huawei-cloud-swr-image-automation

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:26 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned, but it needs Review because its guides include high-impact cloud deployment changes and remote CLI installation steps without enough local warnings or integrity checks.

Install only if you are prepared for the agent to help manage real Huawei Cloud SWR replication and auto-deploy triggers. Use temporary least-privilege credentials, prefer test repositories and non-production clusters for verification, verify any downloaded CLI installer or binary before running it, and require explicit confirmation before any create, update, delete, override, image push, or trigger-enable action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The verification guide expands beyond SWR automation into adjacent capabilities: retrieving SWR registry authorization tokens and inspecting CCE deployment state. Even though these are framed as verification steps, they broaden the operational scope of the skill and encourage use of credentials and downstream cluster inspection that are not strictly necessary for validating core SWR configuration flows. In a security-sensitive automation context, scope expansion increases the chance of unintended access, credential exposure, or misuse of connected infrastructure.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases include broad, common terms such as '触发器', '自动部署', 'auto deploy', and 'image replication', which can cause the skill to activate in contexts broader than intended. Because this skill performs cloud registry replication and deployment-trigger management, accidental invocation can steer an agent toward high-impact write operations or risky guidance, even though the document does require confirmation for writes.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs users to download and immediately execute a remote shell script via curl piped into bash without any integrity verification, signature check, or warning about the trust boundary. If the hosting location, CDN path, or transport chain is compromised, this becomes arbitrary code execution on the user's machine, and the non-interactive -y variant increases the risk by removing a user review step.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The trigger creation examples configure automatic deployment to CCE/CCI on image push, but the surrounding text does not clearly warn that enabling these triggers can cause immediate deployment-side effects in live environments. In an automation skill focused on operational CLI usage, users may copy-paste these commands into production and unintentionally roll out unreviewed or unstable images, creating avoidable availability and change-control risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The manual sync example uses `--override=true` without a nearby warning that this can overwrite existing images in the target region. In a repository automation context, that can replace artifacts consumers depend on, causing rollback difficulty, integrity confusion, or downstream deployment disruption if users run the example without understanding the overwrite semantics.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This section includes state-changing operations such as creating and deleting image sync configurations without an explicit warning that they modify cloud repository settings. Users following a 'verification' guide may assume the steps are safe and read-only, increasing the risk of making unintended changes in production repositories or cross-region replication setups.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The trigger management steps create, modify, and delete deployment triggers tied to a CCE cluster, but they do not clearly warn that these actions can alter live deployment behavior. Enabling or changing a trigger can cause automatic workload updates, potentially impacting availability, rollout timing, or application state in connected clusters.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The end-to-end workflow instructs users to create a trigger, obtain registry credentials, push a new image, and then verify workload updates, but it does not explicitly warn that this sequence can trigger real downstream deployments. Because the section is framed as verification, users may unintentionally roll out new images to active CCE workloads, creating deployment, stability, or change-control risks.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# AMD 64-bit system
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
sudo mv hcloud /usr/local/bin/

# ARM 64-bit system
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"

• Confidence: 83% confidence
• Finding: Using sudo to place a downloaded executable into /usr/local/bin elevates the effect of any prior compromise in the downloaded artifact, turning it into a system-wide trusted command. While sudo itself is normal for installation, the surrounding workflow lacks integrity verification, so a malicious binary would be installed with elevated trust and potentially affect all users on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Intel chips (AMD 64-bit)
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
sudo mv hcloud /usr/local/bin/

# Apple Silicon (ARM 64-bit)
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"

• Confidence: 83% confidence
• Finding: The macOS instructions similarly use sudo to move a downloaded executable into a globally trusted path, which can magnify the impact of a tampered binary. In the context of an automation skill that will be used by operators handling cloud credentials, compromise of the CLI can also expose AK/SK tokens and enable unauthorized cloud actions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.