Security audit

huawei-cloud-dws-cpu-diag

Security checks across malware telemetry and agentic risk

Overview

The skill mostly performs DWS CPU diagnosis, but it includes unrelated OBS/obsutil credential setup and writes potentially sensitive diagnostic reports to disk.

Review before installing. Use this only for DWS CPU diagnosis with a least-privilege DWS IAM identity. Do not configure obsutil or OBS credentials unless the publisher separately justifies why object storage is required. Avoid putting AK/SK values on command lines, protect any MCP config files, and delete or secure generated HTML reports because they may contain operational data and SQL text.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill documentation states that output should only be the diagnosis report, but it also instructs the agent to save an HTML file into the workspace. That creates an undeclared side effect: local file creation on the host environment. In agent settings where workspace contents may persist, sync, or be visible to other processes, this can expose operational data without explicit user awareness or consent.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill promises a report-only output model, but later requires writing that report to disk. This mismatch weakens user and platform expectations about side effects and can cause sensitive diagnostic content to be stored locally when the operator expects only transient output. The issue is primarily unsafe transparency and consent rather than code execution.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The file is materially inconsistent with the declared skill purpose: it is an OBS object storage tooling installation and credential guide embedded in a DWS CPU diagnosis skill. This can mislead users into installing unrelated tooling and configuring storage credentials, expanding the skill’s access surface beyond what is necessary and potentially enabling unnecessary credential collection or misuse.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Requiring obsutil and OBS credentials is not justified by the stated purpose of diagnosing high CPU in a DWS cluster. In this skill context, unrelated storage access is more dangerous because operators may grant AK/SK with broad object-storage permissions to a troubleshooting workflow that should not need them.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to save an HTML report in the current working directory without warning the user about the local file write. That is a real safety issue because diagnostic reports can contain cluster identifiers, host names, IPs, usernames, query text, and workload details, all of which may remain on disk beyond the session. The danger increases in shared workspaces or environments with artifact collection and log shipping.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The obsutil example places AK/SK directly on the command line, which can expose secrets through shell history, process listings, logging, and terminal recording. This is especially risky in an operational troubleshooting skill, where commands are likely to be copied verbatim by administrators on shared bastions or monitored hosts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation explicitly instructs users to place AK/SK credentials in plaintext in a YAML file and on the CLI before encryption occurs, without a prominent warning about secure handling, shell history exposure, file permissions, or secret leakage through screenshots/logs. In the context of an MCP server that grants access to cloud monitoring and host data, exposing these credentials could enable unauthorized API access and broader compromise of cloud resources permitted by the key.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.