Security audit
Security checks for vulnerabilities and agentic risk
The cloud inventory export matches its purpose, but setup weakens download security and the credential instructions contradict the code.
Before use, replace the setup helper with dependency installation in an isolated environment using certificate-verified package sources, without cloud credentials present during setup. Obtain KooCLI through the current official installation guide. Use credentials limited to ECS listing, understand that SDK fallback reads keys from your environment, and protect reports containing instance identifiers and network addresses.
scripts/ensure_env.pyDependency installation disables TLS certificate verification for package mirrors
A network interceptor can supply replacement packages and execute code with the setup process's privileges, including access to files and cloud credentials available to that account.
The supplied script performs a materially different task: skill-specification linting. Its references to hcloud ECS ListServersDetails only search documentation for that text; they do not invoke the cloud API. It contains no instance retrieval, SDK fallback, output generation, pagination, or runtime write-intent guard. Although this could be ancillary development tooling in a larger skill, the declared description does not represent this chunk's primary behavior. No cloud mutation, credential transmission, or other malicious behavior is evident.
Without declared permissions the skill's intent is opaque and cannot be validated.
Lines 74–77 prescribe fixed Chinese workbook labels, and lines 86–87 explicitly require Chinese error hints on stderr. No user opt-in, language selection, or documented justification for restricting output to Chinese is provided.
The subprocess call uses an argument list without a shell, so it does not present an evident shell-injection vulnerability. However, its caller installs dependencies from mirrors using --trusted-host, which disables TLS certificate verification for those hosts; an attacker able to intercept that traffic could substitute malicious packages that execute during installation or subsequent import. This is particularly consequential in a cloud-management environment where the Python process may have access to cloud credentials, regardless of the skill's read-only API intent.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
guard_write_intent(" ".join(extra))
cmd.extend(extra)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
guard_write_intent(" ".join(extra))
cmd.extend(extra)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
L39–L40 promise that the script never reads credentials and relies exclusively on the active KooCLI profile. However, L60–L63 explicitly describe the SDK fallback reading AK/SK from environment variables, making the stated authentication boundary misleading.
No suspicious patterns detected.