Security audit

huawei-cloud-rds-smart-service

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Huawei Cloud RDS administration tool, but it asks users to grant broad database-changing authority with weak scoping and safety guidance.

Install only if you intend to let an agent help administer Huawei Cloud RDS. Prefer a read-only IAM role first, scope permissions to specific instances/projects, avoid full-access roles except for break-glass use, inspect any remote install script before running it, protect AK/SK credentials, and require explicit confirmation plus maintenance-window planning before restore, delete, failover, resize, parameter, security, or session-kill actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (15)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: # Execute command start_time = time.time() try: process = subprocess.run( command, shell=True, capture_output=True,
Confidence: 98% confidence
Finding: process = subprocess.run( command, shell=True, capture_output=True, text=True, timeout=60, )

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill advertises and documents access to environment variables, shell execution, and file operations, but no corresponding permissions are declared. This creates a transparency and policy-enforcement gap: an invoking platform or reviewer cannot accurately understand or constrain what the skill can do, especially given its ability to read cloud credentials and execute mutating RDS commands.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest description presents six domains, but the body adds a separate Security Management capability with actions like security group changes, SSL switching, and audit policy changes. Undisclosed security-administration scope increases the chance of users or governance controls invoking a more powerful skill than expected.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill documents high-impact and destructive operations such as disk reduction, failover, backup deletion, and restore actions that are not fully disclosed in the manifest summary. Hidden mutating capability is dangerous because it can cause data loss, service disruption, or production changes under the guise of a more limited advisory/diagnostic skill.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The test suite exercises audit-log policy and audit-log retrieval capabilities that are not declared in the manifest’s documented capability domains. This creates a scope mismatch: reviewers, policy engines, or users may approve the skill based on incomplete functionality disclosure, while the skill still accesses sensitive security telemetry such as audit configuration and audit records. In a cloud RDS context, audit logs can expose privileged activity, account identifiers, SQL metadata, and operational security posture, so undeclared access increases the risk of over-privileged or insufficiently reviewed behavior.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger list includes broad phrases like 'DBA', 'RDS', 'database instance', and generic troubleshooting/performance terms that could match ordinary conversation. Because this skill can perform impactful cloud database actions, overbroad triggering raises the risk of accidental invocation and unintended operational changes.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The acceptance criteria explicitly require showing backup download links but do not pair that capability with any warning, access control expectation, redaction guidance, or handling requirements for potentially sensitive backup artifacts. In the context of an RDS administration skill, backup links can expose full database contents or time-limited signed URLs, so omitting safeguards increases the risk of accidental disclosure through chat output, logs, screenshots, or misuse by an over-privileged operator.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The guide instructs users to download and immediately execute a remote script via `curl ... | bash` with no integrity verification, signature check, or review step. If the hosting endpoint, network path, or script contents are compromised, users could execute arbitrary code on their systems, which is especially risky in a database administration skill likely used on privileged workstations or servers.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The authentication section tells users to place access keys and secret keys directly into shell commands and persistent configuration without warning about shell history, process inspection, file permissions, or secret leakage from shared environments. In an RDS administration context, exposure of AK/SK credentials could allow unauthorized access to cloud database resources and related infrastructure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document recommends highly permissive IAM patterns such as wildcard actions, wildcard resources, and even `RDS FullAccess`/`RDS Administrator`, while the skill supports sensitive mutating operations including restore, delete, failover, kill, and parameter changes. In a database administration skill, these permissions materially increase blast radius: prompt misuse, operator error, or compromise of the agent could lead to destructive changes, service disruption, or data loss across all RDS instances.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide recommends disruptive recovery actions such as failover and restore operations with only minimal notation and without clearly warning about service interruption, role changes, or possible data/state consequences. In an operations skill, users may follow the decision tree directly, so missing impact warnings increases the chance of accidental production disruption during troubleshooting.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide suggests killing database sessions as a resolution action without warning that doing so can terminate active user connections, abort in-flight transactions, and cause application errors. Because this skill is explicitly for live RDS operations and troubleshooting, operators may apply the step in production, making the omission materially risky.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide recommends operationally disruptive actions such as adding/removing indexes, tuning instance parameters, and creating SQL concurrency limits, but it does not warn users about possible latency spikes, lock contention, restarts, reduced throughput, or the need for rollback planning. In an RDS operations skill, users may treat this as prescriptive runbook guidance and apply changes directly in production, increasing the chance of self-inflicted availability or performance incidents.

Unvalidated Output Injection

High

Category: Output Handling
Content: # Execute command start_time = time.time() try: process = subprocess.run( command, shell=True, capture_output=True,
Confidence: 92% confidence
Finding: subprocess.run( command, shell=True, capture_output

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # Execute command start_time = time.time() try: process = subprocess.run( command, shell=True, capture_output=True,
Confidence: 97% confidence
Finding: subprocess.run( command, shell=True

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.