Cts Anomaly Check

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:23 AM UTC
• Version: 0.1.2

Overview

This skill is broadly consistent with cloud audit checking, but it also creates 24-hour Huawei Cloud temporary credentials and checks billing data without adequate permission disclosure or user control.

Review this skill before installing. Use only a tightly scoped Huawei Cloud identity, assume reports may contain sensitive audit and account data, avoid broad cron logging or email forwarding, and require explicit consent for billing checks or temporary credential creation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/check_cts_anomaly.py:490

Finding

Undisclosed Creation of Long-Lived Temporary Credentials and Billing Access

Content

View full analysis

0): print("警告：您的账号已欠费，无法正常购买和使用按需计费云服务，请您尽快充值。\n") ``` The documented permission requirement only identifies CTS trace access: ```markdown 需要以下权限策略： - `cts:trace:list` ``` ### Technical Analysis Every invocation creates a temporary Huawei Cloud access key, secret key, and security token valid for 86,400 seconds. It then uses those credentials to access the account balance API before performing the requested CTS trace analysis. Creating credentials and querying billing data are separate privileged operations that are not disclosed in the documented permission requirements. They also occur unconditionally, even when the user only requests CTS log analysis. This violates least-privilege and purpose-limitation principles. Although no credential exfiltration was i ...[truncated 1875 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/check_cts_anomaly.py:50

Finding

Requested CTS Time Boundary Is Ignored

Content

View full analysis

Dict[str, Any]: """查询追踪记录""" args: Dict[str, Union[str, int]] = { "cli-region": region, "project_id": project_id, "trace_type": "system", "limit": limit } if trace_rating: args["trace_rating"] = trace_rating # 不传时间参数，让API返回最近的记录 return run_hcloud("CTS", "ListTraces", args) ``` The command-line option is parsed: ```python parser.add_argument("--hours", type=int, default=24, help="查询最近N小时 (默认24)") ``` However, it is never applied when querying traces: ```python # 直接查询所有记录（不传时间参数） all_traces_result = query_traces(args.region, args.project_id, limit=args.limit) ``` ### Technical Analysis The CLI presents `--hours` as a restriction on the query interval, and `query_traces` exposes `from_time` and `to_time` parameters. Neither parameter is inserted into the arguments passed to Huawei Cloud CTS, and `args.hours` is never used to calculate a time boundary. Consequently, an invocation such as `--hours=1` does not restrict retrieval to one hour. The CTS API instead returns its default recent record set, subject to the supplied record limit. Those records may contain user identities, operation names, resource names, service metadata, and timestamps outside the interval selected by the user. This is a data-minimization and audit-integrity defect. The displayed time range is calculated after retrieval from returned records, rather ...[truncated 1427 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises executable usage via a local Python script that can perform cloud-log access and likely networked API calls, but the manifest does not declare any explicit tool scope such as allowed tools or permissions. This creates a capability/transparency gap: users and orchestrators cannot clearly constrain or review what the skill may invoke, increasing the chance of unintended shell or network execution against cloud resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says the skill checks CTS anomaly records but does not clearly warn that CTS logs may contain sensitive operational and identity data, such as usernames, resource actions, permissions failures, and security-relevant events. Without upfront disclosure, users may trigger processing or display of sensitive audit information without understanding the privacy and security implications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger examples are generic conversational phrases like checking whether the account is overdue or looking for recent anomalies. Because they resemble normal chat requests, the skill could be invoked unexpectedly in ordinary conversation, causing unintentional access to cloud audit data or execution of backend checks without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file instructs users to capture JSON results, inspect incident counts, and email alerts containing security-event information. Elsewhere, the sample outputs include usernames and sensitive operations, but the markdown provides no warning that CTS records may contain sensitive audit data and should be handled carefully when exporting, logging, or emailing.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_cts_anomaly.py (reported line 29)May include surrounding context.

python

cmd.extend(["--cli-output=json"])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False)
        if result.returncode != 0:
            return {"error": result.stderr, "returncode": result.returncode}

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script creates temporary access keys and includes a generic request-signing helper capable of authenticating direct Huawei Cloud API calls beyond CTS reporting. Even though this file only uses it for a billing request, embedding broad credential-generation and arbitrary signed-request capability materially increases the blast radius if the skill is modified, reused, or abused.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill's stated purpose is CTS anomaly analysis, but it also performs a billing/debt query against the BSS API. This expands access to unrelated financial account data without being clearly disclosed in the manifest or narrowed by user consent, violating least privilege and increasing privacy/scope-creep risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script accesses sensitive cloud audit logs and temporary credentials, and also checks billing status, but provides no explicit user-facing notice that such sensitive account and activity data will be retrieved. In a skill context, this lack of transparency makes over-collection more dangerous because users may invoke a seemingly simple anomaly check without understanding the scope of data access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill description and all example interactions are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all guidance, headings, and troubleshooting content exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

Natural-language content throughout the file forces a single language/locale without any opt-in or justification. Under the stated policy, language-specific instructions should either offer user choice or clearly document why the locale restriction is necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown recommends periodic execution with output redirected to /var/log/cts-check.log, while later examples show that outputs can include usernames, failed operations, and sensitive actions. There is no accompanying warning about protecting log files, limiting retention, or avoiding disclosure of audit data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.