huawei-cloud-flexus-l-server-openclaw-deployment

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:32 AM UTC
• Version: 1.0.0

Overview

The skill’s cloud deployment purpose is coherent, but it handles paid infrastructure, cloud credentials, secrets, and remote root execution with under-scoped controls and unsafe logging.

Review carefully before installing. Use only restricted, temporary Huawei Cloud credentials; avoid passing secrets on command lines; expect billable cloud resources to be created with auto-pay/auto-renew; restrict Web UI access to trusted IPs or a private access path; and do not run model/channel setup unless you accept remote root execution of downloaded installer scripts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (35)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Executing command: {install_command}")
        
        result = subprocess.run(
            install_command,
            shell=True,
            capture_output=True,

• Confidence: 99% confidence
• Finding: This call executes a shell command built with untrusted input (`model_params`) using `shell=True`, which enables command injection. It also pipes a downloaded remote script directly into `bash`, so an attacker controlling the parameter or the remote script source can achieve arbitrary code execution on the local machine.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Executing command: {install_command}")
        
        result = subprocess.run(
            install_command,
            shell=True,
            capture_output=True,

• Confidence: 99% confidence
• Finding: This shell execution uses attacker-influenced `channel_list` inside a command string and runs it with `shell=True`, creating a direct command injection path. Because the command also downloads and executes remote shell code, compromise of either input or script host leads to arbitrary local code execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill documents capabilities to read environment variables, execute shell/Python commands, and access cloud/network services, yet it declares no permissions. This weakens least-privilege controls and prevents users or hosting platforms from understanding the true execution surface before the skill runs.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The document first says credentials must never appear in conversation or commands, then later instructs users to pass AK/SK/security tokens on the command line. Command-line secrets are commonly exposed through shell history, process listings, logs, and transcript capture, directly undermining the stated security model.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill claims `skill action=exec` automatically inherits credentials from environment variables, but the rest of the documentation requires explicit AK/SK flags and even interactive secret entry. This inconsistency encourages unsafe handling patterns and makes it likely that operators will expose credentials unnecessarily.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill exposes generic COC script creation and arbitrary remote execution primitives that go beyond narrowly deploying OpenClaw. In an agent setting, this materially increases abuse potential because any caller who can influence script content or target selection can execute arbitrary code on cloud instances.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill performs local shell execution of downloaded scripts, which is broader than the advertised cloud deployment function and creates direct host-compromise risk for the environment running the agent. In skill context, this is especially dangerous because local execution can affect the operator workstation or agent host, not just the intended cloud instance.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: Instance creation silently enables auto-renewal, auto-pay, and extra billable resources (`evs`, `cbr`, `hss`) without clear user-facing disclosure. This can cause unexpected financial impact and persistent cloud resource obligations, which is especially problematic in one-click agent workflows.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill supports non-interactive creation of paid cloud infrastructure and states it can create instances directly without user confirmation, but it does not provide prominent risk disclosure about cost, resource creation, or the need for explicit authorization. This can lead to unintended infrastructure provisioning, billing exposure, and policy violations when triggered through automation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to pass Huawei Cloud AK/SK and API keys directly on the command line, which can expose secrets through shell history, process listings, terminal logs, CI logs, and screenshots. In the context of a cloud deployment skill that provisions infrastructure and configures models/channels, leaked credentials could enable unauthorized cloud actions or access to third-party model services.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions tell users to open port 18789 and access the Web UI over HTTP without warning about Internet exposure, source IP restrictions, authentication hardening, or TLS. Because this skill deploys an Internet-reachable management/application interface, exposing the port broadly could allow unauthorized access, credential theft over plaintext HTTP, or attack surface expansion against the deployed OpenClaw instance.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script prints the full channel configuration back to the console via `print(f" Channel list: {channel_list or 'Default'}")`, and the documented JSON includes sensitive fields such as `secret`. This can expose credentials in terminal history, CI/CD logs, remote session transcripts, or support screenshots, allowing unauthorized use of configured messaging channels.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This function provisions a paid cloud instance and additional resources without any explicit confirmation step or strong user warning. In an agent context, such irreversible and billable actions should require affirmative consent because prompt confusion or abuse could create unauthorized charges and infrastructure.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code prints the `Authorization` header, full request headers, and request body during instance creation. These values can expose signed credentials, security tokens, project identifiers, and sensitive provisioning data to logs, enabling replay or broader credential misuse if logs are accessible.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill executes scripts on target instances without any explicit confirmation, approval workflow, or safety interlock. Remote code execution is inherently high risk, and in this skill context it is more dangerous because the functions are generic rather than limited to a single immutable deployment action.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The remote installation flow constructs script content that downloads external shell code and executes it as `root` on the target instance. This creates a supply-chain RCE risk: compromise of the script host, path, or network trust chain leads to arbitrary privileged execution on customer infrastructure.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Channel installation embeds secrets such as bot IDs and secrets into remotely executed script content, which may be stored by the COC service, surfaced in logs, or retrievable from execution history. This is especially dangerous because the skill transmits operational secrets through a generic script-execution channel rather than a dedicated secret-management path.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The local model installation path executes downloaded shell code, runs shell commands as root/admin context, and rewires `/usr/local/bin` symlinks without user confirmation. On the agent host, this can directly compromise the machine, alter system binaries, and persist malicious changes beyond the intended deployment workflow.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The local channel installation function mirrors the same unsafe pattern: it executes external shell code and modifies local system state without confirmation. Because channel configuration may include sensitive values, a compromise here affects both the host and downstream credentials.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The UniAgent status query logs full request headers, which may include authorization material or signed metadata sufficient to aid credential abuse if logs are exposed. Even if the signature is short-lived, leaking it reduces security posture and violates least exposure principles.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code prints remote execution output directly to the terminal, truncated to 200 characters, without any redaction or warning. In this deployment context, installer output can easily include API keys, tokens, model parameters, or other credential-derived secrets returned by scripts or cloud tooling, which can then be exposed to operators, logs, CI consoles, or shell history capture systems.

Unvalidated Output Injection

High

• Category: Output Handling

Content

print(f"Executing command: {install_command}")
        
        result = subprocess.run(
            install_command,
            shell=True,
            capture_output=True,

• Confidence: 91% confidence
• Finding: The command output from a shell pipeline that includes remote script execution is captured and later printed without sanitization. If the output contains terminal escape sequences or deceptive text, it can mislead operators, poison logs, or trigger terminal-based attacks in downstream viewers.

Unvalidated Output Injection

High

• Category: Output Handling

Content

restart_cmd = f"sudo -i -u openclaw env DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus {cmd_name} gateway restart >> /var/manage_operate.log 2>&1"
            subprocess.run(restart_cmd, shell=True)
            status_cmd = f"sudo -i -u openclaw env DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus {cmd_name} gateway status 2>&1"
            status_result = subprocess.run(status_cmd, shell=True, capture_output=True, text=True)
            print(f"Gateway status:\n{status_result.stdout}")
            
        elif os.path.exists("/root/.local/share/pnpm/openclaw"):

• Confidence: 90% confidence
• Finding: Gateway status output is captured from an executed command and printed directly. If an attacker can influence the command output through the underlying service or environment, this can inject terminal control sequences or malicious log content into operator consoles.

Unvalidated Output Injection

High

• Category: Output Handling

Content

subprocess.run("ln -sf /root/.nvm/versions/node/v22.22.0/bin/npm /usr/local/bin/npm", shell=True)
            cmd_name = "/root/.local/share/pnpm/openclaw"
            subprocess.run(f"{cmd_name} gateway restart >> /var/manage_operate.log 2>&1", shell=True)
            status_result = subprocess.run(f"{cmd_name} gateway status 2>&1", shell=True, capture_output=True, text=True)
            print(f"Gateway status:\n{status_result.stdout}")
        
        if result.returncode == 0:

• Confidence: 90% confidence
• Finding: Raw gateway status is emitted directly from subprocess output, creating a log/terminal injection vector if output is attacker-influenced. In an agent workflow, such output may also be fed into subsequent automation steps, amplifying confusion or unsafe decisions.

Unvalidated Output Injection

High

• Category: Output Handling

Content

print(f"Executing command: {install_command}")
        
        result = subprocess.run(
            install_command,
            shell=True,
            capture_output=True,

• Confidence: 91% confidence
• Finding: Captured output from the externally fetched and executed channel-installation script is printed without validation. This enables terminal escape injection or log poisoning if the remote script or its inputs emit malicious output.

Static analysis

No suspicious patterns detected.