huawei-cloud-ascend-models-deploy

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:35 AM UTC
• Version: 1.0.0

Overview

The skill is a legitimate Ascend deployment helper, but it guides agents to run unverified downloaded shell scripts in detached background sessions on remote servers.

Install only if you trust the Huawei Cloud sample-script URLs and are comfortable with the agent generating remote shell commands. Before running a deployment command, inspect the downloaded script, verify its source or checksum independently, use a non-root account where possible, confirm the target host and port, and prefer graceful process shutdown over kill -9.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly instructs the agent to generate and execute shell commands, including `wget`, `chmod`, `sh`, `nohup`, `tail`, and `ss`, but there is no declared permission model limiting shell execution. In an agent ecosystem, undeclared shell capability weakens policy enforcement and increases the chance that a user invokes privileged command execution unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The description presents the skill as a deployment/testing helper, but the body goes further by constructing executable shell commands that download and run remote scripts from an external bucket and by supporting an additional OpenSource category not disclosed in the summary. This mismatch can mislead reviewers and orchestration layers, causing them to authorize a skill with more powerful behavior than expected.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger list includes broad terms like `deploy`, `test`, `model list`, `LLM`, `inference`, and Chinese equivalents, which could activate the skill in contexts unrelated to Ascend DevServer deployment. Over-broad invocation increases the risk that sensitive deployment or command-generation behavior is selected accidentally and exposed to inappropriate prompts or hosts.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation states that `enable_thinking` defaults to `true` and may output a reasoning process, but it does not warn users that this can expose internal reasoning text in API responses. In a deployment/testing skill for LLMs, operators may enable or leave this default on in production integrations, increasing the chance of unintentionally disclosing sensitive prompts, intermediate reasoning, or policy-related internal text to downstream users or logs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions download shell scripts from a remote URL with wget and execute them immediately via sh without any integrity verification, pinning, or code review step. This creates a supply-chain execution risk: if the remote object, hosting bucket, DNS path, or network traffic is compromised, an operator following the skill could run attacker-controlled code on the DevServer with the privileges of the invoking user.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The troubleshooting guidance recommends `kill -9 <PID>` as a routine fix for a busy port without any warning, verification step, or preference for safer termination methods. In a deployment skill, users may copy-paste this and forcibly terminate critical or unrelated services, causing avoidable service disruption or data loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The generated command downloads and executes a remote shell script via `wget` and `sh` in a background `nohup` session without any integrity verification, pinning, or trust check. In a deployment skill, this is especially risky because users are likely to copy-paste the command onto privileged infrastructure, so compromise of the remote bucket, path, or network trust chain could lead to arbitrary code execution on the target host.

Unbounded Output

Medium

• Category: Output Handling

Content

| finish_reason | stop |

Model Response:
[Extract full content, no truncation]

Raw Response:
[Full JSON, no truncation]

• Confidence: 79% confidence
• Finding: The instruction to return model responses and raw JSON with 'no truncation' creates an unbounded output path. In practice, this can expose excessive sensitive content from prompts/responses, overwhelm logs or agent memory, and amplify prompt-injection or data-leak scenarios if the model emits unexpectedly large outputs.

Session Persistence

Medium

• Category: Rogue Agent

Content

deploy_dir = "/home/modelarts-agent"

    cmd = (
        f"nohup bash -c 'export model_name={actual_model} && "
        f"export required_cards={cards} && "
        f"export port={port} && "
        f"wget -P {deploy_dir}/ {script_url} && "

• Confidence: 83% confidence
• Finding: Using `nohup` causes the downloaded deployment script to continue running after the initiating session ends, reducing user visibility and making unintended or malicious activity easier to miss. In combination with remote script execution, persistence of the process increases operational risk because a compromised or faulty script may continue consuming resources or modifying the system without active supervision.

Static analysis

No suspicious patterns detected.