cloudbase
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes vendor-provided command-line tools like the
tcbCLI andnpxfor environment management, authentication, and deployment tasks. These are standard developer tools for the CloudBase platform.- [EXTERNAL_DOWNLOADS]: Instructions are provided to install official vendor resources, including@cloudbase/cli,@cloudbase/cloudbase-mcp, and theTencentCloudBase/cloudbase-plugin. These downloads originate from verified infrastructure.- [DATA_EXFILTRATION]: No evidence of data exfiltration was found. The skill includes explicit instructions for the agent to avoid hard-coding secrets and to resolve environment aliases to secure canonical IDs using official APIs.- [PROMPT_INJECTION]: No malicious prompt injection or behavior-override patterns were identified. The guidelines focus on operational safety and scenario-based routing to ensure the agent follows correct implementation paths.- [PROMPT_INJECTION]: The skill processes untrusted project data (e.g., README files and tool outputs) and possesses resource deployment capabilities. This attack surface is managed through standard JSON serialization. - Ingestion points: Project documentation (README.md, tasks.md) and tool outputs from MCP/CLI calls.
- Boundary markers: Explicit delimiters for external data ingestion are absent.
- Capability inventory: Full resource management (manageFunctions, manageApps, manageCloudRun) and shell command execution (tcb CLI).
- Sanitization: Tool results are serialized via
JSON.stringifybefore being written to the workspace.
Audit Metadata