakens download security, its telemetry is insufficiently explained, and its bundled live test runner exceeds its read-only scope.
Use a dedicated CDN read-only identity. Install SDK dependencies separately with certificate verification enabled, preferably in an isolated environment. Set SKILL_QUALITY_REPORT=0 and skip quality-tool installation until its executable and reporting behavior are reviewed. Use the documented offline tests instead of the generic live runner, and check exported domains before sharing because SDK fallback ignores exact-match. All bundled files were inspected; the separately downloaded reporting executable remains unverified.
scripts/ensure_env.pyDependency installation disables TLS certificate verification
Arbitrary code execution during package installation or the immediate import, with access to files and credentials available to that process.
The supplied script's primary purpose is validating a skill against a structural and security specification, which is materially different from the declared CDN-listing workflow. It does not execute hcloud CDN ListDomains, invoke the CDN SDK, process CDN pagination or filters, or generate domain-list exports. Its checks of hcloud command text and write-operation confirmation are static documentation checks, not the declared runtime write-intent guard. This assessment is limited to the supplied code chunk; it does not establish whether other files implement the declared functionality. No cloud mutation or network exfiltration is evident in this script.
Installing or overwriting quality-tool executables introduces local software modification and subsequent code execution beyond read-only CDN access. Although the body mentions installation, the automatic latest-release dependency unnecessarily exposes a credentialed workflow to release-service or package compromise.
The bundled generic functional runner provides a separate path for configuration-supplied hcloud and curl commands without the exporter’s ListDomains-only restriction. If invoked on malicious or mistaken test configuration, it can perform live cloud mutations or unrelated requests with ambient privileges; this does not establish that the normal exporter itself permits mutations.
The skill adds an unnecessary executable-installation trust boundary to a CDN inventory workflow: its readiness helper downloads a manifest-selected release and installs persistent executable files. The documentation does disclose this dependency, so it is not wholly hidden, but an automatically selected release can subsequently execute with access to the user's cloud credentials and query results.
Default wrapping places an additional reporting-capable program around credentialed cloud commands, potentially exposing command metadata or results beyond the CDN service and local export boundary. Telemetry is disclosed in the body and can be disabled, and no particular leaked payload is established; the alleged SDK filter omissions are functional defects rather than independently demonstrated security vulnerabilities.
The automatic installation component introduces unnecessary executable supply-chain exposure into an authenticated inventory workflow. Manual upgrade instructions and a telemetry-disable setting are not vulnerabilities by themselves, and the documentation explicitly says upgrades are not automatic.
The supplied chunk contains no Huawei Cloud API or CLI calls, domain processing, export generation, or write-intent guard. Its standalone metadata-validation purpose is materially different from the declared CDN functionality, rather than an implementation detail of that functionality. This assessment applies only to the supplied chunk; other files could implement the declared features. No network access, cloud mutation, or malicious behavior is evident.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
The allowlist checks the executable name but permits arbitrary hcloud services, operations, and arguments from test-vars.json. Despite comments promising help-only mutation checks, the runner executes these commands directly, allowing malicious or mistaken test configuration to mutate cloud resources using the active profile.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
self.addCleanup(self._builder_patch.stop)
def _clean_credential_env(self):
env = dict(os.environ)
for name in self._CREDENTIAL_ENV_KEYS:
env.pop(name, None)
return env
Without declared permissions the skill's intent is opaque and cannot be validated.
The guide routes authenticated cloud commands through an unrelated reporting-capable executable by default, adding a potential recipient of sensitive command metadata and inventory output. An opt-out is provided and no actual telemetry payload is shown, so confirmed credential exfiltration cannot be inferred.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
A readiness check automatically installs executable code selected by a mutable remote manifest into the user's persistent executable directory. HTTPS, mandatory SHA256 comparison, and archive path checks provide useful protections, but a compromised manifest publisher can supply both a malicious archive and its matching hash; later execution inherits the user's privileges.
The subprocess call uses an argument list without a shell, so the match does not demonstrate shell injection. However, its concrete pip callers pass --trusted-host for the mirrors, weakening TLS certificate verification while installing unpinned executable packages; a network attacker could substitute packages that later run with access to cloud credentials.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
When available, skill-quality-cli automatically wraps cloud queries unless telemetry is explicitly disabled, although telemetry is absent from the supplied skill description. This gives an additional reporting component access to query arguments, inherited environment credentials, and potentially command results; the supplied code does not establish exactly what it transmits.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
guard_write_intent(" ".join(extra))
cmd = build_hcloud_command(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
guard_write_intent(" ".join(extra))
cmd = build_hcloud_command(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The SDK fallback silently omits exact_match and show_tags despite accepting them on the CLI path. In particular, dropping an explicitly requested exact match can export additional authorized domains into a report intended for narrower sharing; this is a data-minimization failure, not an IAM bypass.
L26-L48 fetch a quality-CLI release manifest and binary archive, while L78-L88 install executable files and supporting modules into ~/.local/bin. The manifest authorizes CDN queries through hcloud or the CDN SDK and local domain-list exports, not installation of skill-quality-cli; manual invocation and checksum validation do not make this unrelated capability part of the declared scope.
Allowing the curl executable without validating its arguments permits arbitrary destinations, methods, upload sources, configuration files, and output paths. Malicious test configuration can therefore upload readable local files, reach internal services, or perform state-changing requests even though shell metacharacters are blocked.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# ak=..., sk=...) inside a BasicCredentials(...) call — both are
# in-band secret-entry forms that put AK/SK on a command
# line / SDK kwarg, contradicting the Pre-check contract:
# 'NEVER ask the user to type or paste AK/SK in chat; user must
# set env vars in shell profile out-of-band and re-run.'
# Whitelist: lines that contain the patterns inside NEVER / Do NOT
# / 禁止 / forbidden contexts (prose warnings about the anti-pattern
The Markdown format explicitly fixes column labels and summary text in Chinese, regardless of the user's language. No language opt-in or justification for this locale constraint is documented; selecting an output format is not a language choice.
The verification criteria prescribe the Chinese column label 域名 and the Chinese empty-result message 当前区域（cn-north-1）无 CDN 加速域名. This makes Chinese output a requirement without documented user opt-in or a justification for that language constraint.