huawei-cloud-flexus-l-server-flexusagent-deployment

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:27 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its cloud deployment purpose, but it exposes sensitive credentials/passwords and runs mutable remote scripts on cloud instances, so users should review it carefully before installing.

Install only in a test or tightly controlled Huawei Cloud account first. Use least-privilege temporary credentials, expect real charges and persistent cloud changes, avoid shared logs or transcripts because the skill can print passwords and signed request headers, and review or replace the remote curl-to-bash scripts before using it on production infrastructure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documentation describes shell execution, network access, and environment-variable credential use, but no explicit permissions are declared. This creates a transparency and policy-enforcement gap: a reviewer or runtime may underestimate the skill’s actual authority, especially because it can use cloud credentials and make external requests. In a deployment skill with billing and infrastructure impact, undeclared capabilities are more dangerous than in a read-only utility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose understates the full behavior: beyond deployment and configuration, the skill can query instance metadata, alter security-group exposure, manage plugins, and reportedly log sensitive request details including Authorization headers. That mismatch prevents informed consent and review, and the logging of authorization material could directly enable credential theft or replay. In cloud automation, hidden network and plugin-management behavior materially increases attack surface and operational risk.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill first states that credentials and sensitive values must never be exposed, then later requires replying with the newly set admin password in plaintext. This is a direct contradiction that normalizes secret disclosure into chat transcripts, logs, and downstream observability systems. Because the password grants administrative access to the deployed platform, exposure could lead to immediate account compromise.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The module contains plugin marketplace discovery and installation logic that materially expands its effective capabilities beyond the stated deployment/password/MaaS/workflow scope. This increases attack surface by allowing the skill to install arbitrary plugins from a marketplace, which can introduce unreviewed code paths and supply-chain risk into the managed FlexusAgent environment.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The code can query security groups and create ingress rules, including opening ports to 0.0.0.0/0 by default, even though this network-modification behavior is not described in the skill metadata. Hidden infrastructure-changing behavior is dangerous because it can expose services to the internet and bypass a user's expectation of limited deployment-only actions.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The generic COC script creation and execution helpers enable arbitrary remote command execution on target instances, which is substantially broader than narrowly scoped password management or workflow import. In the context of a cloud deployment skill, this becomes especially dangerous because any future caller can repurpose these primitives for unrestricted post-deployment actions on customer infrastructure.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The script prints the new FlexusAgent admin password directly to the console before confirmation, exposing a sensitive secret to terminal history, logs, screenshots, CI/CD job output, or remote session recording. In a deployment/password-management skill, this is especially dangerous because operators are likely to run it in shared or logged administrative environments.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The verification guide instructs users to run commands that can provision a cloud instance and change the administrator password of a live system, but it does not clearly warn that these actions are state-changing, may incur cloud charges, and can alter system access. In a skill intended for deployment operations this may be expected behavior, but presenting such commands as routine verification steps without explicit safety and impact notice increases the risk of accidental resource creation, cost exposure, and lockout.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code prints the Authorization header and full signed request headers during instance creation, which can expose signed credentials, security tokens, and other sensitive request metadata in logs. In cloud environments, logs are often widely accessible to operators and systems, making credential leakage a serious compromise path.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The password-change operation downloads a shell script from a remote URL and pipes it directly to bash as root, creating a classic supply-chain and remote code execution risk. Because the function changes administrator credentials on a cloud instance, compromise of the remote script source would give an attacker privileged execution in a highly sensitive context.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The workflow import path also fetches and executes a remote shell script, and passes sensitive values including a base64-encoded payload and admin password as shell arguments. This combines supply-chain risk with credential exposure, and can leak secrets through process listings, logs, or script-side mishandling.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: In non-interactive mode, the script automatically proceeds to perform authenticated remote configuration changes using supplied admin credentials and an API key, without any explicit acknowledgement or safety gate. In a deployment skill context, this increases the chance of unintended or silent changes to a live FlexusAgent/Dify environment if the script is invoked by automation, wrappers, or users who do not realize it is mutating remote state.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Printing an administrator password in cleartext creates immediate credential disclosure risk because anyone with access to the console, shell history, logging backend, or session transcript can recover it and gain administrative access. Given this skill manages a cloud-hosted AI platform, compromise of the admin account could enable full takeover of the application and any connected workflows or model integrations.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Mandating that the assistant reveal the new admin password in its response causes intentional secret exfiltration into conversation history. Chat transcripts are often stored, indexed, audited, or visible to other operators, so this turns a privileged credential into broadly accessible data. In the context of an internet-reachable Web UI, compromise impact is substantial.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

print("\nDeployment cancelled")
            return
    else:
        print("  Non-interactive mode: Auto-confirm")

    # Execute deployment
    print("\nCreating FlexusAgent instance...")

• Confidence: 82% confidence
• Finding: In non-interactive mode, the script automatically approves creation of cloud resources without an explicit final confirmation step. In a skill that performs real infrastructure deployment and later modifies security group rules, this increases the chance of unintended resource provisioning, unwanted charges, or deployment into the wrong region/spec if upstream inputs are incorrect or manipulated.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

flexusagent_password = getattr(args, 'flexusagent_password', None) or prompt_for_input("FlexusAgent admin password:", required=True, hide_input=True)
    maas_api_key = getattr(args, 'maas_api_key', None) or prompt_for_input("MaaS API key:", required=True, hide_input=True)

    # Confirm deployment (skip confirmation in non-interactive mode)
    non_interactive = getattr(args, 'non_interactive', False)
    if not non_interactive:
        confirm = prompt_for_input("Confirm deployment?", required=False, default="y", choices=["y", "n"])

• Confidence: 80% confidence
• Finding: The code explicitly supports skipping human confirmation in a path that uses privileged credentials to log into an administrative interface and modify model provider configuration. That is a form of autonomous action over a remote service, which is risky because it can enable accidental execution, misuse in scripted environments, or unauthorized changes if inputs are passed through another agent or orchestration layer.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

print("\nDeployment cancelled")
            return
    else:
        print("  Non-interactive mode: Auto-confirm")

    try:
        session = get_admin_session(flexusagent_base_url, flexusagent_email, flexusagent_password)

• Confidence: 84% confidence
• Finding: The "Non-interactive mode: Auto-confirm" branch removes the last user-interaction safeguard before authenticated changes are made to the target platform. In this skill's context, the script is specifically designed to deploy and configure AI platform integrations, so auto-confirm makes unintended or opaque administrative changes more dangerous than in a read-only utility.

External Script Fetching

High

• Category: Supply Chain

Content

"description": "Change FlexusAgent admin user password",
        "risk_level": "LOW",
        "content": '''#!/bin/bash
curl -sSL https://documentation-samples.obs.cn-north-4.myhuaweicloud.com/solution-as-code-publicbucket/solution-as-code-moudle/agent/reset_admin_password.sh | bash -s "${adminPassword}"'''
    },
    "import_dify_app_workflow": {
        "name": "import_dify_app_workflow",

• Confidence: 99% confidence
• Finding: This is a direct instance of external script fetching and immediate execution via curl piped to bash. It is dangerous because it executes unaudited remote code at runtime, and in this skill's context the execution occurs on managed cloud instances with elevated privileges for password administration.

External Script Fetching

High

• Category: Supply Chain

Content

"type": "SHELL",
        "description": "import dify app workflow on dify server instance",
        "risk_level": "MEDIUM",
        "content": '''curl -sSL https://flexus-config-cn-north-4-product.obs.cn-north-4.myhuaweicloud.com/stable/dify/scripts/import_yml_to_dify.sh | bash -s ${base64String} ${dify_admin_password}'''
    },
}

• Confidence: 99% confidence
• Finding: This code path also executes a remotely hosted shell script directly from the network, making workflow import dependent on a mutable external artifact. Because it also supplies sensitive import data and credentials, a compromised script source could exfiltrate secrets or alter server state arbitrarily.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The dependency constraint `requests>=2.31.0,<3.0.0` permits installation of vulnerable `requests` releases, including versions affected by public CVEs such as the 2024 `.netrc` credential leak issue. In a deployment skill that likely makes authenticated outbound HTTP requests to cloud services, this increases the chance of credential exposure or unsafe request handling if dependency resolution selects an affected version.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The dependency constraint `pyyaml>=6.0,<7.0` allows vulnerable PyYAML versions, and PyYAML has a long history of unsafe deserialization issues when untrusted YAML is loaded insecurely. Given this skill imports workflows and handles configuration, YAML parsing is contextually relevant, so a vulnerable or misused parser could enable code execution or malicious configuration injection if attacker-controlled YAML is processed.

Known Vulnerable Dependency: urllib3 — 10 advisory(ies): CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +7 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The dependency constraint `urllib3>=2.0,<3.0` can resolve to affected urllib3 versions with known issues such as header leakage or decompression-related weaknesses. In a cloud deployment tool that likely performs authenticated HTTP(S) communication and may follow redirects or process remote content, these issues can materially affect confidentiality and availability.

Static analysis

No suspicious patterns detected.