Security audit
Security checks for vulnerabilities and agentic risk
This cloud inventory skill needs review because its installer disables certificate checks and its required telemetry tool has unclear data handling.
Prefer a corrected version that preserves certificate verification and makes telemetry optional. Use read-only cloud credentials and protect exported inventory files. Before enabling telemetry, review a pinned release and its reporting behavior; the downloaded wrapper was not available for inspection, so its data handling and advertised opt-out remain unverified. Run the optional smoke script only with trusted environment values.
scripts/ensure_env.pyDependency installation disables TLS certificate verification
A substituted dependency can execute arbitrary code during installation or subsequent import, potentially accessing local files and cloud credentials available to the process.
Persistent installation of the unrelated quality CLI expands a read-only cloud inventory task into host executable installation. The dependency is disclosed in the document body, so it is not wholly hidden, but the mandatory expansion still exposes future wrapped commands to downloaded code; this finding overlaps the preceding mismatch finding.
The ECS/local-export description expands into installation and execution of an additional network-connected telemetry tool. Although the body discloses this dependency, making it mandatory introduces executable supply-chain exposure and access to the cloud command's environment and output outside the inventory task's necessary trust boundary.
The primary purpose and cloud access match the declaration: the constructed ECS operation is ListServersDetails, with an official SDK read fallback and no visible cloud mutation calls. However, two explicit advertised behaviors are contradicted by the implementation. The JSON branch never writes the requested output file. In addition, _sort_key_value returns (True, text.lower()) when timestamp parsing fails, so invalid timestamps are not classified as missing/unparseable and may break sorting when compared with datetime values. The imported export_report implementation was not supplied, so its XLSX and UTF-8-BOM CSV details cannot be independently verified.
Referenced artifact was not completely inspected
bash scripts/test-cli-commands.sh
The flagged request retrieves JSON rather than directly executing a remote script, but that JSON determines the executable artifact installed later. A compromised release service can choose both the payload URL and its matching SHA256, so the checksum does not independently authenticate the release; unrestricted download URLs further broaden the supply-chain boundary.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
The mandatory wrapping instruction inserts an unnecessary telemetry component into authenticated ECS queries. That wrapper can observe command arguments, inherited environment, and cloud inventory output; the supplied material does not establish which of these are actually transmitted, but it creates an additional disclosure boundary.
The guide requires installing a telemetry CLI and routing authenticated inventory commands through it despite telemetry not being necessary for ECS export. Disclosure and an opt-out reporting variable reduce surprise, but do not remove the extra executable trust boundary or demonstrate that sensitive inventory and credentials are protected.
The report requirements fix the sheet title, headers, and summary label to Chinese, and the pass criteria require Chinese error hints on stderr. No user language choice or justification for this language constraint is provided; using a regional cloud service does not itself justify forcing Chinese output.
When invoked without an existing usable CLI, this script downloads a manifest-selected executable and persistently installs it outside the ECS export task. HTTPS, checksum verification, and archive checks mitigate several attacks, but a compromised release manifest can supply both a malicious artifact and its matching hash, and download URLs are not restricted to approved HTTPS origins.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
The installer places an unrelated quality CLI and supporting code into the user's executable directory for subsequent use around cloud commands. Manual invocation makes this less surprising than automatic installation, but the required workflow still expands the task's trust boundary without a functional need for ECS inventory.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
guard_write_intent(" ".join(extra))
cmd.extend(extra)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
guard_write_intent(" ".join(extra))
cmd.extend(extra)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The manifest promises native timestamp comparisons and that unparseable sort values are always placed last. At L752-L753, a timestamp parse failure returns a valid text value instead; malformed timestamps therefore sort lexically when all values are malformed and can cause a TypeError when mixed with parsed datetime values.
The manifest promises structured JSON file export with --output selecting the file path. At L879-L881, JSON mode instead prints to stdout and returns before the output path is processed, so a requested JSON report file is never created.