ClawHub
Back to skill

Security audit

huawei-cloud-modelarts-notebook-management

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing Huawei Cloud ModelArts notebooks, but its installation guide includes an unsafe remote shell execution command that users should review before installing.

Review the installation instructions before use. Do not run the curl-to-bash command as written; install hcloud from an official package or downloaded installer you can inspect and verify. Use read-only IAM unless you need full lifecycle management, and confirm every create, delete, attach, detach, renew, or image operation before allowing the agent to run it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The guide instructs users to pipe content fetched over the network directly into bash, which executes remote code without giving the user a chance to inspect it first. If the page, transport path, or upstream content is compromised, users could run arbitrary commands on their systems, and in this skill context that may also expose configured cloud credentials or grant access to manage ModelArts resources.

Static analysis

No suspicious patterns detected.