huawei-cloud-ascend-command

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:36 AM UTC
• Version: 1.0.0

Overview

This skill is a real Ascend NPU administration tool, but it exposes broad local and remote command authority with weak guardrails around high-impact operations.

Install only in a controlled admin environment. Avoid command-line passwords and root accounts where possible, prefer key or secret-store based SSH, and do not let the skill auto-run broad prompts. Review or restrict raw npu-smi, --npu-smi, execute_batch, and remote SSH execution before using it on production hardware.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: A description-behavior mismatch is security-relevant here because this skill operates local shell and SSH execution against NPU management interfaces, including sensitive actions like firmware, virtualization, and certificate changes. If the implementation accepts arbitrary `npu-smi` passthrough or undocumented subcommands, users and orchestrators may invoke more dangerous operations than the documentation suggests, undermining consent, policy review, and safety gating.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This reference documents additional high-impact device control operations such as performance mode changes, clock changes, secure boot, thermal thresholds, and reset actions that go beyond the declared skill scope. In an agent setting, undocumented or under-declared capabilities increase the chance that the model exposes privileged actions unexpectedly, enabling unsafe configuration changes to production NPU hardware.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The executor accepts any input beginning with `npu-smi` and forwards the remainder directly to `self.client._run_npu_smi(...)`, bypassing the natural-language routing and confirmation controls used for sensitive operations. In this skill context, that is dangerous because users can invoke administrative or destructive `npu-smi` functions outside the advertised guardrails, potentially altering device state, firmware, virtualization, or other management settings.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The batch helper accepts an arbitrary list of commands and concatenates them into a single shell command string, enabling execution of commands well beyond the stated NPU-management scope. In SSH mode this becomes unrestricted remote command execution, and even in local mode it can trigger unintended parsing failures or unsafe expansion if later reused with a shell-capable executor.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The parallel FLOPS test builds shell command strings that perform mkdir, output redirection, backgrounding, cat, and rm -rf, which are general shell/filesystem capabilities not limited to npu-smi management. Because device IDs and dtype are interpolated into command strings executed remotely, this unnecessarily broadens the attack surface and can be abused if inputs are not tightly constrained upstream.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The _execute method is a generic command runner for both SSH and local execution, not a narrowly scoped npu-smi wrapper. Once present, any current or future method can invoke arbitrary operating-system commands on the local host or remote server, turning the skill into a general execution primitive if inputs or call sites are compromised.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger list is extremely broad and includes generic terms like 'power', 'memory', 'health', 'compute', and common Chinese equivalents, which can cause accidental activation. In a skill that supports remote SSH administration and device configuration, unintended invocation increases the chance of exposing credentials, running commands on the wrong host, or presenting a high-risk tool when the user intended a general informational query.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill normalizes SSH remote execution with `root` and `--password` on the command line, but the description does not clearly warn that command-line credentials can leak via process listings, shell history, logs, or orchestration telemetry. In context, this is more dangerous because the same skill can perform high-impact administrative actions on remote accelerators, including firmware and virtualization changes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The acceptance criteria explicitly require SSH remote access with password authentication, but provide no warning about credential sensitivity, secure handling, or the risks of issuing commands on remote systems. In a skill that manages NPUs and can perform configuration changes, firmware actions, and other privileged operations, normalizing password-based remote control without guardrails increases the likelihood of insecure credential collection, exposure, or misuse.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file lists virtualization operations such as creating and deleting vNPUs without any warning that these actions can disrupt workloads, alter device allocation, or be difficult to reverse safely in production environments. Because this skill targets infrastructure management hardware, omission of safety messaging and change-impact guidance makes accidental destructive use materially more likely.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases 'Install certificate' and especially 'Import certificate' are broad natural-language mappings for a sensitive, state-changing command that installs a certificate file onto the device. In an agent skill, ambiguous matching can cause accidental execution of certificate replacement or trust-anchor changes, potentially enabling unauthorized trust configuration or breaking secure management paths.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The phrase 'Update certificate' is overly broad and can easily be interpreted as a harmless information update, while it actually maps to a sensitive renewal operation. Because certificate renewal changes device security material, an ambiguous trigger increases the chance of unintended state changes or attacker-crafted prompts causing an operator to authorize the wrong action.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: A generic trigger phrase for `https-enable -d 0` is dangerous because it disables HTTPS, weakening transport security for device management. In this skill's context, which supports remote management and certificate operations, an accidental or induced match could downgrade secure communications and expose credentials or management traffic to interception or tampering.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Using a broad natural-language trigger like 'Reset NPU' or especially 'Factory reset' for a destructive configuration reset creates a significant risk of accidental or prompt-induced invocation. In this skill context, the command resets all configuration settings on accelerator hardware, so an ambiguous trigger can cause operational disruption or loss of security/performance settings.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The troubleshooting guidance recommends `chmod 666 /dev/davinci*`, which makes NPU device nodes world-readable and world-writable. On a system managing accelerator hardware, this can let any local user interact with devices, interfere with workloads, access data paths, or abuse privileged hardware interfaces, and the document only labels it 'less secure' without adequately warning against the risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation demonstrates passing an SSH password directly on the command line (`--password xxx`). Command-line secrets are commonly exposed through shell history, process listings, terminal logs, CI logs, and copied documentation, which can lead to credential disclosure. In this skill's context, the examples target remote management of NPU devices and even use the `root` account, which increases the sensitivity of any leaked credential.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The FLOPS path launches a hardware benchmark immediately, with no confirmation step, even though it can consume significant compute and power and may affect production workloads or device stability. In a remote-management skill for NPUs, unguarded execution of stress-style diagnostics is more dangerous because a casual natural-language prompt can trigger disruptive activity on managed accelerators.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill accepts an SSH password directly via the --password command-line argument, which can expose credentials through shell history, process listings, audit logs, and command wrappers. In this skill's context, the risk is elevated because it is designed for remote administrative management of NPUs, including sensitive operations such as firmware upgrades and device configuration, so leaked credentials could enable unauthorized remote access and control.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: These methods perform security- and availability-impacting operations such as ECC changes, fan changes, firmware upload/activation, virtualization changes, and certificate threshold modification without any built-in safeguard, confirmation, or authorization boundary. In an agent context, exposing destructive administrative actions as simple method calls greatly increases the chance of accidental misuse or hostile prompt-driven invocation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Solution:**
1. Check resource allocation
2. Update firmware
3. Run as root

### Issue: vNPU performance slow

• Confidence: 95% confidence
• Finding: Recommending 'Run as root' as a troubleshooting step encourages privilege escalation without guardrails or least-privilege guidance. In a skill that supports local and SSH-based remote device management plus configuration changes, this can normalize executing powerful hardware-management commands with full system privileges, increasing the blast radius of mistakes or abuse.

Static analysis

No suspicious patterns detected.