Security audit

huawei-cloud-dws-mem-diag

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent read-only DWS diagnosis helper, but it persists potentially sensitive reports locally and includes unsafe cloud-secret setup examples that need review before installation.

Install only if you are comfortable giving the skill read-only access to DWS monitoring data and storing generated diagnosis reports in the workspace. Prefer the interactive or environment-variable credential setup, avoid command-line AK/SK examples, use least-privilege IAM keys, and treat generated HTML reports as sensitive operational artifacts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill claims to produce a diagnosis report, but Step 7 also instructs writing an HTML file into the local workspace. That introduces a side effect beyond the stated read/analyze purpose and can surprise the operator or downstream system with persistent artifacts. In an agent context, undocumented file writes can become a stepping stone for data retention, workspace pollution, or unintended disclosure if the workspace is shared or later exfiltrated.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The workflow adds local filesystem write capability even though the skill's stated purpose is diagnosis and report generation. Unnecessary write actions violate least privilege and expand the agent's operational footprint, creating risk of unauthorized persistence or accidental overwriting in the workspace. The danger is increased because the write is mandatory and automatic, not conditional on explicit operator approval.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs saving an HTML report to the workspace without a user-facing warning or consent step. Silent persistence is risky in agent systems because users may assume the result is transient while sensitive operational data is actually stored locally. Given this skill processes cluster diagnostics, the report may contain infrastructure identifiers, hostnames, queries, or memory details that should not be written by default.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The guide explicitly instructs users to place AK/SK secrets in plaintext in a configuration file before encryption occurs on startup. This creates a real exposure window: secrets may be written to disk unencrypted, captured by backups, editors, shell history, or source control before the server has a chance to auto-encrypt them. In a diagnostic skill that requires cloud credentials, this is more dangerous because the skill is intended for operational use and may be followed by less security-conscious operators under incident pressure.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The CLI example passes AK and SK as command-line arguments, which can be exposed through shell history, process listings, audit logs, CI logs, and monitoring tools. This is a stronger and more direct credential leakage vector than a plaintext config file, and in a cloud operations context compromised AK/SK could enable unauthorized API access to DWS and potentially broader cloud resources tied to those credentials.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.