Versioned security assessment
Report ID: SA-24B2FE42
7/9/2026, 3:45:15 PM
cloudbase-agent security assessment v2
Skill Security Certification Report
- Skill name
- cloudbase-agent
- Version
- v2.23.8
- Maintainer
- tencentcloudbase
- Coverage
- 22 Files scanned · 5,743 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
10 confirmed security findings require attention.
Installation context
Check the current Skill page
This page summarizes report evidence only. The Skill page provides the canonical install advisory.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Report position
Latest published report
Latest refers to the report sequence, not to artifact currentness.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
22 Files scanned · 5,743 Lines analyzed
28 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Commit and path bound
Artifact
Content and tree hashes bound
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 5 evidence locations
Network access
May connect to external services.
Observed in 37 evidence locations
Filesystem access
May read or write local files.
Observed in 3 evidence locations
Env variables
May read values from the process environment.
Observed in 33 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 51 evidence locations
Capability review items (18)
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (10)
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighAuthentication examples can continue after missing or invalid credentials.Reject missing or invalid tokens, remove anonymous fallbacks, and keep development-only examples clearly separated from production code.
- FIX-002HighTypeScript examples trust decoded JWT payloads for tenant isolation.Verify JWT signatures or use CloudBase-authenticated identity before using sub as a storage partition key.
- FIX-003MediumAgent server examples use wildcard CORS and public interface binds.Document production origin allowlists, required authentication, and network restrictions for services listening on 0.0.0.0.
- FIX-004MediumDeployment guides include shell scripts and destructive env rebuild commands.Require explicit user confirmation before running shell scripts, and warn users to run them only from the intended project root.
- FIX-005LowSample secrets and API keys can look deployable.Use clearly invalid placeholders and require generated JWT secrets with at least 32 characters.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- 24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec
- Content hash
- d5b1f6e5cd428a3293a8d36d436f5d975430db2b10b1d0ccbfd2e5c1d7e6bbb7
- Tree hash
- 3b702681b881330c08a816ae0cc088d053c21a3ab6a7e5bd56ed8fe286a85848
- Skill path
- skills/tencentcloudbase/cloudbase-agent
- Audit payload hash
- bc3453eceb8e6d67ed5de2e24111953e
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable