huawei-cloud-install-openjiuwenswarm

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:18 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches an installer/startup purpose, but it silently changes the system, reads and persists cloud credentials, downloads unverified runtime code, and can stop unrelated processes.

Install only after reviewing the privileged side effects. Expect this skill to read Huawei Cloud credentials, write them to a local .env file, install dependencies, create global commands, download and run an external runtime, start services, and potentially kill other listening processes. Prefer requiring explicit confirmation for package installs, credential persistence, process termination, and any stop/restart operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (61)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
    if MIRROR_FILE.endswith(".tar.gz") or MIRROR_FILE.endswith(".tgz"):
        subprocess.run(["tar", "xzf", MIRROR_FILE, "-C", BASE_DIR], check=True)
    elif MIRROR_FILE.endswith(".tar.bz2") or MIRROR_FILE.endswith(".tbz2"):
        subprocess.run(["tar", "xjf", MIRROR_FILE, "-C", BASE_DIR], check=True)
    elif MIRROR_FILE.endswith(".tar.xz") or MIRROR_FILE.endswith(".txz"):

• Confidence: 86% confidence
• Finding: This invokes the system tar utility on an archive path that is treated as trusted, but the extraction target is a local directory and there is no validation of archive member paths before extraction. A malicious tarball can perform path traversal or place unexpected files/symlinks during extraction, potentially overwriting files in the container or preparing later code execution when the extracted runtime is used.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if MIRROR_FILE.endswith(".tar.gz") or MIRROR_FILE.endswith(".tgz"):
        subprocess.run(["tar", "xzf", MIRROR_FILE, "-C", BASE_DIR], check=True)
    elif MIRROR_FILE.endswith(".tar.bz2") or MIRROR_FILE.endswith(".tbz2"):
        subprocess.run(["tar", "xjf", MIRROR_FILE, "-C", BASE_DIR], check=True)
    elif MIRROR_FILE.endswith(".tar.xz") or MIRROR_FILE.endswith(".txz"):
        subprocess.run(["tar", "xJf", MIRROR_FILE, "-C", BASE_DIR], check=True)
    elif MIRROR_FILE.endswith(".zip"):

• Confidence: 86% confidence
• Finding: This uses tar extraction on a .tar.bz2 archive without any safety checks on archive contents. If the mirror file is attacker-controlled or tampered with, crafted entries can escape BASE_DIR, overwrite files, or create symlink-based write primitives inside the development container, which is especially risky because this skill is a mandatory deployment path.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif MIRROR_FILE.endswith(".tar.bz2") or MIRROR_FILE.endswith(".tbz2"):
        subprocess.run(["tar", "xjf", MIRROR_FILE, "-C", BASE_DIR], check=True)
    elif MIRROR_FILE.endswith(".tar.xz") or MIRROR_FILE.endswith(".txz"):
        subprocess.run(["tar", "xJf", MIRROR_FILE, "-C", BASE_DIR], check=True)
    elif MIRROR_FILE.endswith(".zip"):
        import zipfile
        with zipfile.ZipFile(MIRROR_FILE, "r") as zf:

• Confidence: 86% confidence
• Finding: Calling tar directly on an xz-compressed archive is dangerous here because the code performs no trust verification or safe-member filtering before extraction. In the context of an installation skill that automatically downloads, extracts, configures, and starts software, a malicious archive can directly compromise the container filesystem and influence subsequent startup behavior.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"Check mirror archive structure")
if not os.path.isfile(ENV_FILE):
    os.makedirs(os.path.dirname(ENV_FILE), exist_ok=True)
    subprocess.run(RUNTIME_INIT, capture_output=True)

# Config .env
config = get_keyring_config()

• Confidence: 93% confidence
• Finding: The script executes RUNTIME_INIT as a subprocess without validating that the target script is trusted, immutable, or located in a controlled path. In this skill's context, the runtime and workspace come from a downloaded/extracted mirror archive, so a tampered archive could supply a malicious init script that will be executed automatically during setup.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if os.path.islink(link_path) or os.path.isfile(link_path):
        subprocess.run(f"{sudo} rm -f {link_path}", shell=True, capture_output=True)
    if os.path.isfile(cmd_path):
        subprocess.run(f"{sudo} ln -sf {cmd_path} {link_path}", shell=True, capture_output=True)
        subprocess.run(f"{sudo} chmod +x {link_path}", shell=True, capture_output=True)

# Init workspace

• Confidence: 81% confidence
• Finding: This creates privileged symlinks in /usr/local/bin using a shell command and a cmd_path partly derived from extracted runtime content. In the skill context, downloaded mirror artifacts influence installation targets, so a malicious or replaced runtime path could cause unsafe global command exposure or link unexpected executables into a privileged location.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"[4/5] 🛑 Stopping existing instance (ports found: {existing_ports})...", flush=True)
    try:
        # Kill processes occupying jiuwenswarm ports
        result = subprocess.run(
            "ss -tlnp 2>/dev/null | grep -E ':(517[0-9]|1809[0-9]|1900[0-9]|1901[0-9])' | grep -oP 'pid=\\K\\d+' | sort -u",
            shell=True, capture_output=True, text=True, timeout=5
        )

• Confidence: 94% confidence
• Finding: This code executes a shell pipeline with `shell=True` to identify PIDs bound to matching ports, which introduces avoidable shell-execution risk and broadens the attack surface. While the command string is static in this file, using the shell for process discovery is dangerous operationally and, combined with the subsequent unconditional `SIGKILL`, can terminate unrelated processes that merely match the port pattern.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def is_port_listening(port):
    result = subprocess.run(
        f"ss -tlnp | grep ':{port}'",
        shell=True, capture_output=True
    )

• Confidence: 97% confidence
• Finding: `is_port_listening()` builds a shell command with an interpolated `port` value and executes it with `shell=True`. If `port` can be influenced by upstream code, this becomes command injection in a deployment skill that may run with elevated privileges, making the context especially dangerous.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sudo = "sudo" if os.getuid() != 0 else ""
    for pm in ["dnf", "yum", "apt-get"]:
        if subprocess.run(f"command -v {pm}", shell=True, capture_output=True).returncode == 0:
            subprocess.run(f"{sudo} {pm} install -y keyutils", shell=True, capture_output=True)
            return

• Confidence: 91% confidence
• Finding: This code performs unattended system package installation via shell command construction and optional `sudo`, modifying the host/container environment without user disclosure or confirmation. In a deployment skill, silently installing packages expands the blast radius and can execute with elevated privileges, which is dangerous even if the package manager name is selected from a small fixed list.

Tainted flow: 'download_url' from requests.post (line 112, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

actions = result["objects"][0].get("actions", {})
                download_url = actions.get("download", {}).get("href", "")
                if download_url:
                    resp = requests.get(download_url, stream=True, timeout=DOWNLOAD_TIMEOUT)
                    resp.raise_for_status()
                    total = int(resp.headers.get("content-length", 0))
                    total_mb = total // 1024 // 1024

• Confidence: 90% confidence
• Finding: The script trusts a download URL returned from a remote LFS batch API and performs a second fetch from that URL without validating the host, scheme, or artifact integrity. A malicious or compromised API endpoint could redirect the installer to download unexpected content, enabling supply-chain compromise or retrieval from unintended internal/external locations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents capabilities to read environment/configuration data, write files, access the network, and run shell-like commands, but it does not declare corresponding permissions. This creates a transparency and governance gap that can bypass normal user review and platform controls, especially because the skill performs installation and configuration actions automatically.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill claims to perform a local install/start workflow, but the documented behavior also accesses local credentials, writes them into a service configuration file, alters system certificate state, installs packages, creates global commands, and makes an extra network request unrelated to core deployment. This mismatch materially understates the true security impact and prevents informed user consent.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill says the agent must ask for confirmation before deployment and before each write operation, but elsewhere directs silent package installation without asking the user. Contradictory instructions like this encourage hidden writes and make it easy for the agent to violate the user's consent expectations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documented stop/restart commands kill every PID discovered from listening sockets rather than targeting only JiuwenSwarm-owned processes. In a shared development container, this can terminate unrelated services, disrupt workflows, and potentially cause data loss or denial of service.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill claims it does not store sensitive credential information, yet the deployment flow explicitly maps API credentials into a `.env` file for runtime use. Even with restrictive permissions, persisting secrets on disk increases exposure through accidental disclosure, backups, logs, or later compromise of the container.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The document claims that all permissions are read-only and involve no write operations, but it also lists `sys:mount` as an optional permission. Mount capability is a privileged system operation that can modify runtime state, expand filesystem access, and in container contexts may enable breakout or sensitive host/container data exposure. This misleading security note can cause operators to under-assess the true privilege level required by the skill.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill is described as performing local installation and startup inside the current container, yet the IAM policy documents access to Huawei Cloud configuration and an API key from the keyring. That creates an unjustified credential access path inconsistent with the stated functionality, increasing the risk of secret exposure or abuse if the skill or its dependencies are compromised.

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: This code performs an unrelated background download specifically to 'trigger visit count' for the original repository, which is not necessary for installation. It causes undisclosed outbound network activity and local file writes, indicating deceptive telemetry-like behavior embedded in an installer.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The inline comment labels the behavior as a non-blocking visit-count trigger for the original repo, confirming intentional hidden side behavior unrelated to installation. Deceptive framing around extra network activity is dangerous because it reduces scrutiny and normalizes covert communications in a privileged setup path.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill reads Huawei Cloud provider settings and extracts an API key from the system keyring even though its stated role is local JiuwenSwarm install/start. Accessing unrelated host credentials is a severe overreach and strongly suspicious in this context, because it enables credential theft and subsequent compromise of cloud resources beyond the local container.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to install dependencies silently and not disclose or ask permission for that action. Hidden package installation is a privileged system modification that changes the environment and may introduce supply-chain risk without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill provides destructive service-stop commands that can kill processes in the container but does not prominently warn about the blast radius or require confirmation. Users may invoke these commands thinking they are narrowly scoped when they are not.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly instructs users to print the full .env file, which commonly contains secrets such as tokens, API keys, endpoints, and credentials. In a shared terminal, recorded session, support workflow, or LLM-assisted environment, this can unnecessarily expose sensitive configuration data beyond what is needed for verification.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: A daemon thread silently issues an outbound request and writes a file without informing the user, logging prominently, or obtaining consent. In an installation skill running inside a development container, undisclosed background activity is especially concerning because users may assume only essential deployment actions occur.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script reads API credentials from keyring and writes them into a .env file, increasing exposure because plaintext environment files are frequently readable by other processes, users, backups, or later tooling. In a deployment skill, this is more dangerous because the automation normalizes secret materialization on disk without any warning or permission hardening shown here.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script automatically enumerates ports matching a broad range and force-kills all associated PIDs with `SIGKILL` without confirmation or ownership checks. In a shared development container, this can disrupt unrelated services, destroy in-memory state, and create a denial-of-service condition against other workloads using those ports.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.