Security audit
Security checks for vulnerabilities and agentic risk
Review is needed because this subnet inventory skill requires additional telemetry software without explaining what data it collects or where it sends it.
Before installing, request an optional telemetry workflow, a reviewed pinned package, and clear disclosure of collected data and its destination. SKILL_QUALITY_REPORT=0 is documented, but its behavior cannot be verified without the downloaded implementation and it does not remove the wrapper requirement. Use narrowly scoped subnet-list credentials. All bundled files were inspected; the remaining material uncertainty is the external telemetry software, not evidence of proven credential theft.
The referenced installer persistently writes executable files under the user's local binary directory rather than merely listing subnets. This duplicates the preceding scope-expansion concern: the cloud API being read-only does not make downloaded local code read-only or prevent it from accessing credentials.
The subnet-listing workflow introduces installation and execution of an additional telemetry tool, expanding trust beyond the cloud CLI and SDK. Although the document body mentions this dependency, mandatory installation is outside the metadata's inventory-only scope and introduces executable code into an environment containing cloud credentials.
The document directs installation and maintenance of an unrelated telemetry tool as part of a subnet inventory skill. The mismatch is real, but the finding overstates concealment and automation: the body discloses the tool and describes upgrades as manual, not automatic.
The matched request fetches JSON rather than directly executing a script, but the subsequent flow installs an executable selected by that mutable manifest. Because the package URL and expected checksum come from the same live authority, compromise of that authority can substitute both; there is no independent signature or pinned release identity shown.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
Quality-assurance language escalates an ancillary telemetry dependency into a mandatory intermediary for authenticated commands. This creates an unnecessary trust boundary crossing, although the wording alone does not prove malicious intent or that the Python script implements the wrapper.
The mandatory wrapper instruction redirects an agent from a read-only cloud query into acquiring and running additional software. A wrapper around authenticated commands runs in the same security context and can potentially access command output and inherited credentials, regardless of the ListSubnets write guard.
The document requires command telemetry without specifying its payload, destination, retention, or redaction guarantees. Authenticated subnet queries expose infrastructure identifiers and network topology, so inadequate disclosure prevents informed authorization; the supplied material does not establish that such data is actually transmitted.
The guide makes an additional telemetry executable a prerequisite and forbids proceeding with the cloud CLI when that tool cannot be installed. This pressures an agent into installing unrelated software with access to the authenticated process environment; the reporting-disable variable does not remove that execution dependency.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
The readiness check downloads a remotely selected telemetry package and persistently installs executable components without a separate approval step. HTTPS, checksum verification, and archive checks reduce some risks, but they do not justify this additional executable trust relationship for a subnet-listing task.
This installer acquires and persistently installs telemetry software unrelated to the subnet-query implementation. Manual invocation reduces the risk compared with automatic installation, but the surrounding mandatory dependency workflow can still induce installation without task-specific authorization for this scope expansion.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)