Atlas / Skills / tencentcloudbase / References

ReferencesCAUTION

skills/tencentcloudbase/references

Agent skill by tencentcloudbase · agent skills · ai · aicoding · Audited 2026-10-10

⚑ Report / re-scan Source ↗

Backend for AI coding agents on CloudBase — database, auth, functions via Plugin, Skills & MCP.

Verdict

CAUTION

Grade

B

Trust score

85 /100

Version

—

Hosts

6 documented

License

MIT

Stars

1,136

01

Overview

Backend for AI coding agents on CloudBase — database, auth, functions via Plugin, Skills & MCP.

Read from source at commit 7d16f0c5570cOBSERVED · 2026-10-10

02

Host compatibility

What the documentation claims. We have not run a compatibility test.

Host	Status	Notes
claude-code	mentioned
codex	mentioned
copilot	mentioned
cursor	mentioned
openclaw	mentioned
windsurf	mentioned

03

Trust audit

CAUTIONgrade B · trust 85/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	NA
L2	Instruction surface (what it tells the agent)	WARN
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: none-observed
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (7)

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.agents/skills/api-contract-review

.agents/skills/api-contract-review

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.agents/skills/cloud-api-recipe-authoring

.agents/skills/cloud-api-recipe-authoring

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.agents/skills/codebuddy-ide-mcp-upgrade

.agents/skills/codebuddy-ide-mcp-upgrade

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.agents/skills/doc-freshness-review

.agents/skills/doc-freshness-review

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.agents/skills/docs-workflows

.agents/skills/docs-workflows

Why it matters. link not followed

MEDIUMPrompt injection · review.misleading_scope · CWE-94, CWE-1427

<listing:description>

Add a new skill (prompt rule) to the CloudBase AI Toolkit project.

Why it matters. The package description claims to add a 'prompt rule' but the actual content is a comprehensive multi-step workflow instructing the agent to modify project files, upload icons to cloud storage, update code mappings, and edit a separate documentation repository (cloudbase-docs), which is far beyond a

Fix. rewrite it so the instruction says plainly what it does, and asks the user before it acts

MEDIUMInventory / provenance · skill.no_skill_md · CWE-1104

Why it matters. no SKILL.md at the audited path

Fix. a skill without its instruction file cannot be reviewed as one

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha 7d16f0c5570cfull audit observations/trust-audit/skill/tencentcloudbase__references.json · Report an issue / request a re-scan

04

Audit history

Every audit this skill has had.

Date	Source	Verdict	Grade	Score	Change
2026-10-10	`7d16f0c5570c`	CAUTION	B	85	first audit

05

Questions

What does the References skill do?

Backend for AI coding agents on CloudBase — database, auth, functions via Plugin, Skills & MCP.

Is References safe to install?

With care. The audit graded it B (85/100) and found 7 things worth knowing before you trust this skill, listed below with the exact line each was found on.

What can References access on my machine?

The audit observed no filesystem, network or shell use at all in its source.

Which assistants does References work with?

Its documentation mentions claude-code, codex, copilot, cursor, openclaw and windsurf. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (7d16f0c5570c), read on 2026-10-10. The repository is watched, and a new audit runs when it changes — this is the first audit.