huawei-cloud-cli-guidance

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:20 AM UTC
• Version: 1.0.0

Overview

This Huawei Cloud CLI skill is mostly coherent, but it needs review because it can guide broad cloud changes, credential handling, unsafe SSH access, and destructive cleanup with insufficient guardrails.

Install only if you specifically need Huawei Cloud KooCLI help and are comfortable reviewing every generated command before it runs. Use least-privilege IAM profiles, avoid sharing AK/SK or debug/raw logs, restrict security group CIDRs, verify resource IDs and backups before deletion or resizing, and do not use the SSH password examples as-is in production.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (18)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This section goes beyond Huawei Cloud CLI guidance by instructing password-based SSH access, disabling host key checking, and running broad host-level diagnostic commands on remote instances. In a skill meant to guide cloud CLI operations, this expands the action scope into remote administration and normalizes insecure access practices that can expose credentials and enable unsafe remote execution.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The disk expansion workflow includes direct remote OS modification commands such as growpart and filesystem resizing over SSH, which is outside the stated scope of a CLI-guidance skill. These commands can damage partitions or filesystems if applied incorrectly, and the example encourages remote root access with password authentication rather than safer managed or documented procedures.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger list includes extremely broad terms such as "cloud-related services," "命令行," "云," and especially "工具," which can cause the skill to activate in many unrelated contexts. Over-broad activation increases the chance that this skill will intercept prompts outside Huawei Cloud CLI workflows and steer users into credential handling, shell execution, or cloud-operation guidance they did not intend.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to prioritize this document and to read and fully use it in its entirety, reducing flexibility and discouraging context-sensitive judgment. In a security-sensitive domain involving cloud credentials and resource operations, forced adherence can override safer handling, user preference, or more restrictive higher-level controls during execution guidance.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill recommends enabling `--cli-debug=true` as a first troubleshooting step without warning that debug output may reveal request metadata, endpoints, headers, signed requests, or other authentication-related details. In a cloud CLI context, this can lead to accidental exposure of sensitive operational or credential-adjacent information in agent-visible logs or user-facing output.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document includes a destructive deletion example (`hcloud ECS DeleteServers`) without any adjacent warning, confirmation guidance, or emphasis on validating target IDs. In a cloud operations skill, users may copy and run commands directly, so omission of caution increases the risk of accidental production resource deletion.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guidance tells users to enable `--cli-debug=true` and `--cli-output=raw` but does not warn that debug logs and raw HTTP request/response output may expose sensitive data such as access keys, tokens, request payloads, resource identifiers, and internal endpoints. In troubleshooting contexts, users frequently share logs with teammates or support, making unintended credential or data leakage plausible.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The troubleshooting process instructs users to enable debug mode, inspect raw requests, and collect debug logs for support without warning about sensitive authentication and request data in those artifacts. Because this skill is specifically for cloud CLI operations, the likelihood that logs contain privileged access information is higher than in generic documentation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The cleanup workflow performs irreversible deletion of instances, public IPs, volumes, subnets, and VPCs without an explicit warning, confirmation step, or emphasis on backup verification. In an agent skill, this can lead users to execute destructive commands too casually, increasing the risk of accidental service loss and data destruction.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document includes destructive commands for deleting cloud resources and associated public IPs/volumes without any cautionary note, confirmation pattern, or emphasis on irreversible impact. In an agent skill meant to guide terminal cloud operations, this increases the risk of accidental destructive actions and data loss by users who may copy commands directly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The security group rule example allows SSH from 0.0.0.0/0, which exposes management access to the entire internet. In a cloud CLI guidance skill, users may reuse this exact command, creating broad attack surface for brute force attacks, credential abuse, and unauthorized remote access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guidance recommends enabling CLI debug mode and notes that request/response details will be shown, but does not warn that these logs can contain sensitive metadata, request headers, identifiers, or even credential-related material depending on tooling behavior. In operational environments, users may paste debug output into tickets, chats, or logs, causing secondary exposure of secrets or infrastructure details.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document includes a batch deletion example for ECS instances with `--delete_publicip=true` and `--delete_volume=true` but does not warn that these actions can permanently remove associated resources and data. In a guidance skill for cloud CLI operations, users may copy-paste examples directly, so omission of an explicit irreversible-action warning materially increases the risk of accidental destructive operations.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The file includes destructive and state-changing commands such as instance creation, deletion, reboot, and remote console access without any warning, confirmation guidance, or safe-use framing. In a skill meant to guide terminal operations across cloud services, this can normalize risky commands and increase the chance that users or downstream agents run irreversible actions against production resources.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Network security group rule changes and public IP association/deletion commands can directly expose services to the internet, break segmentation, or remove connectivity. Presenting these commands without warnings or least-privilege guidance is dangerous in this skill context because users may treat them as routine copy-paste operations and unintentionally open attack surface or disrupt production traffic.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Storage attachment/extension and database provisioning commands can alter capacity, cost, system topology, and data handling, and in some cases may create data loss or service disruption if misapplied. Because this skill is positioned as operational guidance for cloud terminal use, omission of any warning or impact note makes accidental misuse more likely.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file

• Confidence: 86% confidence
• Finding: The instruction `rm -rf ~/.hcloud/` recursively deletes the user's Huawei CLI configuration directory, which may contain credentials, profiles, history, and other local state. In an agent skill context, destructive shell snippets are more dangerous because an automated system or user may copy them blindly, causing irreversible loss of configuration and possible credential disruption.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match

Content

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file

• Confidence: 89% confidence
• Finding: The YARA match is justified because the document contains autonomous-style destructive filesystem actions such as `rm -rf ~/.hcloud/` and a non-interactive installer mode. Although the apparent purpose is legitimate uninstall/maintenance guidance, these patterns are risky in an agent skill because they normalize irreversible commands that could be emitted or followed without sufficient user confirmation.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.exposed_secret_literal

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/installation-guide.md:212

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/core-commands.md:254