Security audit
Security checks for vulnerabilities and agentic risk
This VPC inventory skill needs review because its instructions require an automatically installed telemetry wrapper without explaining what data it reports or where.
Before installing, seek an optional telemetry workflow, disclosure of reported fields and destinations, and a reviewed, pinned wrapper release. The documented SKILL_QUALITY_REPORT=0 setting does not remove the wrapper requirement. Use narrowly scoped read-only cloud credentials and leave executable-testing overrides unset.
Automatic installation of unrelated executable software introduces supply-chain and local execution risks beyond the requested read-only VPC operation. This overlaps the preceding finding, and although installation is documented, the specific claims about overwriting files under ~/.local/bin cannot be verified without the installer source.
The document explicitly introduces automatic installation of an unrelated telemetry CLI and requires it to wrap cloud commands, expanding an inventory request into third-party software execution. Compromise of that dependency could expose credentials accessible to the process or alter command behavior; the supplied file does not independently verify the reported manifest endpoint or installation paths.
The underlying concern is valid because automatic telemetry collection and a mandatory third-party command wrapper add a trust boundary unrelated to VPC listing, potentially exposing inventory or credential-profile information. However, the finding overstates the mismatch: the dependency is disclosed in the document, and upgrades are described as manual rather than automatic; actual telemetry contents and destinations remain unverified.
When invoked without an existing usable installation, this script downloads a mutable latest release and persistently installs executable code unrelated to the stated read-only VPC-listing task, without an explicit consent step. HTTPS, mandatory SHA256 verification, and archive checks reduce risk, but the download URL and checksum share the same manifest trust source; compromise of that source could install attacker-controlled code for execution with the user's permissions. The supplied script does not establish malicious intent or automatically execute the newly downloaded binary.
The manifest request downloads JSON rather than executing a script, but the subsequent workflow installs executable content selected by that mutable remote manifest. Its SHA-256 check detects corruption but cannot protect against a compromised manifest publisher supplying both a malicious package and its matching hash; no independently trusted signature or pinned digest is checked. Manual invocation and HTTPS reduce exposure, but later execution of a substituted CLI could compromise the user's account and accessible cloud credentials.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill makes an unrelated telemetry CLI mandatory and provides automatic installation despite the user's task requiring only cloud inventory access. Running this wrapper around authenticated cloud commands gives additional software access to command execution and potentially sensitive results; an opt-out reporting variable does not eliminate that execution boundary.
The guide makes an unrelated telemetry executable and its automatic installation mandatory for a read-only VPC listing task, introducing an unnecessary code-execution and supply-chain trust boundary. A compromised installer or wrapper could access credentials available to its process, inspect VPC output, or alter the invoked command; the skill's read-only intent guard would not constrain that executable. The telemetry-disable option does not remove this execution dependency, although the provided content does not establish actual data exfiltration or malicious intent.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
L26–L48 fetch a quality-CLI release manifest and download its package; L78–L88 persist executable files and supporting modules under ~/.local/bin. Installing skill-quality-cli is unrelated to listing VPCs and is neither the declared KooCLI dependency nor the official SDK fallback. Manual invocation and checksum verification do not justify this additional capability under the stated purpose.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
VPC_LIST_HCLOUD_BIN selects an unrestricted executable, while VPC_LIST_HCLOUD_ARGS supplies arguments that bypass the write-intent guard. If an attacker can influence these environment settings without otherwise controlling execution, they can substitute a program or interpreter that runs with the skill's privileges and inherited cloud credentials, defeating the read-only restriction. These documented testing hooks are not evidence of malicious intent, and exploitability depends on an environment-configuration trust boundary.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The empty-list and permission-error criteria prescribe exact Chinese messages, making Chinese output a requirement for these cases. The file provides no user opt-in, language-selection mechanism, or region-specific justification for this constraint.
No suspicious patterns detected.