huawei-cloud-flexus-l-deploy-jiuwenswarm

• Outcome: Review
• Latest audit: Aug 6, 2026 · 4:44 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Huawei Cloud deployment helper, but it handles paid resources, root remote execution, and secrets with several unsafe or under-scoped defaults that users should review before installing.

Install only if you are comfortable granting Huawei Cloud credentials that can create paid resources and execute root scripts on target instances. Prefer temporary STS credentials with least privilege, review generated cloud charges before use, restrict public ingress and CORS/sender allowlists, and avoid using or sharing logs until secret-printing and world-readable config permissions are fixed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents capabilities to access environment variables, read/write files, use the network, and execute shell/Python commands, yet it declares no explicit permissions boundary. That creates a transparency and governance gap: users and the platform may not fully understand that the skill can handle credentials, create cloud resources, and modify remote systems.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill's documented purpose understates or incompletely describes several sensitive behaviors, including credential validation against IAM, paid resource creation, remote package installation, metadata persistence, and COC/RMS monitoring. This mismatch can mislead operators about the real security and cost impact, increasing the risk of unintended cloud changes and credential exposure pathways.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script prints partial values of the cloud access key and secret key to the console, which unnecessarily discloses sensitive credential material during a routine environment check. Even partial secrets can aid credential correlation, leak into terminal history, CI logs, support screenshots, or centralized logging systems, increasing the chance of credential compromise.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The script advertises deployment verification for JiuwenSwarm, but the actual remote script only prints hostname, user, and time, then exits successfully. This creates a false assurance condition: operators or downstream automation may treat the platform as successfully deployed when the application was never checked, potentially exposing users to outages, misconfiguration, or insecure follow-on steps.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code explicitly notes that verification is simplified, yet later logs and persists a result indicating JiuwenSwarm deployment verification succeeded. This mismatch can mislead users and automation into proceeding to later configuration stages on an unverified or broken deployment, increasing operational and security risk through misplaced trust.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger examples use broad, natural phrases like 'Help me deploy JiuwenSwarm to Huawei Cloud,' which may be matched in ordinary conversation and cause unintended invocation of a skill that can create billable cloud resources and perform remote execution. In this context, accidental activation is more dangerous because the documented workflow includes infrastructure changes and credential-dependent actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill asks for third-party model and messaging credentials and then transmits them for remote configuration via COC, but it lacks an explicit warning about this collection, transmission, storage, and restart behavior. Users may not realize secrets are being written into remote configuration files and handled by an execution service, which increases the chance of accidental secret disclosure or inappropriate credential sharing.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The template sets `allow_from: "*"`, which permits messages or requests from any sender/source with no scope restriction. In a deployment skill for an AI agent platform that integrates external messaging channels, this weak default can enable unauthorized interaction, spoofed requests, or abuse if the application trusts this field for access control.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The configuration enables CORS and allows all origins via `allowed_origins: ["*"]`, meaning any website can issue browser-based cross-origin requests to the service. For an internet-deployed multi-agent platform that may expose administrative or API functions, this broad policy increases the risk of cross-site request abuse, data exposure, and unintended access from untrusted web origins.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The API spec explicitly documents a COC endpoint for remote script execution but provides no warning, approval requirement, or scope restriction. In a one-click cloud deployment skill, this increases the chance that downstream automation will invoke powerful remote execution against newly created instances without adequate user awareness or validation, which can lead to destructive changes or abuse if inputs or scripts are tampered with.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The spec instructs users to open SSH and web service ports without describing source IP restrictions, authentication hardening, or the exposure risks of public ingress. In the context of automated internet-facing AI platform deployment, this can result in unnecessarily broad attack surface and easier compromise of the instance or application.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The troubleshooting guide instructs users to print cloud AK/SK environment variables directly to the terminal. Even though this is framed as diagnostics, it can expose long-lived credentials in shell history, terminal scrollback, screen recordings, shared sessions, or support screenshots, enabling unauthorized cloud access if leaked.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Displaying the full .env file during troubleshooting can reveal API keys, tokens, endpoints, and other secrets. In this skill's deployment context, the .env likely contains model provider credentials, so encouraging full disclosure materially increases the risk of credential leakage during debugging or support escalation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Displaying the full config.yaml may expose channel credentials, webhook secrets, callback tokens, and integration settings for Xiaoyi, Feishu, or DingTalk. Because this skill manages message-channel configuration, those secrets could allow message forgery, webhook abuse, or unauthorized access to linked collaboration systems.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: The guide includes a destructive instance deletion API call without a clear warning, confirmation step, or safeguards. In a cloud deployment skill, users may copy-paste commands during incident response, and accidental deletion can cause irreversible service outage, data loss, and operational disruption.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The generated shell script writes channel credentials into /root/.jiuwenswarm/config/config.yaml and then explicitly sets the file mode to 644, making it readable by all local users. Because this file contains secrets such as AK/SK, app secrets, and client secrets, any local user or process on the instance can recover those credentials and potentially use them to access external services or impersonate the configured integrations.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This Feishu configuration path also writes app credentials to config.yaml and then applies chmod 644, exposing the secrets to any local account on the host. On a multi-user system, in a compromised service context, or via backup/log collection agents, these credentials can be harvested and reused against the Feishu integration.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The DingTalk configuration workflow stores client secrets in a plaintext YAML file and then marks that file world-readable with chmod 644. This unnecessarily broadens access to sensitive credentials and can enable unauthorized API access, bot impersonation, or further compromise of integrated messaging channels.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The generated remote shell script prints the full contents of the .env file with `cat "$ENV_FILE"` immediately after writing `API_KEY`, which exposes the secret in COC job output, logs, and any consoles used to monitor execution. In this deployment context, the script is explicitly handling model-provider credentials, so leaking them can enable unauthorized API use and downstream compromise of billing, data access, or model endpoints.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Accepting `--api-key` on the command line exposes the secret to shell history, process listings, audit logs, and orchestration wrappers, especially on shared admin systems. This is more dangerous here because the skill automates cloud deployment and service configuration, so operators are likely to run it from privileged environments where command invocations may be centrally logged.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script can create prepaid cloud resources with auto-renew and auto-pay enabled, and the only interactive safety check can be bypassed via the --confirm flag. In a deployment skill whose purpose is automated infrastructure creation, this increases the risk of unintended charges or non-consensual provisioning if invoked by another component without clear just-in-time user approval.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script triggers remote package installation and system modification on a target instance via Huawei Cloud COC as root, but the code path proceeds directly after argument parsing without any explicit interactive confirmation, dry-run gate, or strong safety warning. In a one-click deployment skill that can affect remote cloud hosts, lack of a confirmation barrier materially increases the chance of accidental or unintended privileged changes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: In verbose mode, the script prints raw remote execution output directly to the console. COC job output can contain secrets, deployment tokens, API keys, host details, or other sensitive operational data, so exposing it without redaction or an explicit sensitivity warning creates an information disclosure risk, especially in shared terminals, logs, or CI environments.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The per-instance verbose section exposes instance-specific output and errors, which may reveal credentials, internal IPs, filesystem paths, deployment artifacts, or stack traces for each target host. In a cloud deployment skill that automates multi-instance provisioning and remote execution, this broadens the disclosure surface and can leak sensitive infrastructure details to anyone with console or log access.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script performs remote shell execution as root on a target cloud instance through COC without interactive confirmation, least-privilege controls, or explicit operator warning. Although the current payload is simple, this pattern normalizes privileged remote execution and increases blast radius if the script content, target selection, or supporting utility functions are modified, compromised, or misused.

Static analysis

No suspicious patterns detected.