Huawei Cloud Infra

Security checks across malware telemetry and agentic risk

Overview

This Huawei Cloud skill appears useful for cloud administration, but it includes host-level CLI installation and destructive infrastructure commands without strong enough scoping or safeguards.

Review this skill before installing. Use it only if you intend to administer Huawei Cloud resources, verify any KooCLI download source and integrity yourself, avoid running the installer with elevated privileges unless necessary, and require the agent to show exact resource IDs and wait for explicit confirmation before any stop, restart, delete, or other mutating cloud operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes shell commands, accesses configuration files, and can install software, yet it declares no permissions or capability boundaries. This creates a trust and review gap: operators may approve the skill as low-risk while it can read local config, modify files, use network access, and execute binaries that affect the host and cloud account.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented primarily as an infrastructure query/audit assistant, but it also includes a software installation workflow that downloads and installs KooCLI, changes file permissions, initializes credentials, and executes verification commands. That mismatch is dangerous because users may invoke a seemingly read-only cloud skill without realizing it can alter the local system and trigger credential setup and network retrieval of executables.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is described as an infrastructure query/audit/monitoring assistant, but this file downloads an external archive, extracts it, installs a host-level executable into a system path, and then runs it. That materially expands the skill's capabilities and trust boundary: if the downloaded artifact or delivery path is compromised, the host running the skill may execute attacker-controlled code.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Host-level software installation is not justified by the stated read-oriented cloud management scope and creates an unnecessary capability to modify the local machine. This increases risk because the script writes to system locations such as /usr/local/bin, unpacks untrusted archives, and places an executable that may later be invoked by other processes.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger conditions are broad enough to match many generic cloud, server, network, database, audit, and status-check requests. Overbroad activation increases the chance the skill runs in contexts the user did not intend, which is especially risky here because the skill can perform local installation and interact with cloud credentials and infrastructure tooling.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The file documents destructive infrastructure commands such as deleting ECS servers and RDS instances with only a brief section heading stating confirmation is required. In an agent skill context, this is risky because the commands are ready to execute and the weak warning may not reliably enforce explicit user confirmation, increasing the chance of accidental or socially engineered destructive actions against production cloud resources.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal