huawei-cloud-cci-instance-management

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:25 AM UTC
• Version: 1.0.0

Overview

This Huawei Cloud CCI administration skill is mostly purpose-aligned, but it needs review because it includes high-impact cloud operations and a helper script with a concrete command-injection weakness.

Install only if you intend to let the agent administer Huawei Cloud CCI resources. Use a least-privilege temporary credential, avoid broad CCI FullAccess unless necessary, require explicit confirmation before deletes, and do not use the helper with untrusted region values until the shell=True command construction is fixed. Treat logs, events, EIP details, Secrets, RBAC operations, and pod exec as sensitive/high-impact actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import subprocess
    try:
        cmd = f"hcloud IAM KeystoneListProjects --cli-region={region} --cli-output=json"
        result = subprocess.run(
            cmd, capture_output=True, timeout=15,
            encoding="utf-8", errors="replace", shell=True,
        )

• Confidence: 98% confidence
• Finding: The script builds a shell command using the untrusted --region argument and executes it with shell=True. An attacker who can control region can inject additional shell metacharacters and execute arbitrary local commands in the environment running the skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs use of shell commands, environment variables, and networked cloud operations, yet no explicit permissions are declared. That creates a governance gap where high-impact capabilities are available without transparent permission scoping, increasing the chance of accidental or overly broad execution in an agent environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill is described as operating via hcloud CLI, but it also relies on a Python helper making direct signed OpenAPI calls and on separate credential sources for that helper. This mismatch is dangerous because reviewers or users may underestimate what code paths run, what credentials are consumed, and what cloud actions can occur outside the expected CLI boundary.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The catalog exposes materially broader capabilities than the skill’s declared purpose of CCI instance lifecycle management, including RBAC, secret handling, API discovery, networking exposure, and batch/job control. In an agent skill, documenting and enabling unnecessary capabilities expands the attack surface and can let prompt-injected or mis-scoped workflows pivot from routine container operations into privilege, credential, or cluster-control actions.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Pod exec enables interactive command execution inside running containers, which is substantially more powerful than ordinary lifecycle management and can be abused for lateral movement, data access, tampering, or running arbitrary commands in workloads. Because this skill is intended for container instance operations, including exec makes misuse far more dangerous if an attacker can influence the agent’s action selection.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: RBAC management allows modification of role bindings and visibility into cluster roles, which can directly grant or expand privileges beyond normal workload management. This is outside the declared CCI instance-management scope and creates a clear privilege-escalation pathway if the skill is abused or incorrectly authorized.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Secret management exposes sensitive credential-bearing resources and allows reading, replacing, or deleting them, which can lead to credential disclosure, service compromise, and operational outages. Since secret administration is not justified by the stated lifecycle-management purpose, its presence represents unnecessary high-risk capability.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger list includes generic infrastructure terms like namespace, deployment, statefulset, and pod, which are broad enough to match unrelated user requests. In an operational cloud-management skill with destructive capabilities, over-broad invocation increases the risk of accidental activation and unintended command generation against live resources.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The catalog lists many destructive and collection-wide deletion operations without embedded warnings, guardrails, or indication of irreversible impact. In an agent setting, omission of safety cues around namespace, workload, and secret deletion increases the chance of accidental or prompt-induced destructive actions affecting broad sets of resources.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The cleanup workflow contains bulk and cascading deletion commands, including namespace deletion that removes all contained resources, but the workflow section itself does not begin with a strong upfront safety warning or explicit confirmation gate. In an agent skill that may be followed step-by-step, this increases the chance of accidental destructive actions, especially because the file even highlights direct namespace deletion as the 'simplest cleanup approach.'

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly show how to auto-create public IP resources for Pods, but they do not warn the operator about two important consequences at the point of creation: ongoing billable resource provisioning and immediate external network exposure. In an infrastructure-management skill, omission of these warnings can lead users to unintentionally create internet-reachable workloads and incur unexpected charges, especially because Option A provisions EIPs automatically rather than attaching existing vetted resources.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The log and event query examples encourage retrieval of pod logs and namespace events without warning that these outputs often contain secrets, tokens, personal data, internal URLs, stack traces, and other sensitive operational details. In an infrastructure-management skill, normalizing unrestricted log viewing increases the chance of accidental data exposure through terminal history, copied output, shared transcripts, or downstream LLM context.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The EIPPool status section notes that specific IP assignments are shown but does not warn that these details can reveal internal infrastructure topology, public exposure, and resource allocation patterns. While less severe than raw logs, this still creates an information disclosure risk if operators share command output broadly or feed it into external systems.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The delete path performs a destructive network deletion immediately with no interactive confirmation, dry-run mode, or explicit safety gate. In an agent skill context, this increases the chance of accidental or prompt-induced destructive actions against live cloud resources.

Unvalidated Output Injection

High

• Category: Output Handling

Content

import subprocess
    try:
        cmd = f"hcloud IAM KeystoneListProjects --cli-region={region} --cli-output=json"
        result = subprocess.run(
            cmd, capture_output=True, timeout=15,
            encoding="utf-8", errors="replace", shell=True,
        )

• Confidence: 97% confidence
• Finding: The shell command incorporates untrusted input into a command string, enabling command injection through the region parameter. This is especially dangerous in an automation/agent setting because user-supplied parameters may be less scrutinized and executed in privileged environments.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

import subprocess
    try:
        cmd = f"hcloud IAM KeystoneListProjects --cli-region={region} --cli-output=json"
        result = subprocess.run(
            cmd, capture_output=True, timeout=15,
            encoding="utf-8", errors="replace", shell=True,
        )

• Confidence: 97% confidence
• Finding: This is a true tool-parameter abuse issue because a user-controlled parameter is forwarded into a local tool invocation through the shell. Exploitation can lead to arbitrary command execution, credential theft, filesystem access, or pivoting from the agent host.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.