tencentcloud-cos
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs the official 'cos-nodejs-sdk-v5' package from the npm registry. This is a well-known package provided by Tencent Cloud for interacting with their Object Storage and Data Intelligence APIs.
- [COMMAND_EXECUTION]: The skill executes cloud operations via a local Node.js script ('cos_node.mjs'). The script includes a 'guardBucketSafety' function that explicitly prevents the execution of destructive commands, such as deleting or clearing storage buckets, providing a layer of protection against accidental or malicious data loss.
- [CREDENTIALS_UNSAFE]: The skill manages sensitive Tencent Cloud API credentials. It implements a robust local security model where credentials can be persisted using AES-256-GCM encryption ('encrypt-env' action). The encryption key is derived from machine-specific metadata (hostname, username, and project path), ensuring the credentials cannot be used if copied to a different environment. Additionally, the setup script automatically configures '.gitignore' to prevent these secrets from being accidentally committed to version control.
- [PROMPT_INJECTION]: The skill provides knowledge base retrieval capabilities ('hybrid-search') that ingest data from external storage buckets. This creates an indirect prompt injection attack surface where untrusted content could potentially influence agent behavior.
- Ingestion points: Data enters the agent context through the 'hybrid-search' and 'doc-preview' actions in 'scripts/cos_node.mjs' which retrieve content from Tencent COS buckets.
- Boundary markers: The current instructions do not specify explicit delimiters or 'ignore' instructions for the retrieved data fragments.
- Capability inventory: The skill possesses capabilities for network operations, file writing, and comprehensive cloud resource management via the Tencent SDK.
- Sanitization: There is no evidence of filtering or sanitizing the retrieved document fragments before they are presented to the agent's context.
Audit Metadata