huawei-cloud-flexus-l-server-scripts-excute

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:29 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it enables privileged remote script execution on Huawei Cloud hosts with under-scoped safety controls and risky credential guidance.

Install only if you intentionally need Huawei Cloud COC remote script management. Use a narrowly scoped IAM role, avoid passing AK/SK/token values on the command line, review every target instance and script UUID before execution, avoid root unless required, and test on a single non-production instance before batch use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill declares that AK/SK/Token must never appear in conversation, yet the documentation repeatedly instructs operators to supply secrets on the command line. Command-line arguments are commonly exposed via shell history, process listings, audit logs, and copied chat transcripts, so this guidance materially increases the chance of credential disclosure. In a remote-execution skill with cloud-control permissions, leaked credentials can enable unauthorized script creation, execution, and broader account compromise.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file states that scripts must only be run via skill action=exec, but then provides direct shell invocation instructions for Python scripts. This contradiction can cause callers or downstream agents to bypass the intended safety boundary, logging, validation, and secret-handling controls associated with the skill execution path. For a capability that manages and remotely executes scripts on hosts, bypassing the wrapper increases the risk of unsafe execution and uncontrolled disclosure of parameters.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger keywords are broad operational phrases such as script management, script execution, and cloud operations, which can match many ordinary admin requests unrelated to this high-risk skill. Over-broad routing can invoke a remote-script-execution capability unexpectedly, increasing the chance that an agent selects a powerful skill in contexts where the user did not intend host-side code execution. Because this skill can run code on target instances, accidental activation materially raises risk.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The routing keywords section lacks precise scope and does not define constraints that separate informational requests from execution requests. In an agentic environment, this ambiguity can cause misrouting into a skill that creates or executes scripts remotely, which is significantly more dangerous than answering documentation questions. The skill context makes this more dangerous because the capability is inherently privileged and can affect multiple cloud instances.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation promotes remote script execution, batch deployment, emergency scripts, and server modifications without an explicit warning about operational impact, blast radius, or the need for authorization and change control. Users may underestimate that these actions can alter many systems, cause outages, overwrite configurations, or execute destructive commands at scale. In this context, the absence of prominent safety warnings is dangerous because the skill is designed for privileged remote code execution across target hosts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document recommends an administrator role with wildcard permissions (`coc:script:*`, `coc:execution:*`, `coc:instance:*`) that include destructive and high-risk actions such as creating, updating, deleting scripts, and remotely executing them across instances. In the context of a skill specifically designed for remote script management and execution, this overbroad guidance increases the chance that users grant far more privilege than necessary, enabling accidental misuse or full remote command execution if the skill or credentials are abused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The CLI help text and examples explicitly instruct users to pass Huawei Cloud AK/SK and security tokens as command-line arguments. Secrets supplied via argv are commonly exposed through shell history, process listings, audit logs, crash reports, and CI job output, which can lead to credential theft and unauthorized cloud access.

Missing User Warnings

High

• Confidence: 88% confidence
• Finding: The tool proceeds directly from collecting target instance and execution parameters to invoking remote script execution, without an explicit confirmation step, dry-run summary, or safety interlock. Because this skill is specifically designed for batch remote execution on cloud instances, an accidental or manipulated invocation can immediately run arbitrary commands as root on production systems and cause outages or destructive changes.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.