测试测试测试

• Outcome: Review
• Latest audit: Jun 3, 2026 · 6:08 AM UTC
• Version: 1.0.3

Overview

This Tencent Cloud storage skill looks purpose-aligned rather than malicious, but it needs review because it can delete cloud objects, change bucket settings, call arbitrary Tencent CI APIs, and persist credentials locally.

Install only if you are comfortable giving this skill Tencent Cloud credentials with the exact COS/CI permissions it needs. Use a least-privilege sub-account or temporary STS credentials, avoid root or full-account keys, prefer non-persistent environment variables, and treat delete, batch delete, ACL/CORS changes, decrypt-env, and ci-request as sensitive operations that should be run only after explicit user review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest security metadata says credential storage is ephemeral and does not persist to disk, but the instructions explicitly support writing secrets to `.env` and decrypting them back to plaintext. This inconsistency can mislead users and reviewers about actual secret exposure, increasing the chance that long-lived cloud credentials are stored insecurely on the local filesystem.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation claims credentials 'never' persist to disk and are not echoed, yet later sections describe persisting them to `.env` and restoring plaintext with `decrypt-env`. Contradictory security assurances are dangerous because they can cause users to provide sensitive Tencent Cloud keys under false assumptions about storage and exposure.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The generic `ci-request` action permits arbitrary CI API invocation beyond the enumerated actions, effectively turning the skill into a broad cloud API proxy. That expands attack surface and weakens policy review because future or undocumented API paths could be used for actions not anticipated by users or the platform.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documented `ci-request` entrypoint is a generic passthrough that allows callers to supply arbitrary CI API paths and parameters, effectively bypassing the skill’s enumerated action boundaries. In an agent setting, this expands the reachable cloud capability surface to any CI API the credentials permit, including sensitive moderation, file-processing, or job APIs not explicitly reviewed in the skill contract.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Allowing user-controlled `method`, `path`, `body`, and `query` for direct CI requests creates a powerful arbitrary API invocation primitive. This can be abused to access unintended Tencent CI features, submit privileged jobs, exfiltrate metadata, or trigger costly/unsafe remote operations using the skill’s authenticated cloud context.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill includes explicit local credential-management features that decrypt secrets and restore them into a plaintext .env file on disk. In an agent-skill context, this extends beyond normal COS/CI API operations into local secret material handling, increasing the risk of credential exposure through filesystem access, backup tools, logs, or later compromise of the host.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The generic ci-request action permits callers to construct arbitrary CI API requests, effectively bypassing the declared action allowlist and enabling undeclared capabilities. In a skill environment this creates a broad unintended attack surface, because future or undocumented API operations can be invoked with the skill's full cloud credentials.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The code comment claims deletion and bucket-emptying are forbidden, but the actual guard only blocks deleteBucket while still allowing single and batch object deletion. This mismatch can mislead reviewers and users into trusting safety guarantees that are not enforced, enabling effective bucket emptying through repeated object deletion.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are very broad, including generic intents like 'put files in the cloud', 'generate download link', or 'protect COS keys', which can cause the skill to activate in unrelated conversations. In a skill that handles credentials, executes shell setup, and can modify local files, accidental invocation materially increases risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents destructive and high-impact operations such as deleting objects, bulk deletion, and arbitrary CI API calls, but does not require explicit user confirmation or present clear risk warnings at the point of use. This makes accidental data loss or misuse more likely, especially when combined with broad activation rules and shell execution capability.

Missing User Warnings

Medium

• Confidence: 71% confidence
• Finding: These features can cause user-supplied image URLs, text, or request bodies to be transmitted to Tencent cloud services, yet the documentation provides no privacy or data-handling warning. In an agent context, users may unknowingly send sensitive content to third-party remote processing endpoints, increasing privacy, compliance, and data-leakage risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The delete action performs immediate destructive deletion of an object without any confirmation, warning, dry-run mode, or secondary acknowledgment. In an agentic setting, ambiguous prompts or prompt injection could trigger irreversible data loss using the configured COS credentials.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Batch deletion accepts an arbitrary JSON list of keys and deletes them immediately without interactive warning or confirmation. Because this can remove many objects in one call, the data-loss blast radius is significantly larger than a single-object delete and can be abused to effectively wipe bucket contents.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The decrypt-env action restores encrypted credentials into a plaintext .env file without a pre-action warning or additional authorization step. This converts protected secrets into persistent cleartext on disk, where they may be exposed to other local processes, backups, editors, or accidental check-in.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.