Security audit
Security checks for vulnerabilities and agentic risk
This host-listing skill needs review because it requires an extra telemetry tool whose reporting behavior is insufficiently explained.
Review the telemetry tool separately before installing, including its exact payload, destination and release verification. Prefer optional telemetry setup. If proceeding, use credentials limited to HSS host listing and clear the test executable overrides. The documented SKILL_QUALITY_REPORT=0 switch does not prevent installing or executing the wrapper, and its implementation was unavailable for inspection.
Requiring an unrelated executable to be installed persistently broadens the local effects of a nominally read-only cloud query. The dependency is mentioned in the documentation, so this is not wholly concealed behavior, but mandatory installation still adds avoidable executable-supply-chain exposure.
The mandatory telemetry dependency expands an inventory query into downloading, installing, and running additional software with the agent's privileges. Although the body discloses this dependency, the read-only HSS purpose does not require it, and making it mandatory introduces an unnecessary supply-chain and data-handling trust boundary.
The security-relevant mismatch is making installation and execution of a telemetry wrapper a prerequisite for HSS listing. Upgrades are explicitly manual rather than automatic, and the dependency is documented, but neither fact removes the unnecessary trust placed in auxiliary executable code.
The highlighted curl response is parsed as JSON, not executed as Python, so the matched fragment is not direct script execution. However, the installer uses that mutable manifest to select both an executable archive and its expected checksum without independent release authentication or a download-origin restriction; compromise of the manifest can therefore result in malicious executable installation and later execution.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
Shadow Command Trigger: description clause 'Supports --region override and readable modes --json (raw response array) and --names-only (compact host-name list)' conflicts with built-in command 'list'
Automatic telemetry and installation add network destinations, local mutations, and another executable to a security-inventory workflow. The provided text does not establish what telemetry contains, but requiring the wrapper without affirmative consent creates an unnecessary data-handling and supply-chain exposure.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz -o koocli.tar.gz tar -xzf koocli.tar.gz sudo mv hcloud /usr/local/bin/ hcloud version
The guide makes a telemetry-producing wrapper mandatory and forbids an otherwise sufficient direct HSS query. This needlessly places an additional executable and reporting path in a credential-bearing workflow; the provided guide does not specify the reported data or demonstrate credential exfiltration.
The diagram explicitly specifies Chinese for error hints, fixing the language of user-facing output. The file provides neither user opt-in nor a documented reason for this language constraint.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
This readiness helper automatically installs persistent executable components selected by a mutable remote manifest, despite those components being unnecessary for HSS inventory. SHA256 checking and archive-path checks are useful protections, but a checksum supplied by the same manifest does not protect against a compromised release manifest distributing malicious code.
The script fetches a release manifest and downloads an external package, then installs executable files and supporting modules into ~/.local/bin. The declared skill only lists HSS hosts through KooCLI or the HSS SDK; installing skill-quality-cli is unrelated to either execution path and introduces persistent local changes. Manual invocation and checksum verification do not make this additional capability necessary for the stated purpose.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
The write-intent and operation guards inspect command-line inputs, but execution also consumes unchecked environment overrides that can replace the program entirely. Consequently, the promised read-only restriction is not enforced at the execution boundary: malicious inherited configuration could run arbitrary code, access cloud credentials, or perform writes permitted by those credentials.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
HSS_LIST_HCLOUD_BIN selects an arbitrary executable, while HSS_LIST_HCLOUD_ARGS supplies unchecked leading arguments, allowing an environment-controlling attacker to substitute an interpreter or wrapper that executes code with the agent's privileges and credential access. This is conditional on control of the process environment—not ordinary host-filter input—and duplicates the underlying issue in SDI-1.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The workflow explicitly specifies Chinese error hints, reinforced by the language requirement at lines 74–77. The skill provides no user opt-in, language selection, or documented justification for requiring Chinese regardless of the user's language.
These criteria require specific Chinese messages for permission errors and empty regions, imposing an output language regardless of the user's preference. The file provides neither a language choice nor a documented justification for this restriction.