huawei-cloud-codearts-code-gen

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:18 AM UTC
• Version: 1.0.0

Overview

This skill routes coding work through Huawei CodeArts but also persists cloud keys, runs remote installers, and grants broad local permissions, so it needs careful review before installation.

Install only if you intentionally want coding requests routed through Huawei CodeArts and are comfortable with the local setup changes. Use a narrowly scoped or temporary Huawei access key if possible, avoid saving secrets in plaintext shell or user environment files, inspect the remote installer source before execution, and restrict permissions to a specific workspace rather than allowing global access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly directs the agent to execute shell commands (`setup.sh`, permission scripts, `codearts run`) while declaring itself as a mandatory routing layer for code generation rather than transparently declaring those capabilities. Undeclared shell execution increases review blind spots and can lead to unexpected command execution in environments that rely on manifest permissions for trust decisions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents the skill as a simple mandatory code-generation entry point, but the body performs much more sensitive actions: downloading/installing software, collecting credentials, modifying shell startup files, changing permission configuration, and contacting external services. This mismatch can mislead operators and agents into invoking a privileged workflow without understanding that it alters the local environment and handles secrets.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest frames the skill as routing code-generation requests, but the documented workflow expands into credential collection and local permission reconfiguration. That discrepancy matters because users and orchestrators may consent to a coding helper without realizing it will request cloud secrets and change local authorization state.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill instructs the agent to store Huawei AK/SK credentials in plaintext in `~/.bashrc`, which creates durable exposure of sensitive secrets to local users, processes, shell history mishandling, backups, and later compromise of the host. Persisting cloud credentials in a startup file is far broader and riskier than necessary for a code-generation workflow.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill directs modification of local permission configuration and workspace write authorization even though its stated purpose is merely to route code-generation requests. Hidden or underexplained permission reconfiguration expands the blast radius if the external CLI or generated actions behave unexpectedly or maliciously.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script advertises that it only configures file write permissions for code generation, but it actually grants a much broader set of capabilities including web search, external directory read, and command allowlisting. This mismatch is dangerous because users or calling agents may consent under a narrower understanding, resulting in over-privileged execution and unintended data access or network activity.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The safety-oriented comment is misleading because the code enables multiple unrelated permissions and broad allow rules, creating a documentation-to-behavior mismatch. In a skill that is described as a mandatory entry point for all code generation, such misrepresentation increases risk because downstream systems may trust and auto-invoke it, amplifying the effect of excessive permissions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The global configuration grants capabilities beyond basic file writing, notably websearch and external_directory_read, with wildcard scope. These permissions can expand data exposure and allow broader environment discovery than users would reasonably expect from a permission-setup script for local code generation.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The user-facing guidance claims the AK/SK will be stored only in the local AI Shell environment and later automatically released, but the script also persists them to Windows user environment variables via SetEnvironmentVariable(..., 'User'). This mismatch can mislead users about credential lifetime and exposure, increasing the chance that long-lived cloud credentials remain on disk and are accessible to other local processes or future sessions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The script presents 'Write code directly' as an error-recovery option even though the skill metadata says all code generation must be routed through this skill. In an agentic environment, this creates a policy bypass path that could let the agent skip the intended control boundary, undermining auditing, safety checks, and any centralized restrictions enforced by CodeArts.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The script tells users that AK/SK will only exist in local environment variables and can be released automatically, but elsewhere it offers to persist them into ~/.bashrc. That contradiction can mislead users into providing long-lived cloud credentials without understanding they will be stored on disk and reloaded in future shells, increasing the chance of credential theft or misuse.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation triggers are extremely broad, covering essentially any request related to code, files, modules, projects, features, or even mention of CodeArts. This can cause unintended activation of a sensitive workflow that installs software, requests credentials, and contacts external services when a user may have expected a simple local response.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The mandatory invocation rules use ambiguous patterns like 'write code' or 'implement a feature' with no clear boundaries, while instructing the agent to stop all other work and run setup first. Because the workflow includes installation and secret handling, this ambiguity increases the chance of coerced or unnecessary execution of sensitive actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script saves cloud AK/SK credentials into persistent user environment variables without an explicit warning at the save point about persistence, local exposure, and cleanup. Because these are sensitive long-lived credentials, silently persisting them increases the risk of credential theft by other local software, accidental reuse, or disclosure through diagnostics and process environments.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script downloads PowerShell code from a remote URL and executes it with Invoke-Expression, which is a classic remote code execution pattern. If the download source, transport, hosting bucket, DNS, or trust chain is compromised, arbitrary code would run in the user's context during setup, and the skill context makes this more dangerous because the install is automatic and positioned as the mandatory path for code generation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script writes cloud access keys directly into ~/.bashrc, creating long-lived plaintext credentials in a common startup file. Any local process, backup system, shell history workflow, or accidental file disclosure could expose these secrets and enable unauthorized cloud access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script downloads a remote installer and pipes it directly to sh, which gives the remote content immediate code execution on the host. If the download source, hosting bucket, DNS path, TLS trust chain, or network is compromised, an attacker can run arbitrary commands in the agent environment.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the agent to solicit cloud credentials and persist them in plaintext for reuse, which is a direct secret-handling anti-pattern. If the host, logs, backups, shell files, or later commands are exposed, those long-lived credentials can be stolen and used to access or spend against the user's cloud account.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The example workflow has the agent capture user-entered secret keys and pass them on the command line to `setup.sh --save-aksk`, which can expose secrets via process listings, audit logs, shell tracing, telemetry, or wrapper tooling. Command-line secret passing is especially dangerous in multi-user or monitored environments.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: Reloading previously stored credentials from `~/.bashrc` normalizes reuse of long-lived secrets and broadens their lifetime beyond a single task. This increases the chance that unrelated shells, tools, or future sessions inherit cloud credentials unintentionally.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **Do not offer alternatives prematurely**:
   On `need_input` (AK/SK required) or `need_consent` (permission authorization required),
   directly request the needed input or consent from the user.
   Do NOT offer alternatives like "or I can just write the code directly".

2. **Only offer alternatives after repeated errors**:
   Only after encountering `error` status (exit code 30/40/50) AND retrying multiple times

• Confidence: 78% confidence
• Finding: The workflow encourages persistent session/setup state and restricts the agent from offering safer alternatives until repeated failures, effectively steering users into a sticky external-tool path. In context, this persistence becomes more dangerous because it is tied to stored credentials and lasting permission changes, increasing residual risk after the immediate task ends.

External Script Fetching

High

• Category: Supply Chain

Content

case "$OS" in
        Linux|macOS)
            if ! command -v curl >/dev/null 2>&1 && ! command -v wget >/dev/null 2>&1; then
                output_error 30 "dependency_missing" \
                    "curl or wget is required to download the install script" \
                    "Install curl: apt install curl or yum install curl"

• Confidence: 99% confidence
• Finding: Even though this duplicate finding highlights the wget/curl dependency branch, it refers to the same unsafe pattern: network retrieval of executable installer content that is later run locally. That exposes the environment to supply-chain compromise and remote code execution.

External Script Fetching

High

• Category: Supply Chain

Content

case "$OS" in
        Linux|macOS)
            if ! command -v curl >/dev/null 2>&1 && ! command -v wget >/dev/null 2>&1; then
                output_error 30 "dependency_missing" \
                    "curl or wget is required to download the install script" \
                    "Install curl: apt install curl or yum install curl"

• Confidence: 99% confidence
• Finding: Even though this duplicate finding highlights the wget/curl dependency branch, it refers to the same unsafe pattern: network retrieval of executable installer content that is later run locally. That exposes the environment to supply-chain compromise and remote code execution.

Static analysis

No suspicious patterns detected.