huawei-cloud-eip-cost-optimizer

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:10 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a Huawei Cloud EIP reporting tool, but it has review-worthy side effects around installer execution, credential handling, cron persistence, and optional alert data sharing.

Install only if you are comfortable with a shell-based cloud operations helper. Prefer hcloud configure over HW_ACCESS_KEY/HW_SECRET_KEY environment variables, review any installer before running it, avoid --fix automation on sensitive hosts, do not pass untrusted --region or --idle-days values, and use webhook/email alerts only when the destination is trusted to receive EIP IDs and public IP addresses.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares shell-based capabilities and operational behaviors but does not expose a clear permissions model. That omission makes it harder for users or an agent framework to understand that the skill can invoke local shell commands, access credentials from the environment, write files, and potentially make network calls via CLI/webhooks. In an agent setting, undeclared execution capability increases the risk of unintended command execution under a misleading 'read-only' label.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill repeatedly presents itself as 'read-only,' but the documented behaviors include package installation, execution of a downloaded installer script, cron modification, and writing reports/audit logs. This mismatch is security-relevant because users may consent expecting passive analysis while the skill can change the host environment and persistence state. The remote installer pipe-to-shell pattern further amplifies risk if used in trusted automation contexts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation promotes webhook/email alerts and cron setup without clearly surfacing that operational data may be transmitted to external endpoints and that local scheduling configuration will be modified. In practice, EIP identifiers, regions, cost metadata, or inventory details could leave the environment, and cron persistence can surprise users who believed the skill was only analytical. Hidden exfiltration and persistence-adjacent behavior are especially concerning in agent-operated environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide includes `AssociatePublicip` and `DisassociatePublicip` commands that can immediately alter production network reachability, yet it does not clearly warn about service interruption, exposure changes, or the need for explicit authorization/change control. In a skill advertised as read-only cost optimization, documenting state-changing network commands increases the chance that an agent or operator could perform unintended live changes contrary to the skill’s stated safety boundary.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This is a real credential-exposure issue: in env_vars mode, the script constructs --cli-access-key, --cli-secret-key, and optionally --cli-security-token flags and passes them on the hcloud command line. Command-line arguments are commonly visible to local users via process listings (/proc, ps, audit logs, shell history wrappers, EDR telemetry), so AK/SK material can be disclosed even though it is not hardcoded. The skill context is read-only for cloud resources, but these credentials are still high-value secrets whose exposure can enable broader compromise of the Huawei Cloud account depending on IAM scope.

External Transmission

Medium

• Category: Data Exfiltration

Content

esac

    local http_code
    http_code=$(curl -s -o /dev/null -w "%{http_code}" \
        -X POST -H "Content-Type: application/json" \
        -d "$payload" "$url" 2>/dev/null) || {
        color_print "$RED" "❌ Webhook 发送失败：网络不可达或 URL 无效"

• Confidence: 73% confidence
• Finding: The script transmits EIP inventory and monitoring metadata to a user-supplied webhook endpoint using curl. Although the code restricts destinations to HTTPS and a small allowlist of known webhook domains, it still enables external exfiltration of cloud asset details if an operator provides an untrusted or compromised webhook URL, and wildcard matching for Slack-related hosts broadens that trust boundary.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo apt install -y jq bc curl

# CentOS/RHEL
sudo yum install -y jq bc curl

# macOS
brew install jq bc curl

• Confidence: 87% confidence
• Finding: The skill instructs use of sudo for dependency installation, and elsewhere documents piping a remote installer script directly into bash. While this is framed as setup, combining elevated privileges with network-fetched code increases the blast radius of compromise or user error. In an agent context, any path that normalizes privileged execution should be treated as risky, especially when the skill markets itself as read-only analysis.

Session Persistence

Medium

• Category: Rogue Agent

Content

fi

    # 添加新任务
    (crontab -l 2>/dev/null; echo "$cron_line") | crontab -
    color_print "$GREEN" "✅ 已添加 crontab 定时任务：每天 09:00 执行监控"
    color_print "$BLUE" "   命令：${cron_line}"
}

• Confidence: 82% confidence
• Finding: The cron entry is built by directly interpolating HW_REGION and MIN_IDLE_DAYS into a shell command line without shell escaping. If a caller supplies crafted values containing shell metacharacters, the resulting crontab line could execute unintended commands when cron runs, turning a convenience feature into command injection with the privileges of the crontab owner.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Re-run installer (overwrites existing version)
curl -sSL -o /tmp/hcloud_install.sh https://hwcloudcli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh
bash /tmp/hcloud_install.sh
rm -f /tmp/hcloud_install.sh

# Verify new version
hcloud --version

• Confidence: 98% confidence
• Finding: The uninstall section contains `rm -rf ~`, which would recursively delete the current user's home directory rather than only removing KooCLI-related files. In documentation for an operational skill, users may copy-paste commands verbatim, so this is a destructive command injection-by-documentation issue with severe data-loss potential.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Re-run installer (overwrites existing version)
curl -sSL -o /tmp/hcloud_install.sh https://hwcloudcli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh
bash /tmp/hcloud_install.sh
rm -f /tmp/hcloud_install.sh

# Verify new version
hcloud --version

• Confidence: 98% confidence
• Finding: The uninstall section contains `rm -rf ~`, which would recursively delete the current user's home directory rather than only removing KooCLI-related files. In documentation for an operational skill, users may copy-paste commands verbatim, so this is a destructive command injection-by-documentation issue with severe data-loss potential.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.