Security audit

storage-obs-huawei-cloud-obs-bucket-create

Security checks across malware telemetry and agentic risk

Overview

This skill appears to help users create Huawei Cloud OBS buckets, with some caution needed around broad activation and use of local OBS configuration.

Install only if you want an agent to help create Huawei Cloud OBS buckets. Before running any commands, confirm the bucket name, region, billing/project context, and access policy, and do not allow the agent to print or share your full ~/.obsutilconfig file.

SkillSpector

By NVIDIA

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad enough to activate on general Huawei Cloud storage discussions rather than explicit bucket-creation requests. This can cause the agent to enter an operational workflow unexpectedly and steer the session toward bucket creation or configuration actions the user did not intend.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Content: ### Step 2: Select Region Get the region for the OBS bucket to be created from the context. If no region is specified, use the "endpoint" parameter in the ~/.obsutilconfig file as the region by default. Return prompt text: >Once a bucket is created successfully, the region cannot be changed, please choose carefully. The region you want to create the bucket in is ${region} ### Step 3: Create Bucket
Confidence: 91% confidence
Finding: Return prompt

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.