Security audit

huawei-cloud-sac-yolo

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Huawei Cloud YOLO deployment purpose, but it needs Review because it persists cloud credentials locally and guides highly privileged cloud changes.

Install only if you are comfortable with a skill that can guide real Huawei Cloud infrastructure creation and charges. Use a test account or tightly scoped IAM user, avoid primary account keys, review Terraform plans and costs before apply, do not commit terraform.auto.tfvars.json, restrict SSH/UI access to your IP or VPN, and rotate any AK/SK written to disk.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to access environment variables, read/write local files, fetch remote content, and run shell/Terraform commands, yet it declares no explicit permissions. This weakens review and consent boundaries: a user or platform may not realize the skill can handle cloud credentials, modify tfvars, and execute infrastructure-changing commands.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill claims to deploy a specific YOLO platform, but its behavior is more generic: it scrapes pages, downloads Terraform from URLs, rewrites provider configuration, and injects credential references into tfvars. That mismatch is dangerous because it can be used as a broader remote-template execution pathway, increasing the chance of deploying unexpected infrastructure or consuming attacker-influenced Terraform content.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This script performs more than provider normalization: it writes a terraform.auto.tfvars.json file containing access_key and secret_key sourced from the environment. That creates a plaintext credential file in the target Terraform directory, which can be accidentally committed, copied into artifacts, or exposed to other local users and tooling.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module and CLI descriptions state the tool only normalizes provider sources, but the implementation also injects credential variables and writes credential tfvars files. This mismatch is security-relevant because operators may run the tool expecting a safe refactor while it silently materializes secrets into project files.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document instructs users to authorize the `rf_admin_trust` agency with the broad `Tenant Administrator` policy over `All resources` without an explicit warning about the security implications or any attempt to scope permissions down. In a deployment skill, this can normalize excessive privilege, increasing the blast radius of any compromise of RFS, the agency, or the deployment workflow.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Documenting direct `ssh root@<EIP>` access normalizes logging in as the root account over the public internet without any caution about key management, least privilege, IP restrictions, or bastion use. In a GPU training deployment exposed via a public EIP, this increases the chance of insecure operator behavior and raises the blast radius if credentials are mishandled or the host is compromised.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: Publishing the platform URL as `http://<EIP>:8001` without any warning implies direct access over plaintext HTTP on a public IP and omits any mention of authentication, TLS, firewalling, or exposure minimization. In the context of a YOLO training platform, this could lead operators to expose an administrative or data-bearing UI to the internet with weak transport and access controls.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide explicitly verifies writing cloud access credentials into `terraform.auto.tfvars.json`, which stores long-lived secrets on disk in a common Terraform input file. Even though it notes the file should not be tracked in git, that does not address local disk exposure, accidental sharing, backups, shell/workspace leakage, or reuse by other processes; in a cloud-deployment skill, compromise of AK/SK can lead directly to unauthorized infrastructure control.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The verification step treats `terraform apply` success as a normal check but does not include an explicit warning that it will create real cloud resources, modify the user's environment, and potentially incur charges. In the context of a GPU training deployment skill, this is more dangerous than a generic example because GPU ECS resources are often expensive and provisioning can have immediate financial and operational impact.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script automatically follows a secondary URL discovered in page content and loads it in a new browser page without constraining the destination to an allowlist or same-origin policy. In a browser-automation skill, this expands the trust boundary to attacker-controlled links on the visited page, which can trigger unintended outbound requests, collect data from untrusted pages, or interact with hostile content beyond the original target.

Static analysis

No suspicious patterns detected.