Security audit
Security checks for vulnerabilities and agentic risk
The skill performs the advertised reporting task, but its installation steps weaken download security and need review before use.
Before use, replace the dependency helper with installation in a dedicated virtual environment using certificate verification and reviewed versions. Obtain KooCLI through Huawei's verified distribution instructions. Use credentials restricted to bucket listing, keep secrets out of chat, and avoid relying on endpoint overrides or result limits during SDK fallback until those defects are fixed.
scripts/ensure_env.pyDependency installation disables TLS authentication for package mirrors
Arbitrary code execution with the installing user's privileges, including access to files and credentials available to that process.
Although CLI setup can support the declared task, this chunk introduces remote script execution with effects that cannot be established from the supplied code. That is materially broader than read-only OBS access and local report generation, and the description does not disclose this installation behavior or the external script source. The chunk does not establish that the downloaded script is malicious or that it modifies OBS.
The installation instructions execute a downloaded, mutable installer with bash without verifying its signature or a trusted, pinned checksum. If the distribution endpoint or installer is compromised, following these instructions could execute arbitrary code with the user's privileges, potentially accessing cloud credentials and local files. Installing KooCLI is relevant to the skill, so this is an unsafe installation practice rather than evidence of malicious tool-parameter manipulation; the skill's read-only OBS restrictions do not constrain the installer.
# Linux/macOS quick start
curl -sSL https://cn-north-4-res.hcccloud.com/cli/latest/install.sh -o install.sh
bash install.sh
hcloud version
Without declared permissions the skill's intent is opaque and cannot be validated.
The verification criteria fix workbook titles and headers to Chinese and require error paths to emit a Chinese hint on stderr. No user language choice or documented justification for this language constraint is provided.
The subprocess call does not introduce shell injection: it uses an argument list with no shell, and its callers construct controlled pip commands. However, those commands install executable dependencies from mirrors using --trusted-host, which disables HTTPS certificate verification for those hosts; a network attacker able to intercept that traffic could substitute malicious packages and execute code during installation or the subsequent import. This installation path runs when dependencies are missing or --upgrade is requested, and the skill's read-only OBS guard does not constrain malicious dependency code.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
guard_write_intent(" ".join(extra))
cmd.extend(extra)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
guard_write_intent(" ".join(extra))
cmd.extend(extra)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The skill requires a fixed header row using Chinese labels, regardless of the user's preferred language. It provides neither a language-selection option nor a documented locale-specific justification for this output constraint.
The acceptance criterion mandates fixed Chinese headers for generated spreadsheets. It provides neither user opt-in nor a documented justification for requiring Chinese output regardless of the user's language.
The manifest states that --page-size caps the returned bucket count. Although the fallback accepts page_size at L366, it never uses that value: it makes an unparameterized list_buckets request and returns every normalized bucket, allowing reports and stdout output to contain more records than requested.
The manifest promises that --endpoint overrides the region-derived OBS endpoint. When hcloud is unavailable, the fallback passes only the region and limit to the SDK function, which selects its endpoint through ObsRegion (L397–L408), so requests do not honor the caller's explicit endpoint selection.
No suspicious patterns detected.