스킬 cloudbase-agent
📦

cloudbase-agent

v2.23.8 콘텐츠 리비전 r1 높은 위험 🌐 네트워크 접근🔑 환경 변수⚙️ 외부 명령어📁 파일 시스템 접근⚡ 스크립트 포함

CloudBase AI 에이전트 백엔드 구축

에이전트 서비스에는 일관된 서버, 어댑터, 배포 및 UI 패턴이 필요합니다. 이 스킬은 TypeScript 및 Python의 CloudBase Agent SDK 프로젝트를 안내합니다.

지원: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 나쁨

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청
Review the Skillstore skill "cloudbase-agent" from https://skillstore.io/skills/tencentcloudbase-cloudbase-agent.md and its manifest at https://skillstore.io/api/skills/tencentcloudbase-cloudbase-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/tencentcloudbase-cloudbase-agent.md 서명된 manifest GET /api/skills/tencentcloudbase-cloudbase-agent/manifest 서명된 lockfile GET /api/skills/tencentcloudbase-cloudbase-agent/lockfile

테스트해 보기

"cloudbase-agent" 사용 중입니다. TypeScript LangGraph 에이전트를 만들고 CloudBase에 배포하세요.

예상 결과:

  • 필수 CloudBase 패키지를 포함한 어댑터 선택.
  • AG-UI 및 OpenAI 호환 엔드포인트를 위한 서버 설정 개요.
  • CloudBase Agent 런타임 요구 사항을 사용하는 배포 체크리스트.

"cloudbase-agent" 사용 중입니다. Python 에이전트 서버에 인증과 관측 가능성을 추가하세요.

예상 결과:

  • 검증된 사용자 컨텍스트를 위한 미들웨어 계획.
  • 모델 및 추적 제공자를 위한 환경 변수 목록.
  • CORS, 시크릿 및 엔드포인트 노출에 대한 프로덕션 검사.

"cloudbase-agent" 사용 중입니다. 웹 클라이언트를 내 에이전트 서비스에 연결하세요.

예상 결과:

이 스킬은 AG-UI 클라이언트 경로, 엔드포인트 형태, 스트리밍 동작 및 배포 고려 사항을 식별합니다.

보안 감사

높은 위험
v2 • 2026. 7. 9. 버전별 보고서 열기

Most static hits are documentation examples or markdown syntax, including placeholder secrets, local URLs, dotenv usage, and inline code. Confirmed risks remain in authentication examples, unverified JWT decoding, public interface binds, shell-based deployment steps, and wildcard CORS guidance.

22
스캔된 파일
5,743
분석된 줄 수
18
검토 항목
0
오탐 무시됨

확인된 보안 우려 사항 (10)

높음
py/adapter-coze.md:221
System reconnaissance
logger.warning("Missing or invalid Authorization header")
The middleware logs a missing or invalid Authorization header and then continues as an anonymous user. That behavior can bypass authentication for protected agent actions.
높음
py/authentication.md:79
System reconnaissance
# Handle invalid token (log but don't block in this example)
The basic JWT example explicitly handles an invalid token by logging rather than blocking. The request then continues to the agent, which is an authentication bypass if reused.
높음
py/authentication.md:80
System reconnaissance
print(f"Invalid JWT token: {e}")
The invalid token branch only prints the error in the basic middleware example. Because execution continues afterward, this is a real unsafe pattern.
높음
py/authentication.md:82
System reconnaissance
# raise InvalidRequestError(message="Invalid authentication token")
The blocking exception is commented out in the basic authentication example. That makes the shown code continue after invalid authentication.
높음
ts/adapter-langchain.md:58
Base64 decode
const payload = JSON.parse(atob(token.split(".")[1]));
The code decodes a JWT payload with atob and uses the sub claim for tenant isolation without signature verification. This can let a caller spoof user identity.
높음
ts/adapter-langgraph.md:64
Base64 decode
const payload = JSON.parse(atob(token.split(".")[1]));
The code decodes a JWT payload with atob and uses the sub claim for tenant isolation without signature verification. This can let a caller spoof user identity.
높음
py/adapter-coze.md:213-228
Authentication Fallback Allows Anonymous Requests
The Coze middleware uses a dev-secret fallback and continues requests as user anonymous when the Authorization header is missing or invalid. This can turn a protected agent endpoint into an unauthenticated endpoint if copied into production.
The cited example directly sets a predictable JWT secret fallback and yields after assigning an anonymous user on missing authentication.
높음
py/authentication.md:78-84
Invalid JWT Example Continues Execution
The basic authentication middleware logs InvalidTokenError and then yields to the agent instead of blocking the request. Later secure guidance exists, but this initial example is unsafe if reused.
The code catches InvalidTokenError, prints the error, leaves the blocking exception commented out, and reaches the yield statement.
확인된 10건 모두 보기
높음
ts/adapter-langchain.md:56-64ts/adapter-langgraph.md:62-69
Unverified JWT Payload Used for Tenant Isolation
TypeScript adapter examples parse the JWT body with atob and use payload.sub for CloudBaseSaver userId. The signature is not verified before using that value for tenant isolation.
Both examples decode the JWT payload client-side and trust sub for storage isolation without a verification step.
중간
py/skill.md:106-111py/adapter-coze.md:272-282py/agent-deployment.md:340-356ts/server-quickstart.md:78-83
Wildcard CORS in Agent Server Examples
TypeScript and Python examples enable broad CORS on agent endpoints, including FastAPI credentialed CORS. Public agent APIs should use explicit origin allowlists in production.
The cited snippets enable wildcard or broadly enabled CORS for agent servers, and one FastAPI example also enables credentials.
기능 검토 항목 (18)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음
py/adapter-coze.md:213
Python getenv function
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
The example falls back to JWT_SECRET_KEY="dev-secret", which can create forgeable JWTs if copied into production. This is a real authentication weakness, not just configuration access.
높음
py/adapter-coze.md:213
getenv function call
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
The getenv call supplies a hardcoded dev-secret fallback for JWT signing. A missing environment variable would silently weaken authentication.
높음
py/adapter-coze.md:213
Generic API/secret keys
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
JWT_SECRET falls back to a predictable value named dev-secret. This creates a credible credential weakness when reused beyond local development.
중간
py/adapter-coze.md:282
Hardcoded IP address
host="0.0.0.0"
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
중간
py/agent-deployment.md:92
Shell command substitution
PROJECT_DIR="$(pwd)"
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
중간
py/agent-deployment.md:104
Shell command substitution
echo "✅ Using: $PYTHON_BIN ($($PYTHON_BIN --version 2>&1))"
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
중간
py/agent-deployment.md:89
Unix shell invocation
#!/bin/bash
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
중간
py/agent-deployment.md:322
Unix shell invocation
#!/bin/bash
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
중간
py/agent-deployment.md:377
Unix shell invocation
#!/bin/bash
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
중간
py/agent-deployment.md:314
Hardcoded IP address
AgentServiceApp().run(create_agent, port=port, host="0.0.0.0")
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
중간
py/references/recipes.md:32
Hardcoded IP address
server.run(host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
중간
py/references/server.md:36
Hardcoded IP address
uvicorn.run(fastapi_app, host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
중간
py/server-quickstart.md:277
Hardcoded IP address
uvicorn.run(app, host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
중간
py/server-quickstart.md:447
Hardcoded IP address
--bind 0.0.0.0:9000
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
중간
py/skill.md:111
Hardcoded IP address
app.run(create_agent, port=port, host="0.0.0.0")
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
중간
ts/agent-deployment.md:74
Unix shell invocation
#!/bin/sh
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
중간
ts/agent-deployment.md:84
Unix shell invocation
> **NOTE**: Use `#!/bin/sh` (not `#!/bin/bash`) for maximum compatibility. The entry point should ma
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
중간
ts/agent-deployment.md:137
Unix shell invocation
| **Startup script** | `scf_bootstrap` — `#!/bin/sh` + `node src/index.js` |
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.

위험 요인

🌐 네트워크 접근 (37)
py/adapter-coze.md:58 py/adapter-coze.md:125 py/adapter-coze.md:136 py/adapter-coze.md:282 py/adapter-langgraph.md:235 py/adapter-langgraph.md:295 py/agent-deployment.md:314 py/authentication.md:431 py/authentication.md:456 py/authentication.md:468 py/references/observability.md:312 py/references/observability.md:360 py/references/observability.md:364 py/references/observability.md:134 py/references/observability.md:233 py/references/observability.md:301 py/references/observability.md:328 py/references/recipes.md:300 py/references/recipes.md:32 py/references/server.md:36 py/references/tools.md:55 py/references/tools.md:87 py/server-quickstart.md:291 py/server-quickstart.md:304 py/server-quickstart.md:321 py/server-quickstart.md:338 py/server-quickstart.md:397 py/server-quickstart.md:430 py/server-quickstart.md:277 py/server-quickstart.md:447 py/skill.md:111 SKILL.md:14 SKILL.md:15 ts/server-quickstart.md:82 ts/server-quickstart.md:128 ts/server-quickstart.md:138 ts/ui-clients.md:16
🔑 환경 변수 (50)
py/adapter-coze.md:134 py/adapter-coze.md:135 py/adapter-coze.md:136 py/adapter-coze.md:213 py/adapter-coze.md:267 py/adapter-coze.md:268 py/adapter-coze.md:269 py/adapter-coze.md:281 py/adapter-coze.md:134 py/adapter-coze.md:135 py/adapter-coze.md:136 py/adapter-coze.md:213 py/adapter-coze.md:267 py/adapter-coze.md:268 py/adapter-coze.md:269 py/adapter-coze.md:281 py/adapter-coze.md:30 py/adapter-coze.md:43 py/adapter-coze.md:57 py/adapter-coze.md:97 py/adapter-coze.md:124 py/adapter-coze.md:135 py/adapter-coze.md:149 py/adapter-coze.md:161 py/adapter-coze.md:213 py/adapter-coze.md:268 py/adapter-coze.md:292 py/adapter-coze.md:293 py/adapter-coze.md:319 py/adapter-coze.md:320 py/adapter-coze.md:337 py/adapter-coze.md:338 py/adapter-coze.md:356 py/adapter-development.md:117 py/adapter-development.md:118 py/adapter-langgraph.md:556 py/adapter-langgraph.md:557 py/adapter-langgraph.md:558 py/adapter-langgraph.md:556 py/adapter-langgraph.md:557 py/adapter-langgraph.md:558 py/adapter-langgraph.md:550 py/adapter-langgraph.md:551 py/adapter-langgraph.md:550 py/adapter-langgraph.md:551 py/adapter-langgraph.md:545 py/adapter-langgraph.md:557 py/agent-deployment.md:313 py/agent-deployment.md:387 py/authentication.md:319
⚙️ 외부 명령어 (50)
py/agent-deployment.md:92 py/agent-deployment.md:104 py/agent-deployment.md:89 py/agent-deployment.md:322 py/agent-deployment.md:377 py/skill.md:26 py/skill.md:27 py/skill.md:28 py/skill.md:29 py/skill.md:46 py/skill.md:60 py/skill.md:61 py/skill.md:62 py/skill.md:63 py/skill.md:78-87 py/skill.md:87-91 py/skill.md:91-112 py/skill.md:112-122 py/skill.md:122-142 py/skill.md:142-146 py/skill.md:146 py/skill.md:148-161 py/skill.md:161-163 py/skill.md:163-164 py/skill.md:164-169 py/skill.md:169-179 py/skill.md:179-181 py/skill.md:181-182 py/skill.md:182-183 py/skill.md:183-184 py/skill.md:184-188 py/skill.md:188-213 py/skill.md:213-217 py/skill.md:217-227 py/skill.md:227-233 py/skill.md:233-234 py/skill.md:234 py/skill.md:235 py/skill.md:236 py/skill.md:237-242 py/skill.md:242-243 py/skill.md:243-244 py/skill.md:244 py/skill.md:245-246 SKILL.md:12 SKILL.md:14 SKILL.md:15 SKILL.md:17 ts/agent-deployment.md:74 ts/agent-deployment.md:84
📁 파일 시스템 접근 (4)
py/agent-deployment.md:46 py/agent-deployment.md:96 py/agent-deployment.md:215 py/agent-deployment.md:215
⚡ 스크립트 포함 (5)
py/references/observability.md:56-61 py/references/recipes.md:240 py/references/recipes.md:246 py/server-quickstart.md:17-22 py/server-quickstart.md:171-179

감지된 패턴

System reconnaissance×4
감사자: codex 감사 이력 보기 →
이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기
보안 평가

보고서 링크 복사

https://skillstore.io/skills/tencentcloudbase-cloudbase-agent/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/tencentcloudbase-cloudbase-agent/security.svg)](https://skillstore.io/skills/tencentcloudbase-cloudbase-agent?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/tencentcloudbase-cloudbase-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tencentcloudbase-cloudbase-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/tencentcloudbase-cloudbase-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
학술 인용 (APA · BibTeX · CFF)

APA 인용

tencentcloudbase. (2026). cloudbase-agent security audit report (audit version 2) [Author version 2.23.8]. Skillstore. https://skillstore.io/skills/tencentcloudbase-cloudbase-agent/audits/2

BibTeX 인용

@techreport{tencentcloudbase-tencentcloudbase-cloudbase-agent-2026, author = {tencentcloudbase}, title = {cloudbase-agent security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/tencentcloudbase-cloudbase-agent/audits/2}, note = {Author version 2.23.8} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "cloudbase-agent security audit report (audit version 2)" version: "2.23.8" type: report authors: - name: "tencentcloudbase" date-released: "2026-07-09" url: "https://skillstore.io/skills/tencentcloudbase-cloudbase-agent/audits/2" identifiers: - type: other value: "skillstore:tencentcloudbase-cloudbase-agent:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간
55
아키텍처
100
유지보수성
87
콘텐츠
65
커뮤니티
91
사양 준수

만들 수 있는 것

에이전트 API 출시

AG-UI 스트리밍을 지원하는 CloudBase Agent 서버를 만들고 권장 런타임으로 배포합니다.

에이전트 UI 연결

CloudBase Agent 엔드포인트에서 이벤트를 스트리밍하는 웹 또는 Mini Program 클라이언트를 구축합니다.

프로덕션 에이전트 준비

CloudBase 에이전트 백엔드를 위한 인증, 스토리지, 관측 가능성 및 배포 검사를 추가합니다.

이 프롬프트를 사용해 보세요

스타터 에이전트 만들기 
LangGraph 어댑터를 사용하여 최소한의 TypeScript CloudBase Agent 서버를 만드세요. 필요한 파일과 로컬 실행 단계를 포함하세요.
Python 서버 구축 
FastAPI와 LangGraph를 사용하여 Python CloudBase Agent 서버를 구축하세요. 환경 변수 설정을 추가하고 각 배포 단계를 설명하세요.
배포 준비 상태 검토 
내 CloudBase Agent 프로젝트의 종속성 정렬, 런타임 버전, CORS, 인증 및 배포 준비 상태를 검토하세요.
프로덕션 백엔드 설계 
영구 메모리, 인증 미들웨어, 관측 가능성 및 웹 AG-UI 클라이언트를 갖춘 멀티 에이전트 CloudBase 백엔드를 설계하세요.

모범 사례

  • 먼저 언어 경로를 선택하고 해당하는 참조 파일만 읽으세요.
  • 최신 CloudBase Agent 패키지와 문서화된 런타임 요구 사항을 사용하세요.
  • 공개 배포 전에 인증, CORS, 시크릿 및 관측 가능성을 검증하세요.

피하기

  • 하나의 프로젝트에서 Python과 TypeScript 배포 지침을 혼용하는 것.
  • 샘플 자격 증명, 와일드카드 CORS 또는 개발용 JWT 시크릿을 프로덕션에 배포하는 것.
  • 종속성 및 런타임 검사를 통과하기 전에 배포 도구를 호출하는 것.

자주 묻는 질문

이 스킬은 TypeScript와 Python을 모두 지원하나요?
예. 프로젝트 언어에 따라 별도의 TypeScript 및 Python 지침으로 안내합니다.
에이전트를 CloudBase에 배포할 수 있나요?
런타임 및 종속성 검사를 포함하여 CloudBase Agent 서비스를 위한 배포 가이드를 제공합니다.
AG-UI 스트리밍을 설명하나요?
예. 에이전트 서버를 위한 AG-UI 이벤트 스트리밍과 OpenAI 호환 엔드포인트를 다룹니다.
어떤 어댑터를 다루나요?
문서는 LangGraph, LangChain, Coze, CrewAI 및 커스텀 어댑터 패턴을 다룹니다.
백엔드 작업 전용인가요?
아니요. 웹 및 WeChat Mini Program 클라이언트 통합 가이드도 포함합니다.
프로덕션 전에 사용자가 무엇을 검토해야 하나요?
사용자는 인증, CORS, 시크릿, 공용 네트워크 노출, 스토리지 및 관측 가능성 설정을 검토해야 합니다.

개발자 세부 정보

라이선스

MIT

작성자 버전

v2.23.8

Skillstore 리비전

r1

리포지토리

https://github.com/tencentcloudbase/skills/tree/main/skills/cloudbase-agent

참조

24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec

유지보수 최신성

2026. 7. 18.

사용량

1 다운로드 · 1 조회

파일 구조

📁 py/

📁 references/

📄 observability.md

📄 recipes.md

📄 server.md

📄 storage.md

📄 tools.md

📄 adapter-coze.md

📄 adapter-development.md

📄 adapter-langgraph.md

📄 agent-deployment.md

📄 authentication.md

📄 server-quickstart.md

📄 skill.md

📁 ts/

📄 adapter-development.md

📄 adapter-langchain.md

📄 adapter-langgraph.md

📄 agent-deployment.md

📄 agui-protocol.md

📄 server-quickstart.md

📄 skill.md

📄 ui-clients.md

📄 ui-miniprogram.md

📄 SKILL.md

tencentcloudbase의 다른 스킬

전체 보기

관련 스킬

전체 보기