Security audit
Security checks for vulnerabilities and agentic risk
The cloud queries are read-only, but insecure dependency installation and incompletely documented telemetry need review before use.
Avoid the bundled SDK installer until certificate verification is preserved; install dependencies separately from a verified source in an isolated environment. Set SKILL_QUALITY_REPORT=0 and skip the quality-CLI installers unless you have reviewed the wrapper and its telemetry policy. Use read-only VPC credentials and protect the exported inventory. All bundled files were inspected, but the remotely downloaded wrapper and its reporting behavior remain unverified.
scripts/ensure_env.pySDK installation disables TLS certificate verification for package mirrors
Arbitrary Python code execution, with access to files and credentials available to that account. This is an exploitable installation defect, not evidence that the configured mirrors or packages are malicious.
The supplied chunk is a software bootstrapper, not a VPC query or export implementation. Although the description mentions tests for a skill-quality-cli wrapper, it does not disclose automatically retrieving and installing that tool. This adds material network access and persistent executable installation beyond the described workflow. SHA256 verification and extraction checks mitigate installation risks but do not eliminate the description-behavior mismatch. No cloud mutation or credential exfiltration is evident in this chunk.
The supplied chunk has a materially different purpose: installing skill-quality-cli. The description mentions tests for a quality-CLI wrapper, but does not disclose downloading and installing executable software. These persistent installation side effects go beyond incidental implementation details of local report generation. The script includes checksum and extraction safeguards, and it does not itself run the installed CLI or mutate cloud resources; those facts do not eliminate the description mismatch. This assessment is limited to the supplied installer, not unseen VPC-export code.
The initial fetch retrieves JSON rather than directly executing a script, but that JSON controls both the subsequently downloaded executable archive and its expected checksum. A compromised manifest service can therefore authorize arbitrary executable content, and the installer does not independently authenticate releases or restrict the selected download URL to approved HTTPS origins.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
The guide makes an unrelated telemetry wrapper part of the normal command path and promotes automatic installation without a separate opt-in. This expands the trust boundary around credentialed cloud commands and their output, while the supplied material does not establish what telemetry is collected; disclosure and an opt-out reduce, but do not eliminate, that risk.
The readiness helper installs persistent executable code chosen by a live remote manifest, although this tool is unnecessary for VPC export. The checksum comes from that same manifest, so compromise of the manifest service can supply both a malicious executable and a matching checksum; archive traversal checks do not prevent this supply-chain attack.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
guard_write_intent(" ".join(extra))
cmd = build_hcloud_command(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
guard_write_intent(" ".join(extra))
cmd = build_hcloud_command(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
L26–L48 fetch a release manifest and executable package for skill-quality-cli, and L78–L88 install or overwrite executable files and supporting modules under ~/.local/bin. This capability is not required to query VPCs or generate local reports; the manifest's mention of wrapper tests does not explicitly declare software installation. Although manually invoked and checksum-verified, the installer still introduces a persistent software-installation capability outside the stated purpose.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
The report format requires fixed Chinese-language headers, including “VPC 名称”, “区域”, and “描述”, regardless of the user's language. No language opt-in or locale-specific justification is provided; the output-mode options change the format, not the language.
The acceptance criterion mandates specific Chinese labels for the exported Markdown table. It provides neither a user language opt-in nor a documented justification for requiring that output language.