Security audit
Security checks for vulnerabilities and agentic risk
This inventory exporter needs review because its instructions require additional telemetry software around cloud commands and its dependency installer weakens download security.
Before installing, require telemetry to be optional and review its exact implementation, collected fields, and destinations. Disabling reports alone does not verify the wrapper's behavior. Install SDK dependencies with certificate verification enabled, use read-only cloud credentials, and keep command overrides unset unless trusted. The bundled installers and exporter were reviewed; remotely downloaded telemetry code remains outside the inspected package, so its data handling is unresolved.
scripts/ensure_env.pyDependency installation disables TLS certificate verification for package mirrors
A network attacker can execute arbitrary code under the user's account by substituting a package during dependency preparation.
Persistent executable installation under ~/.local/bin exceeds the prominent description of read-only cloud access and local Markdown generation. The dependency is mentioned later, so it is not wholly concealed, but requiring unrelated downloaded code exposes subsequent credential-bearing commands to an additional supplier and update channel.
The advertised inventory-and-local-export scope expands into installing executable telemetry tooling and requiring it around cloud commands. Although the body documents this dependency, the automatic installation creates an additional software trust boundary in a credential-bearing environment; the supplied installer code supports this concern, but does not establish malicious behavior.
The declared workflow uses hcloud or huaweicloudsdksfsturbo to query SFS and generate a local Markdown file. The supplied commands instead manage skill-quality-cli, which has no stated role in that workflow. This is an undeclared tool-installation and upgrade capability, not an evident supporting implementation detail. The snippet provides no evidence of cloud writes or other behavior inside the referenced scripts.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
The instructions turn a quality-reporting dependency into a mandatory intermediary for authenticated cloud commands, including credential inspection. Disabling reports does not necessarily remove the wrapper's execution or access to sensitive process context, and no wrapper implementation is supplied to verify its behavior.
The mandatory wrapper places unrelated telemetry software in the execution path of both inventory queries and credential-profile inspection. That software can potentially access inherited credentials and child-process output; its implementation is absent, so actual collection or exfiltration cannot be established.
This guide requires every hcloud invocation to pass through an unrelated telemetry executable rather than limiting it to optional reporting. The wrapper consequently occupies a sensitive trust position with potential access to inherited cloud credentials and inventory output, although the guide does not prove that it transmits either.
When invoked without a working existing CLI, this helper downloads a manifest-selected package and installs executable files persistently without a separate confirmation. SHA256 verification and archive path checks reduce some risks, but the manifest controls both the artifact and its checksum, so compromise of that release channel could introduce code later used around authenticated cloud commands.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
This manually invoked installer adds unrelated executable software that the surrounding skill requires for cloud commands, broadening the trust boundary beyond inventory export. Manual invocation reduces surprise, but the unpinned latest manifest selects both the executable archive and its checksum, leaving release-channel compromise capable of supplying code for later credential-bearing execution.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
The write-intent guard checks the script's command-line arguments and operation value, but not the environment overrides used to construct the actual process invocation. Consequently, the claimed ListShares-only boundary does not constrain the executed program, potentially permitting local code execution or cloud mutations when environment configuration is attacker-controlled; this overlaps with TT2 rather than representing an independent execution flaw.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
SFS_EXPORT_MD_HCLOUD_BIN selects an arbitrary executable, while SFS_EXPORT_MD_HCLOUD_ARGS supplies arguments before the fixed ListShares arguments. If an attacker can influence these environment variables, an interpreter or another program can execute attacker-selected code with the agent's privileges and access to cloud credentials; shell=False does not prevent this, although no untrusted environment-setting path is demonstrated here.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The skill requires Chinese metadata text, table headers, and empty-result messages in generated reports regardless of the user's language. It provides neither a language opt-in nor a documented reason that the report must use Chinese; the cloud region selection does not justify a fixed report language.