huawei-cloud-skill-creator

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:18 AM UTC
• Version: 1.0.0

Overview

This skill is a Huawei Cloud skill generator, but it also reads cloud credentials, runs live cloud tests, and can execute command strings from generated test files.

Review before installing. Use only in an isolated development environment with a non-production Huawei Cloud account, least-privilege credentials, and a budget/quota guard. Do not paste AK/SK secrets into chat; prefer explicit environment variables or profiles. Inspect templates/test-vars.json before running scripts, avoid --insecure, remove unrelated IAM/billing permissions, and require dry-run or per-command confirmation before live create/update/delete tests.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares capabilities that imply shell execution and environment access, but it does not declare permissions or narrowly scope those capabilities. In this context, the skill is not just documenting scaffolding steps; it is instructing credential discovery, command execution, and testing workflows, so undeclared access increases the risk of silent secret exposure and unsafe command execution.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs automatic scanning of broadly named environment variables to locate Huawei AK/SK credentials, which is overbroad for a skill whose main purpose is creating skill scaffolding. This can collect unrelated secrets from the environment without informed consent and expands the blast radius if the skill or downstream prompts are compromised.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill goes beyond content generation and requires live credential collection plus execution of real cloud CLI/SDK/API operations, including create/update/delete lifecycle testing. That materially increases risk because a 'skill creator' can trigger billable actions, data exposure, configuration drift, or destructive changes in a real cloud environment.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document states these permissions are required for skill creation, but the listed actions (`iam:credentials:list`, `bss:coupon:list`, `bss:coupon:view`) do not align with the stated purposes of service availability checks or test execution. This creates unjustified privilege scope and can normalize granting sensitive account- or billing-related access to a tooling component that should not need it.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Access to billing coupon information is unrelated to creating or scaffolding Huawei Cloud skills, so documenting it as part of required permissions violates least-privilege expectations. If granted in real deployments, it could expose financial or account benefit information and indicate a broader pattern of overprivileged access in generated or supporting tooling.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The script claims mutation operations only perform help or syntax checks, but in the CLI path it executes non-hcloud commands directly with `bash -c "$CMD_FINAL"`. Because test cases are sourced from `templates/test-vars.json`, a crafted skill can cause arbitrary command execution during testing, including destructive local actions or live cloud mutations. In a skill scaffolding/testing context, this is especially dangerous because users may trust the safety guarantees in the header comments.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The script auto-discovers access keys and secret keys from environment variables to perform SDK/API calls. While it does not explicitly exfiltrate them, broad credential harvesting from the environment exceeds least-privilege behavior for a local test helper and increases the blast radius if combined with unsafe command execution or future logging changes.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The trigger list contains very broad phrases such as 'create skill', 'new skill', and similar generic Chinese variants, making accidental invocation likely during ordinary conversations. In this skill, accidental invocation is more dangerous because the workflow can lead to shell use, secret access, and live cloud testing rather than harmless text generation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes automatic scanning for credential-related environment variables without an upfront user-facing warning that sensitive data may be accessed. That undermines informed consent and increases the chance that users trigger secret access unintentionally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow asks users to provide AK/SK credentials for testing but does not pair that request with clear privacy, retention, and handling warnings. Because the skill also performs live operations, missing warnings make it easier for users to disclose highly sensitive secrets in an unsafe channel.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The verification guidance includes a resource lifecycle test that explicitly performs create and destroy operations, but it provides no warning about billing impact, destructive behavior, required sandboxing, or confirmation gates. In a cloud skill creator context, users may run these steps against real accounts and production environments, leading to unintended resource creation, deletion, charges, or service disruption.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The fallback guidance permits sending API requests to a user-provided endpoint via curl without any validation or warning about endpoint trust, data exposure, SSRF-like misuse, or accidental transmission of credentials to non-Huawei or attacker-controlled hosts. Because this skill also discusses AK/SK handling, the lack of guardrails increases the chance that sensitive requests are directed to unsafe destinations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The `--insecure` flag disables TLS certificate verification for SDK API calls by setting `ignore_ssl_verification = True`, and the script does not present a strong warning or force an explicit acknowledgment at the point of use. This can enable man-in-the-middle interception of cloud API traffic, particularly risky when credentials are also being used for authenticated requests.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

svc_module = __import__('huaweicloudsdk' + svc_lower + '.v1', fromlist=[svc + 'Client'])
    Client = getattr(svc_module, svc + 'Client')
    ak, sk = '', ''
    for k, v in os.environ.items():
        u = k.upper()
        if not (u.startswith('HUAWEI') or u.startswith('HW') or u.startswith('HWC')): continue
        if 'ACCESS_KEY' in u or u.endswith('_AK') or u == 'AK': ak = v or ak

• Confidence: 86% confidence
• Finding: The embedded Python scans all environment variables and selects values matching broad Huawei/HW/HWC AK/SK naming patterns. In isolation this is credential harvesting behavior, and within this script it materially increases risk because the same tool also runs attacker-influenced commands from skill test definitions, creating a path from available secrets to unauthorized cloud actions.

Hidden Instructions

High

• Category: Prompt Injection

Content

| BSS service SDK initialization fails (GlobalCredentials) | See `references/bss-sdk-notes.md`: BSS must use GlobalCredentials + with_endpoints, not BasicCredentials + with_region |
| list_sub_customer_coupons query returns 400 | BSS limit parameter maximum is 100, not the default 200 |
| Phase 6 security audit FAIL | Fix issues item by item per skill-gate-report Section 4, rerun skill_audit.py after fixing |
| skill-scanner false positive | Use `<!-- skill-scanner:ignore -->` comment annotation, or exclude in .secrets.baseline |
| gitleaks false positive | Add to `.gitleaksignore` file |

---

• Confidence: 93% confidence
• Finding: The skill explicitly suggests using `<!-- skill-scanner:ignore -->` to suppress scanner findings. Even if framed for false positives, embedding bypass guidance in the skill normalizes hiding dangerous content and can be abused to mask genuine prompt-injection, credential, or command-execution issues from automated review.

Hidden Instructions

High

• Category: Prompt Injection

Content

| 类别 | 修复 |
|------|------|
| command_injection | 将危险命令移至 scripts/ 独立脚本，SKILL.md 中引用脚本路径 |
| reverse_shell | 移除或使用 `<!-- skill-scanner:ignore -->` 注释 |
| credential_leak | 替换硬编码密钥为 `${VAR}` 或 `os.environ.get("VAR")` |
| dangerous_function | 用 ast.literal_eval() 替代 eval()/exec()，添加输入验证 |
| prompt_injection | 审查并清理用户可控输入，使用结构化输入模板 |

• Confidence: 87% confidence
• Finding: The guide explicitly suggests using `<!-- skill-scanner:ignore -->` to suppress reverse-shell findings. Even though this appears in documentation rather than executable code, it normalizes bypassing security tooling and could enable unsafe or malicious content to pass review if copied into generated skills or audit workflows.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: huawei-cloud-skill-creator
version: 2.1.3
description: |
  1. Six-phase pipeline for creating Huawei Cloud skills — Socratic requirements gathering, CLI→SDK→API research, MD generation, test preparation, detailed testing, and final cleanup & compliance check
  2. Phase-chained dependency: each phase builds on the previous phase's output, no phase may be skipped
  3. Supports CLI, SDK, and REST API execution modes with automatic fallback detection

• Confidence: 74% confidence
• Finding: The metadata contains indicators associated with tool/manifest poisoning, and the file also includes scanner-ignore guidance elsewhere, which raises suspicion that the manifest may be trying to shape or suppress downstream security interpretation. While not conclusive on its own, in combination with broad triggers, secret scanning, and live execution behavior, this increases the risk that metadata is being used to influence tool behavior unsafely.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.