Security audit
Security checks for vulnerabilities and agentic risk
This inventory skill needs review because its installer disables security checks and some command and filter safeguards are incomplete.
Use only read-only cloud credentials. Before running setup, remove the certificate-verification bypass and use vetted dependencies with normal HTTPS verification. Restrict or avoid the generic test runner, and avoid combining --name-equal with --tags until fixed. Set SKILL_QUALITY_REPORT=0 and skip helper installation unless its telemetry behavior has been reviewed. Verification used mocked calls and validator checks; no cloud operations, downloads, or installations were performed.
scripts/ensure_env.pyPackage installation disables TLS certificate verification
A substituted SDK package can execute attacker-controlled Python during installation or the immediate import, gaining access to files and credentials available to that process. This does not require compromise of the legitimate mirror.
The material mismatch is the execution scope and missing read-only enforcement. The command validator checks executable names and shell syntax, but does not constrain hcloud service/operation arguments or curl destinations and methods. TC_TYPE is only used for reporting; it does not prevent mutation commands from executing. Despite the script comments, the execution paths do not automatically append --help for mutations or --limit=1 for CLI reads. Consequently, template content can cause live cloud changes or unrelated network activity. A test helper could legitimately support the declared skill, but these broader live-execution capabilities contradict its explicit ListInstances-only, strictly read-only contract. The supplied chunk also contains no implementation of the described instance-export workflow.
This chunk's primary function is software installation, not DCS discovery or report export. The description mentions tests for a skill-quality-cli wrapper, but does not disclose downloading and installing that tool. The installer includes checksum verification and archive checks, and it does not visibly mutate cloud resources or execute the downloaded tool. Those safeguards do not resolve the undeclared installation capability. This assessment is limited to the supplied chunk; it does not establish whether other files implement the stated DCS functionality.
The supplied chunk is a software bootstrapper, not a DCS query or export implementation. Although the description mentions tests for a skill-quality-cli wrapper, it does not disclose automatic network-based installation of that tool. Downloading and persistently installing executable software is a material additional capability, rather than a minor report-generation implementation detail. SHA256 verification and archive-path checks reduce installation risks but do not resolve the disclosure mismatch. This chunk does not demonstrate cloud mutations or credential exfiltration.
The strongest mismatch is filter behavior: main() explicitly removes both name and tags from the API query when --name-equal is set, then filters only by name locally. Consequently, results can include instances that do not satisfy the user's requested tags, despite the output describing that tags filter as applied. The optional reporting wrapper is another behavior beyond the stated query-and-local-export workflow, although the supplied code does not establish what the external wrapper records or transmits. No cloud-mutating DCS operation is apparent. Markdown formatting and atomic-write guarantees cannot be verified from this chunk because export_markdown is imported rather than supplied.
The supplied script's primary behavior is validating a skill package against structural and security conventions. It does not execute DCS ListInstances, invoke the DCS SDK, generate instance reports, or enforce a runtime DCS write-intent guard. Although such a validator could be ancillary development tooling, this chunk implements a distinct compliance-auditing workflow rather than an implementation detail of the declared DCS query/export operation. No cloud mutation or data exfiltration is evident. This assessment applies only to the supplied chunk; other files could implement the declared functionality.
The supplied script's substantive purpose is skill-metadata validation, which is not described in the declared DCS functionality. It contains no cloud API calls, KooCLI invocation, SDK fallback, instance processing, report export, or write-intent guard. Although this validator could be ancillary tooling in a larger skill package, the supplied chunk does not establish that connection. This assessment is limited to the provided code; it does not imply that other files lack the declared functionality. No cloud mutation, network access, or malicious behavior is evident.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
The runner executes commands from test-vars.json after checking only the executable name, without enforcing DCS ListInstances or converting mutation tests to help-only checks. A modified test case can invoke cloud mutations using ambient credentials, and SDK fallback likewise lacks an operation allowlist, contradicting the read-only scope.
The executable allowlist permits curl with arbitrary options and destinations supplied by test cases. This allows local-file uploads, arbitrary network requests, and file writes without shell injection, making a supposedly read-only validation workflow a potential exfiltration or overwrite path.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
The script fetches a release manifest and executable archive (L037–L059), then installs executable files and supporting Python modules under ~/.local/bin (L089–L103). Although the manifest mentions tests for a skill-quality-cli wrapper, it does not declare automatic software installation; this persistent modification of the user's executable environment is not necessary to query DCS instances or generate local reports. SHA256 verification protects download integrity but does not justify the additional capability.
The subprocess call is not shell-injectable, but its pip-install caller supplies --trusted-host for both package mirrors, disabling TLS certificate verification for those hosts. A network attacker could substitute package metadata and distributions, leading to attacker-controlled Python execution during installation or subsequent SDK imports in an environment that may contain cloud credentials.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
The module explicitly states that Chinese column headers are always written, and the implementation also uses a Chinese summary. No language selection, user opt-in, or justified locale constraint is provided, so report labels are forced into Chinese regardless of the user's preferred language.
L26–L48 fetch a release manifest and executable archive for skill-quality-cli; L78–L88 then install or overwrite executable components persistently under ~/.local/bin. The stated purpose requires KooCLI or the DCS SDK and local report output, not installation of a separate quality-assessment tool. Although the manifest mentions tests for a skill-quality-cli wrapper, it does not describe this remote-download and persistent-install capability.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
guard_write_intent(" ".join(extra))
cmd = build_hcloud_command(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
guard_write_intent(" ".join(extra))
cmd = build_hcloud_command(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Enabling --name-equal passes tags=None to the query, and subsequent local filtering checks only the instance name. The report can therefore contain instances outside the requested tag scope while still describing the tag filter as active; this is a report-scoping and potential disclosure issue, not an IAM authorization bypass.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# ak=..., sk=...) inside a BasicCredentials(...) call — both are
# in-band secret-entry forms that put AK/SK on a command
# line / SDK kwarg, contradicting the Pre-check contract:
# 'NEVER ask the user to type or paste AK/SK in chat; user must
# set env vars in shell profile out-of-band and re-run.'
# Whitelist: lines that contain the patterns inside NEVER / Do NOT
# / 禁止 / forbidden contexts (prose warnings about the anti-pattern
The skill requires a fixed header row containing Chinese labels, regardless of the user's language. It provides no language-selection option or justification for restricting the report language; the prescribed summary at lines 247–248 likewise uses Chinese.
The acceptance criterion fixes the report's table headers to Chinese labels rather than following the user's language preference. No language opt-in or justification for this output-language constraint is provided.