huawei-cloud-swr-enterprise-instance

• Outcome: Pass
• Latest audit: Aug 3, 2026 · 9:14 AM UTC
• Version: 1.0.0

Overview

This is a disclosed cloud registry management skill with powerful admin actions, but I found no hidden or deceptive behavior.

Install only if you intend to let the agent help administer Huawei Cloud SWR enterprise registries. Use least-privilege IAM, prefer temporary credentials, avoid pasting real secrets into chat or shell history, confirm all create/update/delete commands, and be especially careful with public access, 0.0.0.0/0 whitelists, anonymous access, and deletion of instances, namespaces, repositories, artifacts, domains, or credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The uninstall section includes destructive commands that delete both the CLI binary and the entire local hcloud configuration directory, which may contain stored credentials and settings, but it does not explicitly warn users about that data loss. In an installation guide for a cloud-management CLI, this omission can lead to accidental credential deletion or operational disruption if users copy-paste the commands without understanding the consequences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly states that long-term credential output includes authentication token information, but provides no warning to treat that output as secret, avoid displaying it, or redact it from logs. In this skill context, the agent is used to manage SWR enterprise registries and credentials, so undocumented token exposure can easily lead to accidental disclosure in chat responses, command logs, transcripts, or downstream tooling.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide documents creation of long-term and temporary credentials without warning that the returned secret material may only be shown once and must be handled as sensitive data. In a registry-management skill, users are likely to copy, log, or paste issued credentials into shared terminals or transcripts, increasing the risk of credential leakage and unauthorized image access.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The registry examples normalize passing usernames and especially access secrets directly on the command line, where they can be exposed via shell history, process listings, audit logs, or terminal recording. The same section also shows insecure TLS mode without a strong warning, which can enable man-in-the-middle interception of credentials and registry traffic if adopted in production.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide shows enabling anonymous access without clearly warning that this can make registry access publicly available, depending on service behavior and repository settings. In an enterprise container registry context, this increases the chance of unintended disclosure of images, metadata, and supply-chain artifacts if users enable it casually.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The public endpoint enablement workflow is documented without an explicit warning that it exposes the instance externally and may broaden the attack surface to the internet. Because this skill manages enterprise registries, accidental public exposure could allow unauthorized probing, brute-force attempts, metadata enumeration, or access to misconfigured public content, especially if whitelist controls are weak or replaced incorrectly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The cleanup scenario includes a direct `DeleteInstanceArtifact` command in an example workflow without an immediate confirmation gate at the point of deletion. In an agent skill, users or downstream automation may follow the workflow verbatim, which increases the chance of irreversible deletion of production or still-needed image artifacts, especially because artifact deletion is destructive and can disrupt deployments or rollback capability.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The cleanup workflow shows a destructive `DeleteDomainName` command inline without an immediate warning at the point of execution, even though deleting a custom registry domain can disrupt image push/pull operations and break dependent workloads. In an agent skill context, users or automation may copy the command directly from the scenario section and miss earlier cautions, increasing the chance of accidental service-impacting deletions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The public access enable/disable workflow describes how to turn external registry access on or off, but it does not prominently warn that enabling public access expands the attack surface or that disabling it can immediately break legitimate image pull/push workflows. In an infrastructure management skill for container registries, omission of these operational security consequences can lead users to expose sensitive registries or unintentionally cause outages.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The example explicitly shows configuring `0.0.0.0/0`, which makes the registry reachable from any IP, but only says 'use with caution' rather than clearly marking it as a dangerous last-resort configuration. In the context of an enterprise container registry, this can expose proprietary images, increase credential attack surface, and invite unauthorized access attempts from the internet.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The examples explicitly demonstrate using a highly privileged Harbor `admin` account and passing the password directly on the command line, but they do not warn that CLI arguments may be exposed via shell history, process listings, logs, or transcript capture. In an infrastructure-management skill, users are likely to copy these commands verbatim, which increases the chance of credential leakage and over-privileged registry integration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The verification steps instruct users to create temporary and long-term credentials and note that credential information will be returned, but they do not explicitly warn that these values are secrets that must not be logged, pasted into chats, committed to files, or exposed in terminal history/screenshots. In a cloud administration skill, this omission is dangerous because users may treat returned output as routine verification data and inadvertently leak registry credentials that enable unauthorized image access or repository manipulation.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The condensed checklist repeats commands for creating credentials and deleting namespaces, credentials, and instances without reiterating the earlier cautions about permanent deletion or secret handling. In checklist form, operators may execute commands mechanically, so the absence of repeated safety markers increases the chance of accidental destructive actions or careless credential exposure during verification.

Credential Access

High

• Category: Privilege Escalation

Content

| `--url`                     | Yes      | Registry URL             | Target registry address                      |
| `--credential.type`         | Yes      | Auth type                | `basic` only                                 |
| `--credential.access_key`   | Yes      | Access ID/username       | Auth credential                               |
| `--credential.access_secret` | Yes    | Access secret/password   | Auth credential                               |
| `--insecure`                | Yes      | Verify remote cert       | `true` (skip) or `false` (verify)            |
| `--instance_id` (body)      | Cond.    | Target instance ID       | Required when type=swr-pro-internal          |
| `--project_id` (body)       | Cond.    | Target project ID        | Required when type=swr-pro-internal          |

• Confidence: 85% confidence
• Finding: The skill defines a command interface that accepts and uses sensitive registry secrets via command-line parameters such as `--credential.access_secret`. Secrets passed on the CLI are commonly exposed through shell history, process listings, audit logs, transcripts, and agent/tool logging, making credential compromise plausible in real deployments.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

- `--anonymous_access`: Whether unauthenticated users can pull images without credentials. Values: `true` or `false`. Default is `false` for security.
  - `true`: Enables anonymous pull access — anyone with network access can pull images (useful for public image distribution)
  - `false`: Requires authentication for all pull operations (recommended for production)
  - **Security Impact**: Setting `anonymous_access=true` bypasses namespace-level access control for pull operations. Only enable for public-facing image registries.
  - **Prerequisite**: The instance must have public access enabled (via `CreateInstanceEndpointPolicy --enable=true`) for anonymous access to work externally.
  - **Verification**: After updating, call `ShowInstanceConfiguration` to confirm the change took effect.

• Confidence: 93% confidence
• Finding: The skill includes guidance and example commands to enable anonymous image pull access, which weakens access control and can expose private container artifacts to unauthenticated users if used inappropriately. Although the text notes security implications, presenting an insecure option in an operational skill increases the chance of accidental exposure, especially in production or mixed-sensitivity registries.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.