Security audit
Security checks for vulnerabilities and agentic risk
This RDS inventory exporter needs review because it requires an unaudited telemetry wrapper and weakens security checks when installing dependencies.
Before installing, request certificate-verified dependency downloads and an optional, audited telemetry integration with documented data collection. SKILL_QUALITY_REPORT=0 is a documented reporting opt-out, but does not remove the wrapper requirement or installation. Use cloud credentials limited to RDS listing and protect the report's instance IDs and private IPs. The downloaded wrapper was unavailable for inspection, so its reporting behavior remains uncertain; exfiltration or intentional malicious behavior is not established.
scripts/ensure_env.pyDependency installation disables TLS certificate verification for package mirrors
Arbitrary code execution with the invoking process's privileges, potentially exposing locally accessible cloud credentials and modifying files. This does not require compromising either legitimate mirror.
The added dependency installs persistent executables and supporting modules rather than merely producing an inventory report. Later documentation acknowledges the dependency, but does not make the unrelated installation an explicit, separately authorized action before the agent follows the workflow.
The headline capability describes RDS retrieval and local export, but the instructions also introduce automatic installation and mandatory execution of an unrelated telemetry wrapper. Although disclosed later in the document, this expands the trust boundary to downloaded executable code running with the user's cloud-access environment.
Installing and upgrading skill-quality-cli is not a supporting implementation detail of the declared RDS inventory workflow: the description identifies hcloud and huaweicloudsdkrds as its execution tools, not skill-quality-cli. The supplied chunk therefore introduces unrelated software-management behavior. The installer scripts themselves are not supplied, so their internal actions and any network or filesystem effects cannot be verified.
The underlying RDS ListInstances command is consistent with the declared read-only query operation. However, the supplied code only invokes that query through a wrapper and does not implement the other central purpose: generating a local Markdown inventory. The wrapper's internal behavior is not supplied, so it cannot be assumed to provide export, fallback, or safety features. No cloud mutation or unrelated resource access is visible.
The matched request fetches JSON rather than directly executing a script, but that JSON controls the executable archive subsequently installed and its expected checksum. A compromised release service can replace both values, and there is no pinned release, independent signature verification, or restriction on the manifest-selected download URL.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
The mandatory-wrapper instruction redirects authorized cloud commands through a telemetry-capable component unrelated to producing the local report. That component can access command arguments, inherited credentials, and subprocess output; the provided sources do not establish what it reports, so actual exfiltration is not proven.
The Markdown output specification prescribes Chinese column headers and a Chinese empty-result message regardless of the user's language. No language opt-in or justification for this output-language constraint is provided; selecting a Huawei Cloud region does not itself justify requiring Chinese report text.
The guide requires a telemetry-capable third-party executable to mediate every hcloud call despite that executable not being necessary for inventory export. Its visibility into inherited credentials and command results expands the trust boundary, while the guide does not specify the reported data or destination.
When invoked without an existing working CLI, this helper downloads a mutable latest release and persistently installs unrelated executable software without a separate confirmation. SHA256 checking and archive-path checks are useful, but the checksum and executable location are both supplied by the same remote manifest, so compromise of that release authority can supply an attacker-controlled executable.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
L26–L48 fetch a skill-quality-cli release manifest and binary archive, and L78–L88 install executable files and supporting modules persistently under ~/.local/bin. The declared skill requires KooCLI or the RDS SDK and local Markdown generation, not installation of a separate quality tool. Although the script documents manual invocation, that does not establish a purpose-related justification for this additional capability.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)