huawei-cloud-flexus-l-server-hermes-deployment

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:27 AM UTC
• Version: 1.0.0

Overview

The skill matches its Hermes deployment purpose, but it uses powerful cloud credentials to create paid auto-renewing resources, run remote root scripts, and handle secrets in ways users should review carefully.

Review this skill before installing. Use temporary, least-privilege Huawei Cloud credentials, avoid putting secrets in command-line arguments, understand that deployment creates paid prepaid monthly resources with auto-pay and auto-renew enabled, and verify remote host file permissions and script contents before using it in production.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities to access environment variables, read/write files, invoke shell commands, and make network calls, yet no explicit permissions are declared. This weakens trust boundaries and informed consent because a caller may trigger infrastructure-changing operations without a clear permission model. In a cloud deployment skill, hidden capability breadth is especially risky because it can affect both local execution context and remote cloud resources.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The module provides generic create_script and execute_script primitives that can run arbitrary shell, Python, or BAT content on remote instances, which exceeds the stated Hermes deployment/configuration purpose. If these functions are reachable through the skill surface, an attacker or prompt-injection path could abuse the skill as a general remote code execution channel on cloud instances.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documentation repeatedly instructs users to pass AK/SK, security tokens, API keys, and bot secrets as command-line arguments. Command-line secrets are commonly exposed through shell history, process listings, job logs, terminal scrollback, and support transcripts, creating a direct credential leakage path. This is more dangerous here because the credentials grant access to cloud resources and third-party messaging integrations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document instructs users to pass Huawei Cloud AK/SK directly via command-line flags. Command-line arguments are commonly exposed through shell history, process listings, CI logs, and audit trails, which can leak long-lived cloud credentials to other local users or logging systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The verification steps document passing an API key, Feishu app secret, and related sensitive values on the command line without any secret-handling warning. This creates the same exposure path as AK/SK leakage and broadens the blast radius to model-provider and messaging-platform credentials, which could enable unauthorized service use or bot compromise.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Instance creation is configured with is_auto_renew=True and is_auto_pay=True, enabling immediate paid provisioning and recurring charges without an explicit confirmation mechanism at the call site. In an agent context, that creates a real risk of unintended financial impact or abuse through accidental invocation, prompt injection, or misuse of delegated cloud credentials.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The remote channel-configuration script writes secrets such as FEISHU_APP_SECRET and WECOM_SECRET directly into /home/hermes/.hermes/.env while executing as root, without file-permission hardening or safeguards against unsafe values. This increases the risk of credential disclosure, accidental corruption of the environment file, and privilege-amplified damage if injected values contain shell-significant characters.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The restart operation performs a remote service restart immediately and without a confirmation step, which can interrupt live service availability. In an agent-driven workflow, that makes accidental or malicious triggering more dangerous because a simple invocation can cause avoidable downtime.

External Transmission

Medium

• Category: Data Exfiltration

Content

content = script_info["content"]
    content = content.replace("${api_key}", api_key if api_key else "")
    content = content.replace("${model_name}", model_name if model_name else "")
    content = content.replace("${api_base_url}", api_base_url if api_base_url else "https://api.modelarts-maas.com/v2")
    
    create_result = create_script(
        name=f"{script_info['name']}-{int(time.time())}",

• Confidence: 90% confidence
• Finding: The code injects api_key, model_name, and api_base_url directly into a shell script template before remote execution, meaning sensitive data is embedded into remotely stored/executed script content and potentially visible in script records or execution logs. Even though the endpoint is expected, handling secrets this way increases exposure beyond simple transmission to the intended provider.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if ! command -v yq &> /dev/null; then
        echo "Package manager installation failed, trying direct download..."
        if command -v curl &> /dev/null; then
            sudo curl -sL https://github.com/mikefarah/yq/releases/download/v4.35.1/yq_linux_amd64 -o /usr/local/bin/yq
        else
            sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.35.1/yq_linux_amd64
        fi

• Confidence: 94% confidence
• Finding: The script downloads an executable binary from GitHub and writes it to /usr/local/bin/yq using sudo, then executes it later, without checksum or signature verification. This creates a supply-chain risk: if the download source, transport, or release artifact is compromised, remote root-level code execution on the target instance can follow.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v curl &> /dev/null; then
            sudo curl -sL https://github.com/mikefarah/yq/releases/download/v4.35.1/yq_linux_amd64 -o /usr/local/bin/yq
        else
            sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.35.1/yq_linux_amd64
        fi
        sudo chmod +x /usr/local/bin/yq
    fi

• Confidence: 94% confidence
• Finding: This branch performs the same unsafe privileged binary download via wget into /usr/local/bin. The combination of remote fetch plus sudo placement in the execution path materially increases the blast radius of any compromise of the download chain.

Credential Access

High

• Category: Privilege Escalation

Content

FEISHU_APP_SECRET='${feishu_app_secret}'
WECOM_BOT_ID='${wecom_bot_id}'
WECOM_SECRET='${wecom_secret}'
ENV_PATH='/home/hermes/.hermes/.env'

echo "⚙️  Configuring bot channel..."
echo " - Target Platform: $BOT_PLATFORM"

• Confidence: 90% confidence
• Finding: The script explicitly handles bot secrets and writes them into a plaintext .env file on the remote host. This constitutes sensitive credential material being persisted in a location that may be accessible to other processes/users if permissions are not tightly controlled, increasing risk of credential compromise.

Credential Access

High

• Category: Privilege Escalation

Content

}


# ==================== Update .env File ====================
update_env_file() {
    echo "⚙️  Updating $ENV_PATH ..."

• Confidence: 89% confidence
• Finding: The update_env_file routine is specifically responsible for inserting secrets into the .env file, creating persistent plaintext storage of sensitive values on disk. In a remote execution context, this expands the attack surface for credential disclosure through file reads, backups, logs, or mis-set permissions.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib.py:404