CloudQ

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:29 AM UTC
• Version: 1.0.0

Overview

This skill is a real Tencent Cloud Advisor helper, but it asks for high-impact cloud credentials and contains under-scoped credential, IAM, TLS, and dependency behaviors that users should review before installing.

Install only if you are comfortable giving the skill Tencent Cloud credentials and allowing it to create or use a console-login CAM role. Prefer a tightly scoped subaccount or temporary credentials, avoid writing long-lived AK/SK values into shell startup files, review generated passwordless links as sensitive credentials, and consider fixing the TLS and unpinned dependency behavior before use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:44

Finding

TLS Certificate Verification Is Disabled for Credential-Bearing Requests

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tcloud_api.py:92

Finding

Generic API Client Can Transmit Credential Material to an Arbitrary Host

Content

View full analysis

dict: secret_id = secret_id or os.environ.get("TENCENTCLOUD_SECRET_ID", "") secret_key = secret_key or os.environ.get("TENCENTCLOUD_SECRET_KEY", "") token = token or os.environ.get("TENCENTCLOUD_TOKEN", "") ``` ```python authorization = ( f"{algorithm} " f"Credential={secret_id}/{credential_scope}, " f"SignedHeaders=content-type;host;x-tc-action, " f"Signature={signature}" ) headers = { "Authorization": authorization, "Content-Type": "application/json; charset=utf-8", "Host": host, "X-TC-Action": action, "X-TC-Timestamp": str(timestamp), "X-TC-Version": version, "X-TC-Region": region, } if token: headers["X-TC-Token"] = token req = Request( f"https://{host}", data=payload_str.encode("utf-8"), headers=headers, method="POST", ) ``` The command-line interface passes unvalidated arguments into this function: ```python service = args[0] host = args[1] action = args[2] version = args[3] result = call_api(service, host, action, version, payload, region) ``` ### Technical Analysis The `host`, `service`, `action`, and version values are caller-controlled. No exact domain allowlist or service-to-host mapping is enforced before constructing and sending the request. Consequently, the client can send an authorization header containing the Tencent Cloud SecretId and a temporary `X-TC-Token` to an attacker-selected HTTPS endpoint. The HMAC signature does not protect confidentiality and does no ...[truncated 1300 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: check_env.py:158

Finding

Automatic Execution of Unpinned Remote Dependencies

Content

View full analysis

str | None: import subprocess result = subprocess.run( ["npx", "--yes", "clawhub@latest", "inspect", slug, "--json"], capture_output=True, text=True, timeout=60, ) if result.returncode != 0: return None return _extract_version(json.loads(result.stdout)) ``` ```python try: from playwright.sync_api import sync_playwright except ImportError: print("Playwright is not installed; attempting installation.") subprocess.run( [sys.executable, "-m", "pip", "install", "playwright"], check=True, capture_output=True, ) subprocess.run( [sys.executable, "-m", "playwright", "install", "chromium"], check=True, capture_output=True, ) from playwright.sync_api import sync_playwright ``` ```python try: from selenium import webdriver from selenium.webdriver.chrome.options import Options except ImportError: print("Selenium is not installed; attempting installation.") subprocess.run( [sys.executable, "-m", "pip", "install", "selenium"], check=True, capture_output=True, ) ``` ### Technical Analysis The required environment check has a fallback that downloads and runs `clawhub@latest` using `npx --yes`. The report conversion script similarly installs the latest available `playwright` or `selenium` package and downloads a Chromium binary. No exact package versions, hashes, lockfiles, trusted artifact manifests, or user confirmation are enforced. The effective executable payload can therefore change after the Skill itself has been reviewed. Although these are legitima ...[truncated 1298 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create_role.py:36

Finding

IAM Role Creation Grants Permissions Beyond the Read-Only Advisor Workflow

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/login_url.py:260

Finding

Passwordless Console Credentials Are Emitted into Agent and Chat Output

Content

View full analysis

str: login_timestamp = int(time.time()) login_nonce = random.randint(10000, 100000000) source_string = ( f"GETcloud.tencent.com/login/roleAccessCallback?" f"action=roleLogin" f"&nonce={login_nonce}" f"&secretId={tmp_secret_id}" f"×tamp={login_timestamp}" ) login_signature = base64.b64encode( hmac.new( tmp_secret_key.encode("utf-8"), source_string.encode("utf-8"), hashlib.sha256, ).digest() ).decode("utf-8") login_url = ( f"https://cloud.tencent.com/login/roleAccessCallback?" f"algorithm=sha256" f"&secretId={quote(tmp_secret_id, safe='')}" f"&token={quote(token, safe='')}" f"&nonce={login_nonce}" f"×tamp={login_timestamp}" f"&signature={quote(login_signature, safe='')}" f"&s_url={quote(target_url, safe='')}" ) return login_url ``` ```python print(output_success( login_url, target_url, duration, sts_result["RequestId"], )) ``` ### Technical Analysis The URL contains a temporary SecretId, STS token, timestamp, nonce, and authentication signature. It is then serialized into JSON and printed to stdout. The Skill instructions require placing this URL in a chat hyperlink. Using friendly anchor text does not protect the target URL: it remains present in the Agent's output, message payload, logs, chat history, telemetry, and potentially link-preview or security-scanning systems. Base64 itsel ...[truncated 1139 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: check_env.py:394

Finding

Mandatory Read-Only Environment Check Performs Persistent Writes and Role Assumption

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (65)

Tainted flow: 'req' from os.environ.get (line 228, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The script creates an SSL context that disables certificate verification and hostname checking when the certifi package is unavailable, then uses that context for the STS AssumeRole request. Because this request carries cloud authentication material and returns temporary credentials, a man-in-the-middle attacker could intercept or tamper with the response, potentially obtaining privileged temporary access or redirecting login generation.

Content

Scanner excerpt · scripts/login_url.py (reported line 236)May include surrounding context.

python

)

    ctx = _get_ssl_context()
    with urlopen(req, context=ctx) as resp:
        result = json.loads(resp.read().decode("utf-8"))

    response_body = result.get("Response", {})

Tainted flow: 'req' from os.environ.get (line 186, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tcloud_api.py (reported line 195)May include surrounding context.

python

try:
        ctx = _get_ssl_context()
        with urlopen(req, context=ctx, timeout=30) as resp:
            response_body = resp.read().decode("utf-8")
    except HTTPError as e:
        try:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Enumerating roles, creating a new CAM role, attaching policies, writing local configuration, and testing role assumption are privileged account-management tasks absent from the high-level description. This increases the risk of confused-deputy behavior where a user thinks they are invoking a read-only advisor assistant but actually authorize administrative reconfiguration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Enumerating roles, creating a new CAM role, attaching policies, writing local configuration, and testing role assumption are privileged account-management tasks absent from the high-level description. This increases the risk of confused-deputy behavior where a user thinks they are invoking a read-only advisor assistant but actually authorize administrative reconfiguration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Enumerating roles, creating a new CAM role, attaching policies, writing local configuration, and testing role assumption are privileged account-management tasks absent from the high-level description. This increases the risk of confused-deputy behavior where a user thinks they are invoking a read-only advisor assistant but actually authorize administrative reconfiguration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Enumerating roles, creating a new CAM role, attaching policies, writing local configuration, and testing role assumption are privileged account-management tasks absent from the high-level description. This increases the risk of confused-deputy behavior where a user thinks they are invoking a read-only advisor assistant but actually authorize administrative reconfiguration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Enumerating roles, creating a new CAM role, attaching policies, writing local configuration, and testing role assumption are privileged account-management tasks absent from the high-level description. This increases the risk of confused-deputy behavior where a user thinks they are invoking a read-only advisor assistant but actually authorize administrative reconfiguration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Enumerating roles, creating a new CAM role, attaching policies, writing local configuration, and testing role assumption are privileged account-management tasks absent from the high-level description. This increases the risk of confused-deputy behavior where a user thinks they are invoking a read-only advisor assistant but actually authorize administrative reconfiguration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Enumerating roles, creating a new CAM role, attaching policies, writing local configuration, and testing role assumption are privileged account-management tasks absent from the high-level description. This increases the risk of confused-deputy behavior where a user thinks they are invoking a read-only advisor assistant but actually authorize administrative reconfiguration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Enumerating roles, creating a new CAM role, attaching policies, writing local configuration, and testing role assumption are privileged account-management tasks absent from the high-level description. This increases the risk of confused-deputy behavior where a user thinks they are invoking a read-only advisor assistant but actually authorize administrative reconfiguration.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to permanently store long-lived Tencent Cloud SecretId/SecretKey values in shell startup files or user-level environment variables. Persisting cloud credentials in broadly readable or routinely sourced locations significantly increases the chance of credential theft, accidental disclosure, session inheritance, backup leakage, and long-term account compromise.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 93% confidence

Finding

The YARA match is not evidence of malware in the classic sense, but it correctly flags persistence-like behavior: appending secrets and role settings into shell initialization files to survive across sessions. In this context, the persistence is user-directed rather than covert, yet it still creates a high-severity credential persistence risk because long-lived cloud secrets are being written to durable locations on disk.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

��变量配置密钥：

1.1 必填环境变量

• TENCENTCLOUD_SECRET_ID — 腾讯云 SecretId（必填）
• TENCENTCLOUD_SECRET_KEY — 腾讯云 SecretKey（必填）

密钥获取地址：https://console.cloud.tencent.com/cam/capi

环境变量必须永久写入 shell 配置文件，确保新会话中仍然生效：

Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）：

bash

echo 'export TENCENTCLOUD_SECRET_ID="your-secret-id"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="your-secret-key"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell（写入用户级环境变量）：

powershell

[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")
[Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")

1.2 角色配置（免密登录需要）

为生成控制台免密登录链接，需要配置 CAM 角色。角色配置分为 检测 和 创建 两个独立步骤，角色创

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · check_env.py (reported line 303)May include surrounding context.

python

nd("TENCENTCLOUD_SECRET_ID")
        if not secret_key:
            missing.append("TENCENTCLOUD_SECRET_KEY")
        log_fail(f"未配置以下环境变量: {', '.join(missing)}")
        log_info("")
        log_info("  请将腾讯云 API 密钥永久写入 shell 配置文件：")
        log_info("")
        log_info("  Linux / macOS（写入 ~/.bashrc 或 ~/.zshrc）:")
        log_info('    echo \'export TENCENTCLOUD_SECRET_ID="your-secret-id"\' >> ~/.bashrc')
        log_info('    echo \'export TENCENTCLOUD_SECRET_KEY="your-secret-key"\' >> ~/.bashrc')
        log_info("    source ~/.bashrc")
        log_info("")
        log_info("  Windows PowerShell（写入用户级环境变量）:")
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_ID", "your-secret-id", "User")')
        log_info('    [Environment]::SetEnvironmentVariable("TENCENTCLOUD_SECRET_KEY", "your-secret-key", "User")')
        log_info("")
        log_info("  密钥获取地址: https:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script performs destructive actions well beyond the stated ChatOps/advisor/query scope of the skill: it recursively deletes local configuration and cache data and can also remove a remote CAM role. In an agent-skill context, hidden or mismatched destructive capabilities increase the risk of misuse, accidental invocation, or privilege abuse because users would not reasonably expect cleanup and cloud-deletion behavior from the manifest description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function clean_cloud_role can delete a Tencent CAM role named advisor using available AK/SK credentials, which is an administrative cloud operation not justified by the skill's informational/advisor purpose. If triggered in the wrong environment, it can remove access-control infrastructure and disrupt dependent workflows or security integrations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script performs privileged CAM write operations by creating a role, enabling console login, and attaching broad policies, which goes beyond the skill's described advisory/query functionality. In a chat-integrated skill, this is dangerous because it can modify a user's cloud IAM posture and grant high privileges if invoked, especially when the manifest frames the skill as informational rather than administrative.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/setup_role.py (reported line 44)May include surrounding context.

python

if platform.system() == "Windows":
        # Windows 10+ 的 cmd/PowerShell 支持 ANSI（需 VT100）
        try:
            os.system("")  # 激活 VT100 模式
            return True
        except Exception:
            return False

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This setup flow can create a new CAM role and attach broad policies, changing the user's cloud IAM posture rather than merely providing read-only advisory/chat functionality. In the skill context, this is more dangerous because the manifest describes informational/advisor operations, so hidden or under-justified privilege and identity changes violate least privilege and can expand the attack surface of the Tencent Cloud account.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

If certifi is unavailable, the fallback disables both certificate validation and hostname verification, which allows man-in-the-middle interception of supposedly HTTPS-protected traffic. Because this script sends signed cloud API requests and may include temporary tokens, an attacker on the network path could tamper with requests or capture sensitive cloud-management traffic.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code silently proceeds with CERT_NONE and check_hostname=False when certifi is missing, giving users no indication that transport security has been disabled. In the context of a CloudOps skill that performs authenticated cloud API operations, this materially increases the danger because operators may unknowingly run privileged requests over an unauthenticated TLS channel.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is overly broad and includes vague language like 'related operations', which can cause the skill to activate in contexts beyond the user's intent. Because this skill includes credentialed cloud access and privileged setup actions, broad triggering materially increases the risk of unintended execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

L011 明确写明在身份相关问题下“必须”使用指定内容回答，而指定模板以英文“Hi，我是”及固定格式输出。该文件整体以中文为主，却未给出语言可选项或要求基于用户语言偏好响应，构成语言/locale 强制策略问题。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The role-creation documentation is internally inconsistent: one section says only QcloudAdvisorFullAccess is attached, while another adds QcloudTAGFullAccess and describes broader permissions. Documentation contradictions around IAM policy grants are dangerous because users cannot accurately assess the scope of access they are approving.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The plugin trigger terms are broad operational phrases without strong context constraints, which can pull in a plugin that fetches data and generates reports unexpectedly. In a skill with file generation and external tooling, permissive triggers expand the chance of accidental sensitive-data handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.