ClawHub
Back to skill

Security audit

huawei-cloud-cce-list

Security checks across malware telemetry and agentic risk

Overview

This read-only Huawei CCE inventory skill is mostly coherent, but its detail mode and triggers exceed the stated cluster-list-only boundary.

Install only if you are comfortable exposing CCE cluster inventory to the agent. Use the fine-grained cce:cluster:list policy, avoid the broader CCE ReadOnlyAccess policy unless needed, and do not use --detail=true unless node/addon details are intentionally in scope. Treat very short or ambiguous prompts as needing confirmation before running cloud queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill claims it only lists cluster metadata and does not query other resources, but the documented `--detail=true` mode broadens scope to include node/addon detail. This kind of scope expansion is dangerous because users and orchestrators may trust the manifest's narrow read-only boundary while the skill can retrieve additional potentially sensitive infrastructure information.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The capability-boundary section explicitly says the skill does not query nodes or addons, yet later instructions tell operators how to request detail mode that includes exactly that information. This inconsistency can mislead downstream agents, reviewers, or users into approving broader data access than intended, increasing the risk of unauthorized infrastructure enumeration.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The report documents trigger phrases such as "list cce", "cce list", and "how many CCE clusters," which are broad enough to match casual user language and may cause the skill to be invoked when the user did not explicitly intend to access cloud inventory data. In a cloud environment, unintended invocation can expose cluster metadata such as names, IDs, status, version, and flavor to a conversation path that did not require infrastructure disclosure.

Vague Triggers

High
Confidence
96% confidence
Finding
The archive shows multiple negative test cases marked as successful trigger matches, including requests to create a CCE cluster, query node lists, and use invalid regions or credentials. This indicates the skill’s activation phrases are too broad and can cause the skill to run outside its documented read-only scope, potentially routing unrelated or more sensitive cloud operations into the wrong capability.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.