Security audit
Security checks for vulnerabilities and agentic risk
The skill performs its advertised export job, but unsafe dependency installation and incomplete upload verification need review.
Avoid the dependency helper until certificate verification is restored; install reviewed, pinned dependencies in an isolated environment. Use narrowly scoped cloud credentials and a trusted destination bucket, and approve overwrites explicitly. Independently verify uploaded file sizes because the advertised check can be skipped. All bundled files were reviewed, but live cloud behavior and downloaded code remain unverified.
scripts/ensure_env.pyDependency installation disables TLS certificate verification
Arbitrary code execution with the helper's privileges, potentially exposing cloud credentials accessible to that account.
The supplied script implements the CDN query portion, but not the declared export-to-OBS workflow. Its only result destination is stdout, and its default format is a plain-text table rather than a JSON file. The missing file export, upload, overwrite protection, and verification constitute a materially narrower primary workflow, not merely implementation differences. No undeclared malicious behavior is evident. The claimed unit-test coverage cannot be verified from this code chunk.
In verify_object(), the SDK fallback calls sdk_object_exists(), which discards the head_object response metadata, then returns size=null and size_match=null. The CLI path likewise returns without error when no size is parsed. Thus verification can complete without the size comparison explicitly promised by the description. Otherwise, the module's OBS access and upload behavior align with the declared purpose. CDN querying, serialization, and tests cannot be assessed from this upload-only chunk; their absence here is not treated as a mismatch.
Without declared permissions the skill's intent is opaque and cannot be validated.
The live-verification workflow instructs the agent to upload CDN domain data to OBS and then repeat the upload with --overwrite. Although overwrite refusal is noted, there is no warning that these commands transmit account inventory to cloud storage and can replace an existing object at the selected key.
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
list_cdn.list_domains(...) # hcloud CDN ListDomains (SDK fallback)
→ export_results.export(...) # local json / csv / md (atomic write)
→ upload_obs.upload_file(...) # hcloud OBS cp (SDK fallback)
→ upload_obs.verify_object(...) # hcloud OBS stat read-back
The CDN side is strictly read-only; the only write is the single OBS object
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
size = os.path.getsize(local)
fake = FakeHcloud(self._handler(exists=False, verify_size=size))
with mock.patch("subprocess.run", fake):
result = upload_obs.upload_file(
"cn-north-4", local, "bk", "k", verify=True)
self.assertFalse(result["existed_before"])
self.assertEqual(result["uploaded_via"], "cli")
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
fake = FakeHcloud(self._handler(exists=True))
with mock.patch("subprocess.run", fake):
with self.assertRaises(upload_obs.OverwriteError):
upload_obs.upload_file("cn-north-4", local, "bk", "k")
# no cp issued
self.assertTrue(all(obs_subop(c) != "cp" for c in fake.obs_calls))
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
size = os.path.getsize(local)
fake = FakeHcloud(self._handler(exists=True, verify_size=size))
with mock.patch("subprocess.run", fake):
result = upload_obs.upload_file(
"cn-north-4", local, "bk", "k", overwrite=True)
self.assertTrue(result["existed_before"])
self.assertTrue(result["overwritten"])
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
fake = FakeHcloud(handler)
with mock.patch("subprocess.run", fake):
with self.assertRaises(upload_obs.ObsError) as ctx:
upload_obs.upload_file("cn-north-4", local, "bk", "k")
self.assertIn("大小", str(ctx.exception))
def test_missing_local_file(self):
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
side_effect=[False, True]), \
mock.patch("upload_obs.sdk_put_object",
return_value={"etag": "x", "size": 2}) as put:
result = upload_obs.upload_file("cn-north-4", local, "bk", "k")
self.assertEqual(result["uploaded_via"], "sdk")
put.assert_called_once()
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
fake = FakeHcloud(self._handler(exists=False, cp_ok=False))
with mock.patch("subprocess.run", fake):
with self.assertRaises(upload_obs.ApiError):
upload_obs.upload_file("cn-north-4", local, "bk", "k", verify=False)
# --------------------------------------------------------------------------
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
return result
key = args.key or os.path.basename(local_path)
upload = upload_obs.upload_file(
args.region, local_path, args.bucket, key,
endpoint=args.endpoint, overwrite=args.overwrite,
verify=not args.no_verify,
The subprocess call uses an argument list rather than a shell, so it is not itself shell injection. However, its callers install unpinned executable Python dependencies from third-party mirrors with --trusted-host, disabling normal certificate verification for those hosts; a network or mirror attacker could supply malicious packages that execute during installation or later import in the credential-bearing environment.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
The fixed Chinese headings are applied to every Markdown export, regardless of the user's language; the optional summary is also hardcoded in Chinese. The file provides no language selection or documented regional justification for this constraint.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=300, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=300, universal_newlines=True,
)
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
with open(local_path, "rb") as handle:
request = PutObjectRequest(
stream=handle, bucket_name=bucket, object_key=key)
response = client.put_object(request)
except OSError as exc:
raise ObsError("无法读取本地文件 %s：%s" % (local_path, exc))
except Exception as exc: # noqa: BLE001
With verification enabled, the SDK fallback checks only existence and returns no size comparison; the CLI path also accepts metadata with no parseable size. This weakens the advertised archive-integrity safeguard: a truncated or otherwise wrong-sized object can leave the operation successful without the requested verification being completed.
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
def test_missing_local_file(self):
with self.assertRaises(upload_obs.ObsError):
upload_obs.upload_file("cn-north-4", "/no/such/file", "bk", "k")
def test_sdk_fallback(self):
with tempfile.TemporaryDirectory() as tmp:
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
fake = FakeHcloud(self._handler(exists=False, cp_ok=False))
with mock.patch("subprocess.run", fake):
with self.assertRaises(upload_obs.ApiError):
upload_obs.upload_file("cn-north-4", local, "bk", "k", verify=False)
# --------------------------------------------------------------------------
The guide specifies the fixed Chinese message 缺少 AK/SK 凭证 for credential failures, irrespective of the user's language. No language opt-in or locale-specific justification is provided for this user-facing output.