ClawHub
Back to skill

Security audit

huawei-cloud-vpcep-name-list

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only Huawei Cloud VPCEP lookup skill, but users should handle the CLI install and cloud credentials carefully.

Install only if you are comfortable using Huawei Cloud credentials on this machine. Prefer a least-privilege VPCEP read-only IAM policy, avoid pasting real secrets into shared shells or logs, verify the hcloud CLI source or checksum where possible, and confirm that name-filtered results match the endpoints you expect before using the skill for security inventory.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill claims endpoint-name fuzzy filtering, but the documented parameter `endpoint_service_name` appears to filter by service name instead. This can mislead operators into querying the wrong resource set, causing incomplete or incorrect inventory results and potentially hiding endpoints that should be reviewed during security or operational checks.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The guide instructs users to set long-lived access keys directly on the command line and via environment variables without any warning about shell history, process inspection, or accidental leakage through logs and shared sessions. In a cloud administration context, exposed AK/SK credentials can allow unauthorized API access to enumerate or modify cloud resources depending on the account permissions.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The installation steps download an executable from the network, extract it, and place it into a system PATH location using elevated privileges, but provide no checksum/signature verification or warning about trust and system-wide impact. If the download source is compromised, redirected, or tampered with, users could install a malicious binary with broad execution reach.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
curl -sL https://hwcloudcli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_cli_linux_amd64.tar.gz -o hcloud.tar.gz
tar -xzf hcloud.tar.gz
chmod +x hcloud
sudo mv hcloud /usr/local/bin/

# macOS
curl -sL https://hwcloudcli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_cli_mac_amd64.tar.gz -o hcloud.tar.gz
Confidence
82% confidence
Finding
The use of sudo to move the downloaded binary into /usr/local/bin requires elevated privileges and increases the consequences of installing an unverified executable. While sudo is common for system-wide CLI installation, combining privilege elevation with unsigned or unverified downloads creates a meaningful supply-chain and local system integrity risk.

Static analysis

No suspicious patterns detected.