huawei-cloud-sac-new-api

• Outcome: Review
• Latest audit: Aug 5, 2026 · 1:14 PM UTC
• Version: 1.0.1

Overview

This Huawei Cloud deployment skill is coherent, but it handles cloud credentials and destructive infrastructure actions in ways users should review carefully before installing.

Install only if you are comfortable letting the agent prepare and run Terraform against a Huawei Cloud account. Use a least-privilege IAM user, review terraform plan before apply, confirm destroy separately, avoid primary account credentials, keep terraform.auto.tfvars.json out of version control and backups, delete it after use, and prefer user-local tool installation paths over system directories.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell commands, reads environment variables, downloads remote content, and writes local files including a tfvars file, yet no explicit permission model is declared. This creates a real security gap because an agent may execute high-impact actions without clear sandboxing or user-visible authorization boundaries, increasing the risk of credential misuse, unintended file access, or destructive infrastructure changes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims to deploy a specific Huawei Cloud solution, but it also scrapes web content, downloads a Terraform template from a URL, rewrites provider configuration, and materializes credentials into terraform.auto.tfvars.json. That mismatch is dangerous because it hides a broader trust boundary: remote content can influence infrastructure code and credential handling, which could lead to supply-chain abuse, malicious template substitution, or secret exposure through downstream tooling.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script goes beyond provider normalization and writes cloud credentials into terraform.auto.tfvars.json on disk. Persisting access keys and secret keys to a predictable file materially increases exposure through accidental commits, local compromise, artifact collection, backups, or downstream tooling that reads workspace files.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The utility harvests HW_ACCESS_KEY and HW_SECRET_KEY from the environment and persists them to disk without that behavior being necessary for source normalization. In deployment/CI contexts, environment variables often carry highly privileged cloud credentials, so silently converting them into a local file broadens the attack surface and creates durable secret sprawl.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide instructs users to unzip Terraform directly into /usr/local/bin, a privileged system directory, without warning that this modifies shared system state and may require elevated privileges. This can lead users to run the command with sudo or overwrite an existing terraform binary, creating integrity and operational risk if the archive URL is mistyped, replaced, or if a local packaging policy is bypassed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Windows instructions expand the Terraform archive into $env:SystemRoot\system32, a protected system directory, without warning about administrative rights, system-wide impact, or possible replacement of existing executables. Writing third-party binaries into system32 increases the chance of unintended system modification and can normalize unsafe installation practices for users following the guide.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly grants delete permissions for core infrastructure resources such as ECS instances, VPCs, subnets, EIPs, and volumes, but it does not clearly warn operators that apply/destroy workflows can irreversibly remove infrastructure, interrupt service, or delete attached data. In a deployment skill, this omission increases the chance of accidental misuse or overbroad IAM assignment, especially by less experienced users following the example policy verbatim.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The file explicitly recommends `ssh root@<EIP>` for remote administration without any warning or safer alternative. In a deployment skill for an internet-reachable LLM gateway, normalizing direct root login increases the chance of insecure operational practices, broadens blast radius if credentials are exposed, and may encourage users to bypass least-privilege access controls.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document explicitly verifies writing cloud access credentials into a local `terraform.auto.tfvars.json` file, but provides no warning about secure handling, file permissions, secret exposure in logs/backups, or safer alternatives. In a deployment skill that handles real Huawei Cloud AK/SK credentials, this omission increases the chance of credential leakage through the working directory, shell history, backups, or accidental reuse beyond the intended session.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The verification method instructs operators to run `terraform apply` and later `terraform destroy`, which are cost-incurring and destructive infrastructure actions, yet the file does not require a clear user-facing warning or reconfirmation immediately before execution. In an infrastructure deployment skill, this can lead to unintended cloud charges, accidental creation of internet-exposed resources, or deletion of active resources if reused in the wrong workspace or account.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script automatically opens a second page and navigates to a URL discovered from the current page's links without constraining the destination to a trusted allowlist. Even though this is intended to scrape pricing documentation, a hostile or compromised source page could supply attacker-controlled links that trigger unintended outbound requests, access untrusted content, or influence downstream extraction results.

Static analysis

No suspicious patterns detected.