Security audit

huawei-cloud-cce-cluster-management

Security checks across malware telemetry and agentic risk

Overview

The skill is a mostly coherent Huawei CCE administration tool, but it exposes sensitive cluster credentials and public-access changes with weaker warnings and controls than its own safety framing implies.

Review this before installing if you will use it against production Huawei Cloud accounts. Use a narrowly scoped IAM identity, avoid long-lived admin AK/SK, prefer SSH keys over node passwords, treat kubeconfig output as a secret, and require your own approval step before binding a public EIP or scaling/deleting resources.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (57)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill explicitly relies on environment variables for cloud credentials and makes outbound API calls, but it does not declare permissions/capabilities accordingly. Undeclared env and network access weakens governance and review controls because a caller may authorize or invoke the skill without understanding it can read credentials and interact with external cloud APIs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The documented scope is CCE cluster management, but the behavior reportedly extends into broader cloud reconnaissance and supporting infrastructure discovery such as VPC, security groups, ACLs, EIPs, NAT gateways, and metrics, plus IAM project ID lookup. This mismatch is dangerous because it expands access beyond user expectations and can facilitate inventorying the environment, which increases blast radius and may expose sensitive topology information.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The script rebinds and exposes non-CCE capabilities such as networking, EIP, NAT, VPC inventory, and monitoring helpers despite the skill being presented as CCE cluster management only. In an agent context, scope creep is dangerous because it silently expands the actions an invoking user or upstream orchestration layer can perform beyond the user-expected trust boundary.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: General-purpose VPC and network inventory functions are exposed even though they are not clearly necessary for the advertised cluster-management-only role. These functions can aid reconnaissance by enumerating security groups, ACLs, networks, and subnets, which is especially sensitive in a cloud administrative skill.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: Monitoring and metrics helpers broaden the skill beyond cluster lifecycle management and may expose operational telemetry unrelated to the user’s intended task. In cloud environments, such telemetry can reveal asset names, topology, utilization patterns, and other sensitive metadata useful for follow-on attacks or lateral reconnaissance.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The file declares that certificates must never be saved to the filesystem, yet helper code later writes kubeconfig-derived client certificate and private key material to disk. This contradiction matters because temporary files can be read by other local processes, captured in backups, or left behind on crashes, resulting in credential compromise and cluster access.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The code can use provided or ambient AK/SK credentials to enumerate IAM projects globally in order to derive project IDs automatically. In a skill context, this expands access beyond the user’s explicit request and can reveal account structure across regions/projects, which is sensitive metadata and a form of overbroad cloud reconnaissance.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The dispatcher defines handlers for non-CCE resources such as VPC, EIP, NAT, EVS, SFS, ELB, IAM projects, ECS metrics, and other cloud services that exceed the declared skill purpose of CCE cluster lifecycle management. In an agent setting, this broadens the available action surface and can enable unintended reconnaissance or modification of unrelated cloud assets if the agent is invoked with attacker-influenced prompts.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This section exposes Kubernetes-level introspection and control beyond stated cluster management, including pods, logs, namespaces, deployments, workloads, services, configmaps, secrets, daemonsets, and statefulsets. These capabilities can reveal sensitive application data or alter workloads, which is materially more powerful than the declared cluster/node/nodepool/addon management scope.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: Inspection, diagnosis, monitoring, dashboard generation, alarm analysis, and automated remediation-related flows substantially expand the operational scope of the skill beyond lifecycle management. While not all of these are inherently unsafe, hidden operational breadth increases the chance of misuse, over-privileged deployment, and user surprise in agent-mediated environments.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The dispatcher includes secret enumeration via list_cce_secrets, with an include_data option that may expose actual secret contents. In a CCE management skill, this is highly sensitive because Kubernetes secrets often contain credentials, tokens, certificates, and API keys, enabling lateral movement or full cluster/application compromise.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: HSS vulnerability-management handlers are unrelated to the stated CCE cluster management function, yet they allow querying host vulnerabilities and changing vulnerability status. That creates an unexpected administrative capability over security operations, which could be abused to hide, suppress, or tamper with vulnerability tracking outside the declared scope.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill includes ECS power-control operations such as stop, start, and reboot for instances, which are not justified by the declared CCE cluster management role. These actions can directly disrupt workloads and availability of unrelated compute resources if an agent is induced to invoke them.

Description-Behavior Mismatch

High

Confidence: 91% confidence
Finding: This file adds broad network-administration and monitoring functions (VPCs, subnets, security groups, ACLs, EIPs, NAT gateways) to a skill declared as CCE cluster lifecycle management. In an agent setting, this expands the accessible attack surface and enables infrastructure reconnaissance well beyond cluster operations, violating least privilege and increasing the chance of unauthorized data exposure or misuse.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The NAT gateway function performs direct signed API access to a non-CCE service and accepts broad filter inputs, enabling arbitrary NAT inventory from within a cluster-management skill. Because it bypasses the normal SDK abstraction and reaches a separate control plane, it creates an unjustified capability for network reconnaissance and magnifies the blast radius if the skill is invoked by an untrusted workflow.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: EIP monitoring and listing expose general network asset inventory and operational telemetry that are not necessary for the stated cluster-management purpose. In a multi-tool agent environment, this can be abused for reconnaissance, identifying public exposure points and traffic characteristics of unrelated infrastructure.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: NAT gateway metrics provide detailed operational telemetry for network infrastructure outside the declared CCE scope. Such telemetry can help an attacker map infrastructure usage patterns, identify chokepoints, or infer deployment topology even without modifying resources.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: VPC, subnet, security group, and ACL enumeration are general cloud network administration capabilities, not core CCE lifecycle tasks. Their inclusion allows broad environment discovery that can reveal segmentation rules, reachable address ranges, and security posture of unrelated assets.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The document enumerates destructive permissions such as cluster and node deletion without warning that they enable irreversible operational actions. In a cluster-management skill, users may copy these permissions directly, increasing the chance that credentials are granted broader destructive capability than intended or used without adequate approval controls.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Recommending the broad 'CCE Administrator' system policy without a cautionary least-privilege note can lead users to grant excessive authority for convenience. In the context of a skill that manages full cluster lifecycle, that excessive authority can permit deletion, reconfiguration, service exposure changes, and other high-impact actions if the account or automation is misused.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation instructs users to supply a node login password through the CCE_NODE_PASSWORD environment variable but does not warn that environment variables can be exposed through shell history, process inspection, CI/CD logs, crash reports, or inherited subprocess environments. In a cluster-management skill, this is especially sensitive because the credential grants node access and could enable broader compromise of cluster workloads or infrastructure if leaked.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation provides a scale-down example for a node pool with no warning that reducing node count can evict workloads, remove capacity, and potentially cause service disruption or data loss for stateful or poorly replicated workloads. In a cluster-management skill, omission of this caution materially increases the chance that users execute a destructive operation without understanding the operational risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The troubleshooting guide instructs users to place a node password in an environment variable without any warning about shell history, process environment exposure, CI/CD logs, or the need to unset the variable afterward. In a cloud cluster-management skill, these credentials can grant access to newly created nodes, so normalizing insecure secret handling increases the risk of credential disclosure and later infrastructure compromise.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This function returns the full kubeconfig and YAML-formatted credential material directly to the caller without warning, masking, or confirmation. A kubeconfig commonly contains client certificates or bearer-token-equivalent access to the cluster, so exposing it can grant administrative or lateral-access capability over Kubernetes workloads and secrets.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Binding an EIP makes the Kubernetes API publicly reachable, materially increasing the attack surface of the control plane. The function performs this exposure change without any explicit confirmation or warning, making accidental internet exposure more likely.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/cce-api-guide.md:82

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/cce-cluster-parameters.md:163

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781