huawei-cloud-ecs-alert

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:10 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent Huawei Cloud alarm automation, but it combines broad cloud permissions, credential handling guidance, unverified install guidance, and alert-silencing notification actions that deserve manual review.

Install only for users who intentionally want an agent to manage Huawei Cloud ECS/CES alarms. Use a least-privilege IAM policy instead of broad FullAccess where possible, prefer temporary credentials, avoid pasting AK/SK into chat or shell history, verify any downloaded installer before running it, and require explicit confirmation before creating, updating, removing, or deleting notification paths.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly invokes shell scripts and relies on environment-based credentials, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: a caller or platform may underestimate the skill's ability to execute commands or access secrets, increasing the risk of unintended shell execution or credential exposure through surrounding orchestration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented behavior extends beyond the declared purpose by including environment/credential validation, broader resource inventory, and independent SMN subscription management including deletion. This mismatch can mislead users and policy engines about the skill's actual operational scope, enabling broader cloud-side changes than expected and increasing the chance of accidental or unauthorized modifications.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script enumerates SMN topics and subscriptions, which expands the skill from ECS/CES alarm management into direct notification-resource discovery. Even though the operations are read-only, they can expose internal notification endpoints, topic names, and monitoring topology that are not clearly required by the declared skill scope, creating an information-disclosure and over-privilege concern.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The code directly queries SMN resources without a clear functional tie to creating or listing ECS/CES alarms, which indicates unnecessary capability. In a shared or agent-driven environment, this can enable broader cloud inventory discovery than users may expect, exposing email/SMS/webhook endpoints and related metadata.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to match generic monitoring or alert-related requests, which can cause the skill to activate in situations where the user did not intend Huawei Cloud alarm management. In a skill with write capabilities, accidental invocation raises the risk of unintended cloud changes, especially when combined with create/update/delete flows.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document shows commands for setting long-lived access keys directly on the CLI without any warning about shell history, process listing exposure, or persistent local credential storage. In a cloud administration skill, this increases the chance operators paste sensitive AK/SK values into insecure environments, leading to credential theft and full API misuse within the granted Huawei Cloud account scope.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions download and execute a remote shell script in one flow without verification guidance, integrity checks, or a warning that this grants arbitrary code execution. In an infrastructure automation skill used by administrators, compromise of the distribution URL, DNS, TLS trust chain, or storage backend could result in immediate execution of attacker-controlled code on the operator's machine.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation recommends broad IAM grants such as CES FullAccess and SMN FullAccess as baseline requirements, without emphasizing least privilege, scoping limits, or the risks of granting administrative access to notification resources. In an automation skill that manages alarms and notification channels, these permissions could be unnecessarily propagated to operators or service accounts, increasing blast radius if the account is misused or compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The troubleshooting guidance tells users to pass AK/SK directly on the command line without warning that secrets may be exposed in shell history, process listings, terminal logs, or persisted CLI configuration. In a cloud administration skill, these credentials can grant broad access to Huawei Cloud resources, so accidental disclosure could lead to account compromise or unauthorized infrastructure actions.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Function**: Unsubscribe endpoint from topic

**API**: `DELETE /v2/{project_id}/notifications/topics/{topic_urn}/subscriptions/{subscription_urn}`

**hcloud Command**:

• Confidence: 88% confidence
• Finding: The documented presence of an unsubscribe operation exposes a destructive notification-management action that could be abused to silently disable alarm delivery. In the context of an ECS alert automation skill, removing subscriptions can suppress operational or security alerts, reducing visibility into incidents and enabling persistence or delayed detection if invoked without strict user intent validation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/common-commands.md:76