huawei-cloud-dws-io-diag

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:40 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate Huawei Cloud DWS diagnostic skill, but it needs review because it uses local/cloud command execution, handles sensitive operational data, and writes reports without tight declared scoping or user control.

Install only in an environment where the agent is allowed to run local KooCLI/Python commands and access Huawei Cloud DWS operational telemetry. Treat generated reports as sensitive: they may include cluster details, node names/IPs, usernames, query IDs, and SQL snippets. Use least-privilege read-only IAM permissions, avoid entering AK/SK in chat or shell history, and prefer an explicit export path or no-file-output mode before using this skill on production data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs local Python execution to read configuration values from the filesystem. That exceeds the declared tool boundary and introduces local code-execution and file-read behavior that a skill consumer may not expect, creating an avenue for unauthorized access to local secrets or environment data if such behavior is generalized or copied elsewhere.

Scope Creep

High

• Confidence: 99% confidence
• Finding: The workflow declares only three allowed tools, but the body instructs use of local shell commands, Python execution, config-file reads, and later file writes. This capability mismatch breaks the security model for skills, because reviewers and runtime policy may trust the manifest while the instructions attempt actions outside it.

Scope Creep

High

• Confidence: 98% confidence
• Finding: The skill instructs saving an HTML report to the workspace even though no file-write permission is declared. Undeclared persistence can leak sensitive diagnostic data into shared storage, leave artifacts on disk, or violate operator expectations about a read-only diagnostic skill.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The skill causes a filesystem side effect by writing a report without warning or consent. Because diagnosis reports may contain cluster identifiers, node names, usernames, and SQL snippets, silent export increases the risk of sensitive operational data being retained or exposed unexpectedly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The reference examples explicitly instruct output of full SQL text, usernames, query IDs, and timestamps in diagnosis responses. Even if presented as examples, this normalizes disclosure of potentially sensitive operational and customer workload data to whoever can invoke or view the skill output, which can leak business logic, identifiers, and investigative metadata.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: These additional examples go beyond generic diagnosis and show per-user, per-query, and system-internal workload details without any warning, masking, or authorization boundary. In an operational skill, such examples can directly shape implementation and lead the agent to expose sensitive telemetry and identifiable activity in routine responses.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to place AK/SK in plaintext in a YAML file and pass them as CLI arguments before encryption occurs, but it does not warn about shell history, process-list exposure, file permission hardening, or prompt alternatives. In a security-sensitive cloud-operations skill, this creates a realistic secret-handling risk because credentials may be exposed locally before the advertised auto-encryption step runs.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The reset command is described as simply resetting configuration, but it also clears all parameters and removes crypt.json, which is a destructive action. Without a prominent warning or confirmation guidance, users may unintentionally erase configuration or key material, causing service disruption or loss of access to encrypted settings.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The examples specifically direct inclusion of user-specific SQL statements, usernames, query IDs, and timestamps in natural-language responses. That is a direct data exposure pattern: SQL may contain literals, schema details, file paths, and business logic, while usernames and timestamps enable user activity correlation and internal reconnaissance.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The top-contributor example instructs aggregation and disclosure of per-user and per-query activity, including IO volumes and recurrence across sampling windows. In context, this is more dangerous than a single example because it enables profiling of tenant behavior, workload attribution, and targeted reconnaissance across users and queries at cluster scope.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: This system-side example exposes an internal user identity and a specific SQL maintenance command in the response. Revealing internal account names and maintenance activity can aid attacker reconnaissance, clarify privileged workflows, and disclose internal operational patterns that should normally stay restricted.

VirusTotal

57/57 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.