Security audit
Security checks for vulnerabilities and agentic risk
This cloud inventory skill needs review because its installer weakens download security and its fallback can ignore the account you select.
Before using cloud credentials, replace the mirror installation commands with certificate-verified package installation in an isolated environment. Disable reporting with SKILL_QUALITY_REPORT=0 unless you have reviewed the external reporter's data handling. Use read-only credentials and verify the effective account; the SDK fallback does not honor --domain-id. Scanner coverage gaps were investigated across all bundled files, but the downloaded reporter remains unreviewed. The evidence supports Review, without establishing malicious intent or exfiltration.
scripts/ensure_env.pySDK installation disables TLS certificate verification for package mirrors
An intercepted dependency installation can execute attacker-supplied Python code with access to the user's files and available cloud credentials.
The supplied chunk is an installer for skill-quality-cli, not KooCLI or the huaweicloudsdkrms fallback described in the skill. It contains no RMS queries, inventory views, export functionality, or write-intent guard. Although local writes alone do not contradict a cloud-read-only claim—the description permits exports—installing unrelated executable software is a materially different, undeclared capability. The script's manual invocation, checksum verification, and archive checks do not eliminate that mismatch. This assessment applies to the supplied chunk; it does not establish what other skill files do or what the downloaded CLI does when executed.
The primary cloud-query behavior matches the description, and the supplied code does not construct cloud-mutating operations. However, build_hcloud_command adds a separate reporting capability absent from the declaration: by default, it launches skill-quality-cli with the complete hcloud command when that executable is available. The supplied code does not establish what the external reporter stores or transmits, so data exfiltration cannot be concluded. There are also concrete interface and behavioral discrepancies: non-table output implicitly creates files, table exports are ignored, advertised format switches do not exist, explicit domain selection is dropped on SDK fallback, and type-only inventory filtering fails before execution.
The supplied chunk is a bootstrap installer for a quality CLI, not an RMS inventory implementation. Installing this separate tool is a substantive undeclared capability rather than an ordinary implementation detail of the documented KooCLI/RMS SDK workflow. SHA256 verification and archive checks reduce installation risks but do not resolve the purpose mismatch. The chunk contains no RMS queries or implementation of the declared views, filters, exports, or write-intent guard. This finding is limited to the supplied code and does not establish that other parts of the skill lack those features.
Installing a required RMS backend could be a supporting implementation detail, but the explicit skill-quality-cli upgrade and reporting configuration concern a different tool from the declared KooCLI and RMS SDK backends. These introduce unrelated maintenance and configuration behavior. The setup scripts are not supplied, so their effects cannot be determined; likewise, the telemetry opt-out does not establish that any telemetry is actually transmitted.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
curl -LO https://cli.dev.huaweicloud.com/koolci/hcloud-linux-amd64-latest.zip unzip hcloud-linux-amd64-latest.zip chmod +x hcloud && sudo mv hcloud /usr/local/bin/ hcloud --version
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
curl -LO https://cli.dev.huaweicloud.com/koolci/hcloud-linux-amd64-latest.zip unzip hcloud-linux-amd64-latest.zip chmod +x hcloud && sudo mv hcloud /usr/local/bin/ hcloud --version
L56–L58 state that every hcloud call is reported through skill-quality-cli when available, and L61–L64 provide installation and opt-out instructions. This reporting capability is not required for RMS inventory queries or exports and is not declared in the manifest; the file does not establish what information is reported or where it goes.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
The manifest describes read-only RMS queries through KooCLI or the RMS SDK, plus optional inventory exports; it does not declare installation of a separate quality CLI. This script fetches that tool's release manifest and archive (L027–L059), then installs executable files and supporting modules into ~/.local/bin (L089–L101). SHA256 verification protects download integrity but does not justify this additional software installation capability.
The subprocess call is not shell-injectable, but its pip caller passes --trusted-host for both package mirrors, disabling normal TLS certificate verification for those hosts. A network attacker able to intercept a mirror connection can substitute unpinned packages or dependencies, leading to code execution during installation or the subsequent import in an environment used for cloud authentication.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
L26–L48 fetch a release manifest and package for skill-quality-cli, and L78–L88 install executable files and supporting modules under ~/.local/bin. The manifest describes RMS inventory queries through KooCLI or the RMS SDK, not installation of skill-quality tooling; this manually invoked installer therefore adds an unrelated software-installation capability. Its checksum verification does not resolve the purpose mismatch.
When available, skill-quality-cli is automatically inserted around authenticated cloud queries despite telemetry not being disclosed in the supplied skill metadata. This gives an additional program access to CLI arguments, inherited credentials, and potentially sensitive inventory output; its implementation is not supplied, so actual external transmission cannot be confirmed.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
guard_write_intent(" ".join(extra))
cmd = build_hcloud_command(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
guard_write_intent(" ".join(extra))
cmd = build_hcloud_command(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The SDK fallback accepts domain_id but constructs GlobalCredentials using only AK/SK, silently replacing the explicitly requested account scope with the SDK-resolved scope. Although this does not bypass IAM authorization, it can query and export inventory for an unintended authorized account, creating a confidentiality and report-integrity risk in multi-account workflows.