Security audit

huawei-cloud-dns-managemengt

Security checks across malware telemetry and agentic risk

Overview

This is a real Huawei Cloud DNS management skill, but it can change live DNS and has under-scoped safety, privacy, and install controls.

Review this before installing if it will touch production DNS. Use a dedicated least-privilege Huawei Cloud IAM user, prefer hcloud configure over environment secrets, test only in non-production zones first, require explicit human approval for create/update/delete/failover operations, avoid the pipe-to-bash installer unless you independently verify it, and be aware that validation and audit logs may expose domain and infrastructure details.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly drives shell scripts and cloud CLI operations that can modify production DNS, yet it declares no explicit permissions or safety boundaries. This creates an authorization and transparency gap where an agent may invoke powerful shell-backed actions without the metadata needed for proper policy enforcement or user review.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The function `run_hcloud_service()` exposes a generic wrapper capable of invoking arbitrary Huawei Cloud services and operations, not just DNS. In a skill advertised and scoped for DNS management, this creates unnecessary privilege expansion and enables callers to repurpose the skill for unrelated cloud actions if the configured credentials are broad. The danger is increased because the wrapper automatically injects authentication and region settings, making cross-service abuse easy once the skill is available.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This DNS skill includes unjustified generic cross-service cloud API execution capability, which breaks the principle of least functionality. Even if intended for convenience, exposing arbitrary service invocation broadens the attack surface and can let a user or chained agent perform non-DNS actions such as IAM, compute, or storage operations using the same credentials. In the context of an automation skill, that mismatch between claimed scope and actual capability makes abuse materially more dangerous.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The script falls back to querying https://dns.google/resolve via curl, which sends user-supplied domains to a third-party resolver outside the stated Huawei Cloud workflow. This creates an unintended data disclosure path and changes trust boundaries during validation, especially for internal, sensitive, or pre-production hostnames.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger list contains broad phrases like 'DNS management', 'domain resolution', and multilingual variants that could match routine informational requests rather than intentional change requests. In an agent setting, overbroad triggers increase the chance this skill is selected unexpectedly and leads to sensitive DNS enumeration or modification workflows being proposed or executed out of context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises deletion, failover, traffic switching, and batch update operations without mandatory warning or confirmation language, even though such changes can immediately disrupt routing, cause outages, or break verification and mail flows. Because DNS is a control plane for many services, accidental or rushed execution can have broad operational impact.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The guide instructs users to pipe a remotely fetched installer script directly into bash, which executes unreviewed code from the network with no integrity verification, signature check, or pinned version. If the hosting bucket, network path, or DNS resolution is compromised, users could run arbitrary code on their systems immediately.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The troubleshooting section repeats the same unsafe remote-script execution pattern, reinforcing insecure behavior at the point where users are likely to copy-paste commands under pressure. This increases the chance of arbitrary code execution if the remote source or transport is tampered with.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The guide provides direct public DNS create/update commands that can immediately alter production traffic behavior, but it does not place a clear safety warning, approval gate, or verification step adjacent to those operations. In a DNS management skill, this omission increases the chance of accidental or unsafe changes that could redirect users, break service availability, or cause unintended cutovers.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The private DNS create, update, and delete examples modify internal name resolution but are presented without prominent warnings about operational impact. This can lead operators to make internal routing changes or deletions without understanding that they may break service-to-service communication, failover behavior, or access to internal applications.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document instructs users to create, update, delete, and batch-modify live DNS records, including failover and traffic-switching actions, but does not prominently warn about the operational risk to production traffic, service availability, or rollback requirements. In a DNS-management skill, these actions are expected functionality, but presenting them as routine verification steps without safety guardrails increases the chance of accidental outages or misrouting.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The API connectivity check uses an authenticated cloud CLI command against the user's account and region without warning that credentials will be used, that account metadata may be disclosed in output, or that the command may be logged in shell history or CI systems. While the command is read-only, the lack of credential/privacy notice can lead to unintended exposure of cloud environment details.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script persists DNS audit entries, including free-form operation details, region, and username, to local disk by default without any minimization, masking, retention control, or permission hardening visible in this file. In the context of DNS management, the detail field can easily contain sensitive infrastructure information such as internal hostnames, target IPs, failover actions, or deployment changes, which could aid reconnaissance if logs are exposed.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The delete path performs a live DNS record-set deletion immediately after locating the recordset ID, with no interactive confirmation, dry-run mode, safeguard flag, or policy check. In a DNS management skill whose stated purpose includes failover and traffic switching, an accidental invocation or prompt-driven misuse can directly disrupt domain resolution and availability for production services.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The DoH fallback silently transmits queried domains to Google's resolver without explicit user notice in the script description or runtime prompt. Even if used only as a fallback, this can leak private infrastructure names, tenant information, or operational activity to an external service.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.