辉火云管家密码管理(Vault)

The skill is presented as a password-management assistant, but it also exposes Vault administrative operations such as sealing and unsealing the service. Mixing secret access with infrastructure control expands the blast radius substantially: a user invoking a credential task could be induced to perform service-disruptive or privileged admin actions unrelated to the stated purpose.

The documented workflow includes creating Vault userpass accounts for colleagues, which is a privileged identity-management function not disclosed in the top-level skill description. Hidden account-provisioning capability increases the risk of unauthorized persistence or privilege expansion because users may invoke the skill expecting only secret lookup and sharing behavior.

Seal/unseal are powerful service-administration operations and are not necessary for ordinary password-management tasks. Exposing them in a broadly triggerable conversational skill creates a direct path to denial of service or misuse of highly sensitive recovery material such as unseal keys.

The helper script advertises a Vault container restart capability unrelated to the skill's stated password-management purpose. This extends the skill from secret handling into infrastructure control, enabling service disruption and increasing the chance that routine secret operations become a vehicle for administrative misuse.

The trigger list includes broad terms such as 'vault' and '密钥', which can cause the skill to activate in conversations that are not clearly requesting secret operations. Because this skill has access to sensitive credentials and admin-adjacent functions, accidental invocation materially increases the chance of unintended secret access or destructive actions.

The intent-recognition table maps common everyday phrases directly to sensitive Vault operations without clear scope checks. In a secret-management context, this can lead to overbroad execution of listing, retrieval, writing, or account-sharing commands from ambiguous natural language.

This line documents loading an environment file and enumerating secret paths under secret/shared, which is credential-access functionality. In the context of a conversational skill, exposing direct commands to list sensitive secret namespaces increases the chance of unauthorized discovery of available credentials and targets.

This command continues broad enumeration of secret categories after sourcing a privileged environment file. Even without retrieving values, inventory disclosure reveals what systems, services, or providers the organization uses, which aids follow-on credential targeting and lateral movement.

The skill provides another privileged path-enumeration command for shared secret storage. Repeated examples of direct enumeration normalize credential discovery as a default action, which is dangerous in an agent setting where prompts can be ambiguous or adversarially framed.

This line exposes continued enumeration of sensitive Vault namespaces through a sourced environment file. The context makes it more dangerous because the skill explicitly manages many categories of production secrets, so path discovery meaningfully increases operational and attack intelligence.

The documented command lists additional shared secret categories, contributing to a comprehensive inventory of credential-bearing systems. In a secret-management skill, inventory exposure is itself sensitive because it reveals high-value services and possible credential types even before secret values are read.

This line further demonstrates privileged listing of secret namespaces using environment-loaded access. The danger is amplified by the skill's broad path structure, which includes cloud, payment, publishing, and other high-impact secrets that should not be discoverable by default.

The command sequence continues secret namespace enumeration, making the skill capable of mapping out the organization's credential layout. Such discovery facilitates social engineering, targeted retrieval attempts, and abuse of any downstream command that accepts a path parameter.

This line documents direct retrieval of a secret entry after sourcing the Vault environment file. In context, that is a core credential-access capability and is dangerous because the skill includes paths to production secrets across multiple services, making unauthorized invocation potentially expose live credentials.

This command retrieves a specific field from a secret, demonstrating precise extraction of live credentials such as API keys. Field-level access can make exfiltration easier and less noticeable because it supports targeted harvesting of just the valuable secret material rather than whole records.

This line documents vault operator unseal <unseal_key> after loading the environment, which involves highly sensitive recovery material and privileged service control. In a conversational skill, requesting or handling unseal keys is especially dangerous because it can expose key shares and enable unauthorized restoration or manipulation of the Vault service.