技能 cloudbase-agent
📦

cloudbase-agent

v2.23.8 内容修订 r1 高风险 🌐 网络访问🔑 环境变量⚙️ 外部命令📁 文件系统访问⚡ 包含脚本

构建 CloudBase AI Agent 后端

Agent 服务需要一致的服务器、适配器、部署和 UI 模式。此技能为 TypeScript 和 Python 中的 CloudBase Agent SDK 项目提供指导。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "cloudbase-agent" from https://skillstore.io/skills/tencentcloudbase-cloudbase-agent.md and its manifest at https://skillstore.io/api/skills/tencentcloudbase-cloudbase-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/tencentcloudbase-cloudbase-agent.md 已签名 manifest GET /api/skills/tencentcloudbase-cloudbase-agent/manifest 已签名 lockfile GET /api/skills/tencentcloudbase-cloudbase-agent/lockfile

测试它

正在使用“cloudbase-agent”。 创建一个 TypeScript LangGraph agent 并将其部署到 CloudBase。

预期结果:

  • 选择适配器并包含所需的 CloudBase 包。
  • 为 AG-UI 和 OpenAI 兼容端点提供服务器设置概要。
  • 使用 CloudBase Agent 运行时要求的部署检查清单。

正在使用“cloudbase-agent”。 为 Python agent 服务器添加身份验证和可观测性。

预期结果:

  • 用于验证用户上下文的中间件方案。
  • 模型和追踪提供商的环境变量列表。
  • 针对 CORS、密钥和端点暴露的生产检查。

正在使用“cloudbase-agent”。 将 Web 客户端连接到我的 agent 服务。

预期结果:

该技能会识别 AG-UI 客户端路径、端点形态、流式传输行为和部署注意事项。

安全审计

高风险
v2 • 2026/7/9 打开版本化报告

Most static hits are documentation examples or markdown syntax, including placeholder secrets, local URLs, dotenv usage, and inline code. Confirmed risks remain in authentication examples, unverified JWT decoding, public interface binds, shell-based deployment steps, and wildcard CORS guidance.

22
已扫描文件
5,743
分析行数
18
复核项
0
已忽略误报

已确认安全问题 (10)

高
py/adapter-coze.md:221
System reconnaissance
logger.warning("Missing or invalid Authorization header")
The middleware logs a missing or invalid Authorization header and then continues as an anonymous user. That behavior can bypass authentication for protected agent actions.
高
py/authentication.md:79
System reconnaissance
# Handle invalid token (log but don't block in this example)
The basic JWT example explicitly handles an invalid token by logging rather than blocking. The request then continues to the agent, which is an authentication bypass if reused.
高
py/authentication.md:80
System reconnaissance
print(f"Invalid JWT token: {e}")
The invalid token branch only prints the error in the basic middleware example. Because execution continues afterward, this is a real unsafe pattern.
高
py/authentication.md:82
System reconnaissance
# raise InvalidRequestError(message="Invalid authentication token")
The blocking exception is commented out in the basic authentication example. That makes the shown code continue after invalid authentication.
高
ts/adapter-langchain.md:58
Base64 decode
const payload = JSON.parse(atob(token.split(".")[1]));
The code decodes a JWT payload with atob and uses the sub claim for tenant isolation without signature verification. This can let a caller spoof user identity.
高
ts/adapter-langgraph.md:64
Base64 decode
const payload = JSON.parse(atob(token.split(".")[1]));
The code decodes a JWT payload with atob and uses the sub claim for tenant isolation without signature verification. This can let a caller spoof user identity.
高
py/adapter-coze.md:213-228
Authentication Fallback Allows Anonymous Requests
The Coze middleware uses a dev-secret fallback and continues requests as user anonymous when the Authorization header is missing or invalid. This can turn a protected agent endpoint into an unauthenticated endpoint if copied into production.
The cited example directly sets a predictable JWT secret fallback and yields after assigning an anonymous user on missing authentication.
高
py/authentication.md:78-84
Invalid JWT Example Continues Execution
The basic authentication middleware logs InvalidTokenError and then yields to the agent instead of blocking the request. Later secure guidance exists, but this initial example is unsafe if reused.
The code catches InvalidTokenError, prints the error, leaves the blocking exception commented out, and reaches the yield statement.
显示全部 10 条已确认问题
高
ts/adapter-langchain.md:56-64ts/adapter-langgraph.md:62-69
Unverified JWT Payload Used for Tenant Isolation
TypeScript adapter examples parse the JWT body with atob and use payload.sub for CloudBaseSaver userId. The signature is not verified before using that value for tenant isolation.
Both examples decode the JWT payload client-side and trust sub for storage isolation without a verification step.
中
py/skill.md:106-111py/adapter-coze.md:272-282py/agent-deployment.md:340-356ts/server-quickstart.md:78-83
Wildcard CORS in Agent Server Examples
TypeScript and Python examples enable broad CORS on agent endpoints, including FastAPI credentialed CORS. Public agent APIs should use explicit origin allowlists in production.
The cited snippets enable wildcard or broadly enabled CORS for agent servers, and one FastAPI example also enables credentials.
能力复核项 (18)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高
py/adapter-coze.md:213
Python getenv function
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
The example falls back to JWT_SECRET_KEY="dev-secret", which can create forgeable JWTs if copied into production. This is a real authentication weakness, not just configuration access.
高
py/adapter-coze.md:213
getenv function call
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
The getenv call supplies a hardcoded dev-secret fallback for JWT signing. A missing environment variable would silently weaken authentication.
高
py/adapter-coze.md:213
Generic API/secret keys
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
JWT_SECRET falls back to a predictable value named dev-secret. This creates a credible credential weakness when reused beyond local development.
中
py/adapter-coze.md:282
Hardcoded IP address
host="0.0.0.0"
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
中
py/agent-deployment.md:92
Shell command substitution
PROJECT_DIR="$(pwd)"
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
中
py/agent-deployment.md:104
Shell command substitution
echo "✅ Using: $PYTHON_BIN ($($PYTHON_BIN --version 2>&1))"
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
中
py/agent-deployment.md:89
Unix shell invocation
#!/bin/bash
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
中
py/agent-deployment.md:322
Unix shell invocation
#!/bin/bash
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
中
py/agent-deployment.md:377
Unix shell invocation
#!/bin/bash
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
中
py/agent-deployment.md:314
Hardcoded IP address
AgentServiceApp().run(create_agent, port=port, host="0.0.0.0")
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
中
py/references/recipes.md:32
Hardcoded IP address
server.run(host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
中
py/references/server.md:36
Hardcoded IP address
uvicorn.run(fastapi_app, host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
中
py/server-quickstart.md:277
Hardcoded IP address
uvicorn.run(app, host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
中
py/server-quickstart.md:447
Hardcoded IP address
--bind 0.0.0.0:9000
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
中
py/skill.md:111
Hardcoded IP address
app.run(create_agent, port=port, host="0.0.0.0")
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
中
ts/agent-deployment.md:74
Unix shell invocation
#!/bin/sh
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
中
ts/agent-deployment.md:84
Unix shell invocation
> **NOTE**: Use `#!/bin/sh` (not `#!/bin/bash`) for maximum compatibility. The entry point should ma
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
中
ts/agent-deployment.md:137
Unix shell invocation
| **Startup script** | `scf_bootstrap` — `#!/bin/sh` + `node src/index.js` |
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.

风险因素

🌐 网络访问 (37)
py/adapter-coze.md:58 py/adapter-coze.md:125 py/adapter-coze.md:136 py/adapter-coze.md:282 py/adapter-langgraph.md:235 py/adapter-langgraph.md:295 py/agent-deployment.md:314 py/authentication.md:431 py/authentication.md:456 py/authentication.md:468 py/references/observability.md:312 py/references/observability.md:360 py/references/observability.md:364 py/references/observability.md:134 py/references/observability.md:233 py/references/observability.md:301 py/references/observability.md:328 py/references/recipes.md:300 py/references/recipes.md:32 py/references/server.md:36 py/references/tools.md:55 py/references/tools.md:87 py/server-quickstart.md:291 py/server-quickstart.md:304 py/server-quickstart.md:321 py/server-quickstart.md:338 py/server-quickstart.md:397 py/server-quickstart.md:430 py/server-quickstart.md:277 py/server-quickstart.md:447 py/skill.md:111 SKILL.md:14 SKILL.md:15 ts/server-quickstart.md:82 ts/server-quickstart.md:128 ts/server-quickstart.md:138 ts/ui-clients.md:16
🔑 环境变量 (50)
py/adapter-coze.md:134 py/adapter-coze.md:135 py/adapter-coze.md:136 py/adapter-coze.md:213 py/adapter-coze.md:267 py/adapter-coze.md:268 py/adapter-coze.md:269 py/adapter-coze.md:281 py/adapter-coze.md:134 py/adapter-coze.md:135 py/adapter-coze.md:136 py/adapter-coze.md:213 py/adapter-coze.md:267 py/adapter-coze.md:268 py/adapter-coze.md:269 py/adapter-coze.md:281 py/adapter-coze.md:30 py/adapter-coze.md:43 py/adapter-coze.md:57 py/adapter-coze.md:97 py/adapter-coze.md:124 py/adapter-coze.md:135 py/adapter-coze.md:149 py/adapter-coze.md:161 py/adapter-coze.md:213 py/adapter-coze.md:268 py/adapter-coze.md:292 py/adapter-coze.md:293 py/adapter-coze.md:319 py/adapter-coze.md:320 py/adapter-coze.md:337 py/adapter-coze.md:338 py/adapter-coze.md:356 py/adapter-development.md:117 py/adapter-development.md:118 py/adapter-langgraph.md:556 py/adapter-langgraph.md:557 py/adapter-langgraph.md:558 py/adapter-langgraph.md:556 py/adapter-langgraph.md:557 py/adapter-langgraph.md:558 py/adapter-langgraph.md:550 py/adapter-langgraph.md:551 py/adapter-langgraph.md:550 py/adapter-langgraph.md:551 py/adapter-langgraph.md:545 py/adapter-langgraph.md:557 py/agent-deployment.md:313 py/agent-deployment.md:387 py/authentication.md:319
⚙️ 外部命令 (50)
py/agent-deployment.md:92 py/agent-deployment.md:104 py/agent-deployment.md:89 py/agent-deployment.md:322 py/agent-deployment.md:377 py/skill.md:26 py/skill.md:27 py/skill.md:28 py/skill.md:29 py/skill.md:46 py/skill.md:60 py/skill.md:61 py/skill.md:62 py/skill.md:63 py/skill.md:78-87 py/skill.md:87-91 py/skill.md:91-112 py/skill.md:112-122 py/skill.md:122-142 py/skill.md:142-146 py/skill.md:146 py/skill.md:148-161 py/skill.md:161-163 py/skill.md:163-164 py/skill.md:164-169 py/skill.md:169-179 py/skill.md:179-181 py/skill.md:181-182 py/skill.md:182-183 py/skill.md:183-184 py/skill.md:184-188 py/skill.md:188-213 py/skill.md:213-217 py/skill.md:217-227 py/skill.md:227-233 py/skill.md:233-234 py/skill.md:234 py/skill.md:235 py/skill.md:236 py/skill.md:237-242 py/skill.md:242-243 py/skill.md:243-244 py/skill.md:244 py/skill.md:245-246 SKILL.md:12 SKILL.md:14 SKILL.md:15 SKILL.md:17 ts/agent-deployment.md:74 ts/agent-deployment.md:84
📁 文件系统访问 (4)
py/agent-deployment.md:46 py/agent-deployment.md:96 py/agent-deployment.md:215 py/agent-deployment.md:215
⚡ 包含脚本 (5)
py/references/observability.md:56-61 py/references/recipes.md:240 py/references/recipes.md:246 py/server-quickstart.md:17-22 py/server-quickstart.md:171-179

检测到的模式

System reconnaissance×4
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/tencentcloudbase-cloudbase-agent/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/tencentcloudbase-cloudbase-agent/security.svg)](https://skillstore.io/skills/tencentcloudbase-cloudbase-agent?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/tencentcloudbase-cloudbase-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tencentcloudbase-cloudbase-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/tencentcloudbase-cloudbase-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

tencentcloudbase. (2026). cloudbase-agent security audit report (audit version 2) [Author version 2.23.8]. Skillstore. https://skillstore.io/skills/tencentcloudbase-cloudbase-agent/audits/2

BibTeX 引用

@techreport{tencentcloudbase-tencentcloudbase-cloudbase-agent-2026, author = {tencentcloudbase}, title = {cloudbase-agent security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/tencentcloudbase-cloudbase-agent/audits/2}, note = {Author version 2.23.8} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "cloudbase-agent security audit report (audit version 2)" version: "2.23.8" type: report authors: - name: "tencentcloudbase" date-released: "2026-07-09" url: "https://skillstore.io/skills/tencentcloudbase-cloudbase-agent/audits/2" identifiers: - type: other value: "skillstore:tencentcloudbase-cloudbase-agent:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
100
可维护性
87
内容
65
社区
91
规范符合性

你能构建什么

启动 Agent API

创建支持 AG-UI 流式传输的 CloudBase Agent 服务器，并使用推荐的运行时进行部署。

连接 Agent UI

构建一个 Web 或小程序客户端，从 CloudBase Agent 端点流式接收事件。

准备生产级 Agent

为 CloudBase agent 后端添加身份验证、存储、可观测性和部署检查。

试试这些提示

创建入门 Agent 
使用 LangGraph 适配器创建一个最小化的 TypeScript CloudBase Agent 服务器。包含所需文件和本地运行步骤。
构建 Python 服务器 
使用 FastAPI 和 LangGraph 构建一个 Python CloudBase Agent 服务器。添加环境变量设置并说明每个部署步骤。
审查部署就绪状态 
审查我的 CloudBase Agent 项目的依赖项一致性、运行时版本、CORS、身份验证和部署就绪状态。
设计生产级后端 
设计一个多 agent CloudBase 后端，包含持久化记忆、身份验证中间件、可观测性和 Web AG-UI 客户端。

最佳实践

  • 先选择语言路径，并且只阅读匹配的参考文件。
  • 使用当前的 CloudBase Agent 包和文档化的运行时要求。
  • 在公开部署前验证身份验证、CORS、密钥和可观测性。

避免

  • 在一个项目中混用 Python 和 TypeScript 部署指令。
  • 将示例凭据、通配符 CORS 或开发用 JWT 密钥部署到生产环境。
  • 在依赖项和运行时检查通过之前调用部署工具。

常见问题

此技能是否同时支持 TypeScript 和 Python？
是的。它会根据项目语言路由到单独的 TypeScript 和 Python 指令。
它能将 agent 部署到 CloudBase 吗？
它为 CloudBase Agent 服务提供部署指导，包括运行时和依赖项检查。
它是否说明 AG-UI 流式传输？
是的。它涵盖 agent 服务器的 AG-UI 事件流式传输和 OpenAI 兼容端点。
涵盖哪些适配器？
文档涵盖 LangGraph、LangChain、Coze、CrewAI 和自定义适配器模式。
它是否只用于后端工作？
不是。它还包含 Web 和微信小程序客户端集成指导。
用户在生产前应审查什么？
用户应审查身份验证、CORS、密钥、公网暴露、存储和可观测性设置。

开发者详情

许可证

MIT

作者版本

v2.23.8

Skillstore 修订

r1

仓库

https://github.com/tencentcloudbase/skills/tree/main/skills/cloudbase-agent

引用

24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec

维护新鲜度

2026/7/22

使用量

1 次下载 · 1 次浏览

文件结构

📁 py/

📁 references/

📄 observability.md

📄 recipes.md

📄 server.md

📄 storage.md

📄 tools.md

📄 adapter-coze.md

📄 adapter-development.md

📄 adapter-langgraph.md

📄 agent-deployment.md

📄 authentication.md

📄 server-quickstart.md

📄 skill.md

📁 ts/

📄 adapter-development.md

📄 adapter-langchain.md

📄 adapter-langgraph.md

📄 agent-deployment.md

📄 agui-protocol.md

📄 server-quickstart.md

📄 skill.md

📄 ui-clients.md

📄 ui-miniprogram.md

📄 SKILL.md

tencentcloudbase 的更多技能

查看全部

相关技能

查看全部