huawei-cloud-terraform-installer

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:10 AM UTC
• Version: 1.0.0

Overview

This Terraform installer is mostly purpose-aligned, but it makes broad persistent system changes and can delete user Terraform configuration without clear consent or rollback.

Review carefully before installing. Use only on a disposable or backed-up machine unless you are comfortable with Terraform binaries being installed, PATH being changed, Terraform provider configuration being overwritten, HuaweiCloud provider files being added, and uninstall potentially deleting existing Terraform configuration/provider directories. Remove the exposed test credential from the package and prefer explicit confirmation, backups, checksums, and dry-run uninstall behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # 运行 terraform init
        result = subprocess.run(
            ["terraform", "init"],
            cwd=test_dir,
            capture_output=True,

• Confidence: 91% confidence
• Finding: The script executes `terraform init` by command name from `PATH`, not by the freshly installed absolute path. If a malicious or trojanized `terraform` binary appears earlier in `PATH`, the test step will execute attacker-controlled code. In this skill context, that risk is elevated because the script is an installer and is expected to modify environment state, making users more likely to run it with elevated trust or privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 也检查系统 PATH
    try:
        if system_info["is_windows"]:
            result = subprocess.run(
                ["where", "terraform"],
                capture_output=True,
                text=True,

• Confidence: 97% confidence
• Finding: On Windows, `subprocess.run(["where", "terraform"], shell=True)` is unsafe because `shell=True` routes execution through the command interpreter and introduces command-resolution ambiguity. Combined with trusting the first `where` result, this allows execution flow to be influenced by a malicious `where.com/.exe/.bat` or a malicious `terraform` found earlier in `PATH`, leading to arbitrary command execution or incorrect binary trust decisions.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if terraform_path.exists():
        try:
            result = subprocess.run(
                [str(terraform_path), "version", "-json"],
                capture_output=True,
                text=True,

• Confidence: 90% confidence
• Finding: The script executes whatever binary was found at `terraform_path` to query its version, but that path may come from an attacker-controlled `PATH` search result. Running an untrusted executable, even for `version`, grants arbitrary code execution in the user's context. This is especially risky in an installer workflow where users may run with admin privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"   安装路径: {terraform_path}")
                return True, version
            else:
                result = subprocess.run(
                    [str(terraform_path), "version"],
                    capture_output=True,
                    text=True,

• Confidence: 88% confidence
• Finding: This fallback again executes the discovered `terraform_path`, which may refer to a malicious executable resolved from `PATH`. The absence of shell invocation does not remove the core issue: arbitrary local code can run if a hostile binary is present. As part of installation checks, this broadens the attack surface before trust has been established.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises network access and operational behavior that implies file writes, shell execution, environment inspection, and system modification, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: an agent may invoke a skill that can change PATH, write Terraform config files, or uninstall software without an explicit permission model visible to reviewers or users.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose says the skill installs Terraform CLI, but the behavior extends to provider installation, Terraform configuration rewrites, Windows registry/PATH modification, uninstall/removal flows, and test/init actions. This mismatch is dangerous because users or orchestrators may authorize a seemingly simple installer while the skill performs broader persistent system changes and can redirect provider installation through a local mirror configuration.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The verification document exposes a public IP, permits password-based root access, and includes a hardcoded root password in plaintext. Even in test documentation, publishing live-style administrative credentials and remote access details creates a direct credential exposure pattern that can enable unauthorized access if reused, copied into real environments, or harvested from repositories.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill advertises Terraform installation, but it also installs the HuaweiCloud provider and rewrites the user's Terraform CLI configuration to force a filesystem mirror/direct policy. This is an unexpected expansion of scope that alters future Terraform behavior beyond simple CLI setup, increasing supply-chain and persistence risk because all subsequent provider resolution may be influenced by the written config.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The provider test is not a passive validation; it initializes Terraform with a real HuaweiCloud provider configuration and a live data source query. That creates unnecessary outbound network activity and may use ambient credentials, causing unintended access to cloud resources or metadata. In a Terraform installer skill, performing a real cloud operation is more dangerous than a simple binary check.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The uninstall logic deletes `terraformrc` and the entire provider directory tree, which affects broader Terraform user configuration and cached/provider state beyond uninstalling the CLI binary. This can remove unrelated providers or user settings, causing data loss and persistent workflow disruption. The skill context makes this more concerning because users would reasonably expect only Terraform CLI removal.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad enough that the skill may be invoked for general Terraform-related conversations or missing-tool detection, not just explicit install requests. In context, this is risky because the skill performs network downloads and environment modification, so overbroad activation increases the chance of unintended installation, configuration changes, or destructive operations being suggested or run.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation exposes an uninstall capability but does not warn that it may remove Terraform binaries, delete provider/configuration files, or alter the user's environment. In an agent setting, omission of these consequences can lead to accidental destructive actions on a workstation or CI environment without informed consent or recovery guidance.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The test scenarios document actions that install software, modify PATH, run `terraform init`, and uninstall Terraform, but they do not warn users that these operations change the host system and may download code, alter shell configuration, or remove installed tools. In a skill meant to automate Terraform setup, omitting safety and impact notices increases the chance that a user or agent will execute destructive or environment-altering steps without informed consent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The uninstall verification documents deletion of Terraform binaries, configuration, and provider files without warning about destructive side effects or potential loss of local setup state. In an installer skill context, omission of such warnings increases the chance of accidental disruption to user environments, especially if the document is followed verbatim on non-disposable systems.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The remote execution section tells users to upload and run the installer over SSH without warning that this will modify the remote machine. In the context of an installation skill that performs system changes, failing to state that the action is mutating can lead to accidental changes on the wrong host or on production-like systems.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The verification document advertises an uninstall flow that deletes the Terraform binary, user terraformrc configuration, and provider cache without any explicit warning, confirmation, or data-loss notice. In a skill intended to automate Terraform setup, this can normalize destructive behavior and lead users or agents to remove local tooling and configuration unexpectedly, potentially disrupting infrastructure workflows or erasing customized provider settings.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The uninstall path performs irreversible deletions of binaries, config files, and provider directories without confirmation or dry-run support. A mistaken invocation or automation error can therefore destroy user configuration and installed providers immediately. In an agent skill, unattended destructive behavior is particularly risky.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# 也检查系统 PATH
    try:
        if system_info["is_windows"]:
            result = subprocess.run(
                ["where", "terraform"],
                capture_output=True,
                text=True,

• Confidence: 95% confidence
• Finding: This finding is valid because the script takes output from a PATH-based discovery step on Windows and uses it to establish trust in a binary, while also using `shell=True`. The combination enables command-resolution abuse and untrusted executable selection, which can lead to arbitrary code execution when the resolved binary is later run.

Unvalidated Output Injection

High

• Category: Output Handling

Content

try:
        # 运行 terraform init
        result = subprocess.run(
            ["terraform", "init"],
            cwd=test_dir,
            capture_output=True,

• Confidence: 90% confidence
• Finding: Running `terraform init` by bare command name allows PATH hijacking: the script may execute an attacker-supplied `terraform` instead of the intended binary. Because `terraform init` also processes provider installation logic, this can additionally trigger unintended network access or plugin execution under the user's privileges.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 也检查系统 PATH
    try:
        if system_info["is_windows"]:
            result = subprocess.run(
                ["where", "terraform"],
                capture_output=True,
                text=True,

• Confidence: 96% confidence
• Finding: Using `shell=True` for a simple lookup command is unnecessary and opens the door to tool-parameter abuse through shell semantics and executable resolution behavior. In an installer, this can subvert control flow early and cause the script to trust or interact with attacker-controlled tools, increasing the chance of arbitrary code execution.

Static analysis

No suspicious patterns detected.