ClawHub
Back to skill

Security audit

huawei-cloud-cce-env-assessment

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an assessment tool, but it asks for powerful cloud credentials and can run broad local and cloud actions without tight scoping.

Install only if you are comfortable giving the agent Huawei Cloud credentials with read access across the relevant CCE, AOM, LTS, and HSS resources. Use least-privilege, temporary AK/SK or an existing scoped profile where possible, avoid running sudo or non-interactive installer/uninstall commands through the agent, and review what will be deleted under data/ and artifacts/ before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"-H", f"Host: {host}",
        url
    ]
    r = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=30)
    
    if log_mode:
        return r.stdout if r.returncode == 0 else None
Confidence
90% confidence
Finding
The script builds a curl command using environment-derived values, including a URL/host based on REGION and cluster metadata, then performs authenticated requests with cloud credentials. Although shell injection is avoided, this still creates an SSRF-like outbound request primitive to attacker-influenced endpoints and disables TLS verification with -k, increasing interception and redirection risk.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print(f"Cloning {DOCKERFILE_REPO_URL} -> {app_repo} (depth=1, sparse on api/web)...", file=sys.stderr)
    # Use sparse-checkout to only pull needed directories, speeding up download
    try:
        subprocess.run(["git", "clone", "--filter=blob:none", "--depth=1", "--no-checkout",
                        DOCKERFILE_REPO_URL, str(app_repo)],
                       check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        subprocess.run(["git", "-C", str(app_repo), "sparse-checkout", "init", "--cone"],
Confidence
95% confidence
Finding
The skill automatically clones a repository from an environment-controlled URL without trust validation or user confirmation. Even without shell injection, this permits untrusted network access, local filesystem writes, and ingestion of attacker-controlled content that is later scanned and persisted, expanding the skill far beyond passive assessment.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
date_str = now.strftime("%Y-%m-%dT%H:%M:%S") + "Z"
        
        def make_request():
            r = subprocess.run(
                ["curl", "-s", "-X", "POST", url,
                 "-H", "Content-Type: application/json",
                 "-d", json.dumps({
Confidence
84% confidence
Finding
The script invokes curl to obtain IAM-related authentication material using environment-supplied credentials and domain/project data. While not shell-injectable, it increases credential exposure surface, relies on external tooling, and can send secrets to a remote endpoint under loosely validated context, which is dangerous in an agent skill.

Tainted flow: 'cmd' from os.environ.get (line 171, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"-H", f"Host: {host}",
        url
    ]
    r = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=30)
    
    if log_mode:
        return r.stdout if r.returncode == 0 else None
Confidence
91% confidence
Finding
Attacker-influenced endpoint components flow into an authenticated curl request, enabling requests to unintended hosts if REGION/endpoint construction is manipulated. Combined with disabled certificate validation, this creates meaningful risk of credential misuse, MITM, or unauthorized data exfiltration.

Tainted flow: 'DOCKERFILE_REPO_URL' from os.environ.get (line 16, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
print(f"Cloning {DOCKERFILE_REPO_URL} -> {app_repo} (depth=1, sparse on api/web)...", file=sys.stderr)
    # Use sparse-checkout to only pull needed directories, speeding up download
    try:
        subprocess.run(["git", "clone", "--filter=blob:none", "--depth=1", "--no-checkout",
                        DOCKERFILE_REPO_URL, str(app_repo)],
                       check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        subprocess.run(["git", "-C", str(app_repo), "sparse-checkout", "init", "--cone"],
Confidence
97% confidence
Finding
An environment-controlled repository URL is used directly in git clone, allowing attacker-selected remote content to be fetched and written locally. In an agent skill, this is risky because it expands the trust boundary, enables data persistence and network access to arbitrary repos, and can facilitate supply-chain or denial-of-service abuse.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High
Category
Data Flow
Content
date_str = now.strftime("%Y-%m-%dT%H:%M:%S") + "Z"
        
        def make_request():
            r = subprocess.run(
                ["curl", "-s", "-X", "POST", url,
                 "-H", "Content-Type: application/json",
                 "-d", json.dumps({
Confidence
86% confidence
Finding
Environment-derived credentials and identity parameters flow directly into an external curl invocation that transmits authentication material to a remote service. Even absent shell injection, this is dangerous because secrets are operationalized in a subprocess context and may be exposed through process inspection, logs, or misuse of untrusted input values.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill requires sensitive capabilities including shell execution, network access, environment-variable handling, and file read/write, but it does not declare permissions or bound them explicitly. That makes the trust boundary opaque and increases the chance that an operator or user triggers actions they did not expect, especially when the workflow also handles credentials and local filesystem changes.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior exceeds the stated purpose of a simple CCE environment assessment by including source repository analysis, broader Huawei Cloud service interrogation, report generation side effects, and direct use of AK/SK to access APIs. This mismatch is dangerous because users may provide powerful credentials and approve the skill under a narrower understanding than what it actually does.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill goes beyond assessment by modifying the local environment: installing or upgrading tooling and deleting files in local directories. Those side effects can alter the host system and destroy prior outputs, which is risky in an analysis skill whose core purpose does not inherently require persistent local changes.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The instruction to use sudo on permission failures encourages privilege escalation without demonstrating that elevated rights are necessary for the assessment task. If followed, this can grant the skill broad system-level access, magnifying the impact of mistakes, malicious script behavior, or compromised dependencies.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The file is an expansive KooCLI installation and lifecycle guide, not a narrowly scoped CCE assessment reference. In an agent skill that is supposed to assess environments, bundling broad cloud CLI installation and management instructions increases the chance the agent or operator is led into unnecessary privileged setup and non-assessment actions, expanding attack surface and operational risk.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
Describing KooCLI as a tool for managing 100+ cloud services is broader than justified for a read-mostly assessment skill. That framing normalizes high-capability tooling and can encourage over-privileged credentials or use of commands outside the intended assessment scope.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The guide includes update, uninstall, and cache deletion operations that are unrelated to producing an assessment report. In an agent context, these destructive or modifying actions can be misused, accidentally executed, or copied by users, causing service disruption or loss of local configuration data.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill description focuses on CCE environment assessment, but the implementation also clones and scans source repositories. This scope expansion increases the attack surface, introduces unnecessary trust in external content, and may surprise users by collecting and persisting code-derived data.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script enumerates AOM, LTS, HSS, autoscaling, and other security/observability services beyond the core CCE assessment described in metadata. Broad cross-service access increases privilege requirements and the blast radius of misuse or compromise, especially in an autonomous agent context.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill asks the user to provide Huawei Cloud AK/SK and store them in environment variables without a clear warning about secret sensitivity, handling, retention, masking, or safer alternatives. This is dangerous because these credentials may grant broad cloud access, and insecure collection or storage can lead to account compromise.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The workflow directs deletion of historical files in data/ and artifacts/ without an explicit warning, preview, or confirmation for destructive action. This can lead to accidental loss of previous reports or unrelated files if directory assumptions are wrong or the skill is run in an unexpected working directory.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The guide recommends piping a downloaded remote installer into bash, including a non-interactive mode that skips confirmation, without integrity verification or a prominent risk warning. This creates a classic supply-chain and remote code execution risk: if the hosting location, transport path, or script contents are compromised, users may execute attacker-controlled code immediately.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The uninstallation and cleanup sections present irreversible deletion commands without explicit warnings about data loss, especially removal of binaries and local CLI configuration under ~/.hcloud. In an agent or copy-paste workflow, this can lead to accidental destruction of credentials, profiles, cached state, and tooling needed for recovery or auditing.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill clones a repository and writes it to local storage without clear disclosure or consent. In an agent environment, undisclosed filesystem modification and retention of third-party content are risky because they can leak data, consume resources, and violate user expectations.

Unpinned Dependencies

Low
Category
Supply Chain
Content
#   - make_report_html.py → 内联 SVG + CSS font-family，无 ReportLab，无 TTF 依赖

openpyxl>=3.0,<4
huaweicloudsdkcore>=3.1
Confidence
89% confidence
Finding
The dependency 'huaweicloudsdkcore>=3.1' is effectively unpinned on the upper bound, allowing future major or minor releases to be installed without review. In an assessment skill that interacts with Huawei Cloud APIs, this increases supply-chain and integrity risk because a compromised or breaking upstream release could alter authentication, request handling, or execution behavior during installation or runtime.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file
Confidence
95% confidence
Finding
The command rm -rf ~/.hcloud/ is a destructive filesystem operation that recursively deletes local CLI state, which may include profiles, cached tokens, and configuration required for access or forensic review. In an agent skill, inclusion of such a command materially raises the risk of harmful parameter or command abuse, especially if surfaced in automated workflows or copied without full understanding.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Content
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file
Confidence
90% confidence
Finding
The combination of non-interactive installation patterns and recursive deletion commands matches behavior associated with autonomous destructive actions in agent skills. While this appears to be documentation rather than overt malware, the skill context makes it dangerous because an assessment-oriented agent should not need to install, update, or destroy local CLI state automatically.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
references/koocli-installation-guide.md:212