Skill

cloud-cli

skill:yc-software/qm#cloud-cli

Sign a cloud provider's CLI in (AWS, Google Cloud, Azure, or another) with a device-code flow, then run that CLI as the requesting user. Covers checking the CLI is installed, the login that survives the browser round-trip, and the boundaries on cloud writes.

SkillsMP

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 27, 2026, 21:57 UTC at 9432ce5

findings

—

highest severity

threat classes

2,607

files scanned

17/17

checks satisfied

package advisories

Why this verdict

inconclusive: gap skill_frontmatter_invalid at .claude/skills/dev-instance/SKILL.md
inconclusive: gap skill_frontmatter_invalid at .claude/skills/update-qm/SKILL.md
inconclusive: gap skill_frontmatter_invalid at .claude/skills/upstream-pr/SKILL.md
inconclusive: unresolved question on CRED

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the open questions and coverage gaps below; 5 candidate findings were refuted on review.

Open questions 8

What the analysis could not settle from the code alone.

Detector leads DET:18029de64740a6b7 and DET:18a670c16937ccd6 indicate an observed file_read of '~/.aws/config' that is undeclared and allegedly contradicts the boundary against using ungranted credentials; the shown text only instructs placing non-secret SSO config there, so whether the runtime reads credential-bearing sections of ~/.aws/config cannot be settled from this pass.

Credential access

The boundaries section instructs the agent to 'load the admin skill for QM administration'; the identity and content of that skill are not shown, so whether its instructions further expand authority beyond the declared task is unsettled.

Privilege escalation

Detector DET:18029de64740a6b7 attributes a safety claim (Do not use another person's ungranted credentials or expose unrelated private content.) to line 90, but that sentence does not appear anywhere in the shown section (lines 82-91), so the asserted contradiction between that claim and reading ~/.aws/config cannot be verified from the evidence shown.

Credential access

[file request skills-seed/use-shared-credential/SKILL.md] Does the use-shared-credential skill instruct the agent to read, relay, or apply a shared org credential beyond the requesting user's own grants, and does its text steer beyond the cloud-cli declared task?

Credential access

[file request skills-seed/interactive-login/SKILL.md] Does the interactive-login skill save provider login state only to the keychain as claimed, or does it persist or transmit credentials or device codes elsewhere, and does its text steer beyond the declared login task?

Credential access

[file request skills-seed/interactive-login/SKILL.md] The cloud-cli skill delegates the login flow and keychain storage to the interactive-login skill; does that skill keep credentials on-host (keychain only) as claimed, or does it send the private HOME, tokens, or environment data off-host?

Credential access

[file request skills-seed/use-shared-credential/SKILL.md] The cloud-cli skill offers 'a shared org credential by proxy' via the use-shared-credential skill; does that skill restrict itself to credentials the requesting user is granted, or can it reach other users' credentials?

Credential access

[file request skills-seed/use-shared-credential/SKILL.md] The cloud-cli skill delegates credential sourcing to the use-shared-credential skill: does that skill read shared org or keychain credentials and send them anywhere beyond the provider's own API endpoints?

Credential access

Refuted findings 5

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedlow confidence

When the provider CLI is missing, the skill tells the agent to run the provider's own installer unpinned into the workspace or $HOME, fetching and executing remote installer code at runtime as a prerequisite for the task.

skills-seed/cloud-cli/SKILL.md:25-26

provider's own installer, into the workspace or `$HOME`, not a system path.

Why it was refuted

The install fallback is itself a declared mandatory capability (D5), naming the provider's own installer scoped to the workspace or $HOME with explicit disclosure ('Say that you installed it'), so the unpinned-install behavior is neither undeclared nor outside the declared core capability.

Credential access

criticalRefutedmedium confidence

The skill directs the agent to authenticate the cloud CLI with a credential already on the host, naming the user's keychain and a shared org credential obtained via the referenced use-shared-credential skill, routing an existing secret into the provider HTTP API.

skills-seed/cloud-cli/SKILL.md:28-29

with a credential you already have (a keychain entry, or

Why it was refuted

Authenticating the provider's HTTP API with a credential the requesting user already holds is the skill's declared core capability (D6), and the same artifact bounds it with 'Do not use another person's ungranted credentials' (D16), so routing a keychain entry or shared org credential is declared, disclosed behavior, not concealed secret handling.

Credential access

criticalRefutedmedium confidence

The cloud-cli skill delegates the entire device-code login and persistence of a private HOME holding provider login state to the `interactive-login` skill file, which ships outside consumed content, so the instructions controlling where credentials are stored or sent are unreviewable.

skills-seed/cloud-cli/SKILL.md:60-62

Run the login with the `interactive-login` skill: it starts the CLI as a background job in a

Why it was refuted

The delegation is openly declared (D3/D4 name the `interactive-login` skill and keychain storage) and its mechanics are summarized in-file (background job in a private HOME, save that HOME to the keychain), so nothing about where credentials are stored is undeclared or concealed; unreviewability of the referenced file is a review-scope fact, not an undeclared behavior of this skill.

Persistence

criticalRefutedlow confidence

The skill instructs writing provider SSO session and profile configuration into the user's ~/.aws/config outside the workspace, a host config write that persists settings the CLI later reads back for logins.

skills-seed/cloud-cli/SKILL.md:90

`[sso-session …]` block plus a profile in `~/.aws/config`

Why it was refuted

The write is the provider-documented, explicitly non-secret SSO setup (start URL, region, session name) that the declared device-code login requires, so it falls under the declared core capability and the detector's claimed contradiction with D16/D17 does not hold for non-secret config; at most a low-severity undeclared-residue bookkeeping item remains, which does not make the persistence harmful.

Privilege escalation

highRefutedmedium confidence

The boundaries section asserts that an independently authorized admin may administer resources owned by other users and that an owner-only QM API denial does not prohibit that work, conditioning the agent to treat owner-level denials as non-blocking when it believes admin authority applies.

skills-seed/cloud-cli/SKILL.md:67-70

an ordinary owner-only QM API denial does not prohibit that administrative work

Why it was refuted

The quoted sentence is the artifact's declared boundaries policy (D13) scoped to a verified, independently authorized admin, and the same section requires verifying authority and preserves explicit restrictions plus the hard ceiling that the agent never exceeds the user's own cloud access, so the 'when it believes' reading misstates disclosed, bounded policy rather than an escalation instruction.

Coverage gaps 18

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

desktop/assets/qm.icns

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/encrypted.pdf

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/hostile.pdf

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.doc

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/sample.pdf

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.ppt

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.pptx!/ppt/printerSettings/printerSettings1.bin

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.xls

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/scanned.pdf

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/dev-instance/SKILL.md

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/update-qm/SKILL.md

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/upstream-pr/SKILL.md