huawei-cloud-ecs-sqlbot-deploy

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:26 AM UTC
• Version: 1.0.0

Overview

The skill broadly matches its SQLBot-on-Huawei-Cloud purpose, but it uses risky defaults that can expose passwords, run unverified remote code, and create billable cloud resources before clear user control.

Review this skill before installing. Use only temporary, least-privilege Huawei Cloud credentials in a disposable project, avoid passing AK/SK on the command line, disable Feishu notifications or ensure they never carry secrets, restrict security group ingress to trusted IPs, inspect or pin the remote SQLBot install script, and change both the ECS and SQLBot default passwords immediately. Expect billable cloud resources to be created.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (31)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'-i', 'https://repo.huaweicloud.com/repository/pypi/simple'
            ] + modules_to_install
            
            result = subprocess.run(
                pip_cmd,
                capture_output=True,
                text=True,

• Confidence: 84% confidence
• Finding: The code automatically invokes pip to install packages and uses '--break-system-packages', which changes the host environment and can undermine system package integrity. In a deployment skill, this creates a risky supply-chain and host-modification behavior, especially if run with elevated privileges or in shared environments.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill declares no permissions while its documented behavior requires access to environment variables, local files, shell execution, package installation, and network/cloud APIs. This under-declaration is dangerous because it obscures the true privilege and execution surface, preventing reviewers and users from making informed trust decisions about a skill that can create cloud resources and handle credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose understates several high-risk behaviors: automatic dependency installation, remote script retrieval/execution, automatic VPC/subnet creation, Feishu notifications, and disclosure of generated credentials. In this cloud-deployment context, hidden or weakly disclosed behavior can lead to supply-chain compromise, unauthorized infrastructure changes, and leakage of administrative secrets to logs or third-party messaging channels.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The presence of a notify-user-id parameter introduces an out-of-band data egress path unrelated to the core deployment goal. In a skill that handles cloud credentials, instance details, and generated passwords, notification hooks increase the risk that sensitive operational data is transmitted to unintended recipients or external systems.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document claims there are no hardcoded credentials while also embedding a default SQLBot login and credential-like AK/SK examples in the same acceptance material. Even if the AK/SK strings are placeholders, this normalizes insecure secret handling and creates contradictory guidance that can lead operators to leave real credentials or default passwords in place.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script sends the server's initial password in a Feishu progress notification, transmitting plaintext credentials over an auxiliary channel unrelated to the minimum deployment action. Anyone with access to the recipient account, message history, notification logs, or downstream integrations could obtain privileged instance access.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The code automatically creates a VPC and subnet when none exist, expanding its behavior from deploying an ECS-hosted application into provisioning additional network infrastructure. In an automation skill, this can cause unexpected resource creation, extra cost, and policy violations if users did not explicitly consent to network changes.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The skill includes standalone helpers to create arbitrary VPCs and subnets, which are broader infrastructure capabilities than the stated one-click SQLBot deployment purpose. While likely intended for convenience, this increases blast radius because compromised inputs or mistaken execution can modify cloud networking beyond the minimum needed for app deployment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The utility code can send deployment status messages through an external Feishu/openclaw channel, which is outside the core need of provisioning and deploying SQLBot. This increases the attack surface and introduces a data exfiltration path for operational details, especially because message content is assembled from runtime state and sent off-host.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The dependency checker goes beyond verification and installs software onto the host, which is a privileged side effect not essential to the skill's primary deployment logic. In the context of an agent skill, silent package installation expands trust assumptions and creates supply-chain and environment-tampering risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to provide AK/SK directly when environment variables are unavailable, despite those being long-lived or privileged secrets. In this context, encouraging credential entry into chat or conversational interfaces materially increases the chance of accidental exposure through logs, transcripts, screenshots, or downstream tooling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Passing AK/SK on the command line is risky because command-line arguments may be exposed via shell history, process listings, CI logs, or audit tooling. In a cloud deployment skill, this increases the chance of credential leakage and subsequent unauthorized access to Huawei Cloud resources.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Requiring port 8000 to be open to all IPs exposes the SQLBot service directly to the public internet without any compensating controls noted in the acceptance criteria. Because the same document also references a known default admin credential, the public exposure materially raises the risk of scanning, brute force attacks, and unauthorized access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Including a default admin credential in acceptance criteria encourages deployments to ship with a predictable password and treats successful login with that password as a sign of correctness. In an internet-facing deployment workflow, this is especially dangerous because attackers routinely test default credentials immediately after discovering exposed services.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs users to download and execute a remote shell script directly via curl and bash without any integrity verification, signature check, pinning to a specific version, or warning about the trust implications. If the hosting location, network path, or script content is compromised, users could execute arbitrary code on their systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document recommends attaching broad preset policies such as ECS FullAccess, VPC FullAccess, and EIP FullAccess for a deployment task that only requires a narrower set of create/read/bind operations. Even though the file later shows a least-privilege custom policy, presenting FullAccess as a primary configuration path without a prominent warning increases the chance users will overprovision IAM and expose their account to unintended resource creation, modification, and cost impact if the credentials or automation are misused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code path creates a remote shell script in Huawei COC and executes it as root on an ECS instance, and the shell script itself downloads another script from a remote OBS URL and runs it without any integrity verification, provenance check, or interactive confirmation. In a deployment skill, this creates a real supply-chain and remote-code-execution risk: if the hosted install script is modified or the URL content is compromised, arbitrary code will be executed on the target cloud server automatically.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The configuration hardcodes a default administrative password ("Test@123456") for provisioned servers. Default credentials are commonly discovered or guessed, and if the deployed ECS instance exposes SSH or any management path, an attacker could gain unauthorized administrative access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: TLS verification is globally disabled via urllib3 warning suppression and per-request verify=False for outbound Huawei Cloud API calls. This makes the credentialed AK/SK API traffic vulnerable to man-in-the-middle interception or response tampering, which is especially dangerous because the code performs privileged cloud provisioning actions.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: When no subnet exists, the skill silently creates a new VPC and subnet without an explicit user-facing confirmation. In cloud automation, implicit infrastructure creation can surprise users, violate change-control requirements, and create externally reachable environments that were not intentionally approved.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Security group rules default to remote_ip_prefix="0.0.0.0/0", which opens services to the entire internet unless callers override it. In the context of auto-deploying a server with a public IP, this materially increases the chance of remote attack, brute force attempts, and accidental exposure of management or application ports.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The prepaid server flow automatically provisions a public IP and enables auto-pay, which can create externally exposed, billable resources without an explicit consent step. Although useful for one-click deployment, this is risky because it combines cost incurrence with internet exposure in a privileged automation path.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The pay-as-you-go flow auto-creates a public IP without a clear warning about internet exposure or bandwidth cost. In this skill's context, that makes the deployed SQLBot host reachable from outside by default, increasing exposure even if the user only expected an internal test deployment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script modifies the local system by installing packages automatically without an interactive confirmation or comparable explicit consent gate. In an automation skill that may run unattended or under broad permissions, this can lead to unexpected host changes, policy violations, and increased blast radius if a package source is compromised.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The progress notification includes the instance's initial password in plain text. This creates credential exposure through chat systems, push notifications, archives, mobile lock screens, and any admin or compliance tooling attached to Feishu.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/deploy_sqlbot.py:524

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud_ecs.py:280