Security audit

huawei-cloud-obs-website-host

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its OBS website-hosting purpose, but it asks for sensitive cloud credentials and broad public-infrastructure write access with insufficient guardrails.

Install only if you are comfortable giving this skill Huawei Cloud credentials that can modify OBS website settings and DNS records. Use least-privilege IAM scoped to the exact bucket and DNS zone, avoid putting AK/SK values on command lines, and verify any downloaded CLI installer before running it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill promises to configure public website access and Huawei Cloud DNS integration, but the documented behavior does not actually implement DNS changes or ACL/policy changes needed to make a site publicly reachable. This can cause operators to believe a deployment is complete or secure when critical steps were never performed, leading to broken exposure, misconfiguration, or unsafe manual follow-up actions.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The document states that a custom domain is mandatory and configuration must not proceed without it, but later steps allow verification and operation without one. This contradictory guidance can lead to policy bypass, incomplete compliance enforcement, and inconsistent operator behavior, especially if users treat default OBS endpoints as acceptable despite the earlier prohibition.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The anonymous-read verification section says 403 responses from anonymous HTTP requests may indicate missing AK/SK IAM permissions, even though the stated source of truth is a no-credential website request. This conflates control-plane credential failures with data-plane anonymous access failures, which can misdirect remediation, cause unnecessary privilege escalation, and obscure the real cause of public access problems.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide instructs users to download and immediately execute a remote shell script, which creates a supply-chain and arbitrary code execution risk if the URL, hosting bucket, or transport path is compromised. Even if this is common installer behavior, the documentation provides no integrity verification, publisher verification, or warning that the script will make system changes.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The command embeds access key and secret key directly on the command line, which can expose credentials through shell history, process listings, terminal logging, or shared session tooling. In a cloud-management skill, this is especially sensitive because leaked AK/SK credentials may allow unauthorized access to Huawei Cloud resources.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation grants write-capable permissions that can change bucket website hosting, custom-domain bindings, and DNS records, but it does not clearly warn that these actions modify public-facing infrastructure. In the context of a skill that automates OBS website hosting, this omission increases the risk that operators overgrant permissions and unintentionally enable website defacement, traffic redirection, or broader exposure of bucket-hosted content.

Static analysis

No suspicious patterns detected.