Security audit
Security checks for vulnerabilities and agentic risk
This CDN listing skill needs review because its dependency installer weakens download security and local settings can bypass its advertised read-only protection.
Before installing, have the dependency helper retain certificate verification and use verified, pinned packages in an isolated environment. Verify the CLI installer before executing it. Use credentials restricted to CDN listing and keep executable overrides unset or tightly controlled. The bundled code was inspected, but external downloads and live cloud behavior were not verified.
scripts/ensure_env.pyDependency installation disables certificate verification for package indexes
An active network attacker can substitute an SDK package and execute code with the user's privileges, potentially accessing the cloud credentials available to that process.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
)
def _clean_credential_env(self):
env = dict(os.environ)
for name in self._CREDENTIAL_ENV_KEYS:
env.pop(name, None)
return env
Without declared permissions the skill's intent is opaque and cannot be validated.
The installation procedure executes a mutable remote shell script without checking a trusted digest or signature, giving its contents the invoking user's privileges. HTTPS protects transport but does not prevent execution of a compromised upstream artifact; the read-only CDN operation does not constrain installer side effects.
The subprocess call uses an argument list and is not itself shell injection, but its pip-install callers explicitly mark third-party mirror hosts as trusted, bypassing normal TLS certificate verification for those hosts. Combined with unpinned packages and no trusted hash verification, this allows a network or mirror attacker to supply code that executes during installation or subsequent SDK imports, potentially accessing cloud credentials.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
The write-intent guard validates user arguments and the operation name, but does not constrain the environment-selected executable or prepended arguments. Consequently, someone controlling those overrides can replace the entire execution path, bypassing the claimed read-only guarantee; actual cloud-write impact still depends on the credentials' IAM permissions.
Although subprocess.run uses no shell, the executed program and prepended arguments can both be supplied through environment overrides. An attacker able to influence those variables can select an interpreter or malicious executable rather than hcloud, executing code with the process's privileges and inherited credentials; ordinary domain filter values do not provide this capability.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
CDN_LIST_HCLOUD_BIN and CDN_LIST_HCLOUD_ARGS flow into the executable position and argument list without validation. If a less-trusted launcher or configuration can set them, arbitrary code can run and access the inherited cloud credentials; this is environment-controlled execution, not shell metacharacter injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The criteria prescribe specific Chinese messages for empty results and authorization failures. These requirements fix the language of user-facing output without offering user opt-in or explaining a locale-specific need.