huawei-cloud-ascend-command

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:34 PM UTC
• Version: 1.0.0

Overview

The skill’s NPU-management purpose is real, but it exposes high-impact local and remote administration paths that are not consistently scoped or guarded.

Install only in a controlled Ascend administration environment. Treat it as a powerful hardware-management tool, avoid command-line SSH passwords and root accounts where possible, verify the target host before remote use, and do not use raw npu-smi passthrough unless you have reviewed the exact command and its impact.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill explicitly allows `bash`, `python3`, and `ssh` and is designed to execute administrative NPU management commands locally or on remote hosts, but the finding indicates shell-capable behavior is not properly declared in the permission model. In this context, the mismatch is dangerous because the skill can perform configuration changes, firmware upgrades, and remote command execution, so under-declared execution capability weakens policy enforcement and informed consent.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The acceptance criteria require SSH support via the paramiko library, but the deployment criteria simultaneously claim there are no external dependencies beyond the standard library. This contradiction can lead to insecure or inconsistent implementations, such as ad hoc SSH handling, undocumented dependency bypasses, or broken security review assumptions around how remote access is performed. In a skill that supports remote device administration, dependency ambiguity increases the chance of unsafe credential handling and unreviewed remote-execution code paths.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The reference file exposes high-risk management capabilities that are broader than the declared skill description, including secure boot changes, clock/performance tuning, thermal threshold modification, and full configuration reset. This mismatch weakens user and platform understanding of the skill’s true privileges and can enable unexpected destructive or security-relevant actions, especially in a remote device-management context where natural-language requests may trigger impactful configuration changes.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file exposes generic remote command execution beyond the declared NPU-management scope. execute_batch accepts arbitrary command strings, and the FLOPS helpers invoke mkdir, cat, rm, redirection, background execution, and shell chaining on the target host, creating a broad SSH command-execution surface that could be abused for unauthorized actions if any upstream input reaches these methods.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: execute_batch is a generic command multiplexer that combines caller-supplied strings and sends them to exec_command over SSH. Because it is not limited to the documented NPU operations, it can be used as an arbitrary remote execution primitive, which is especially dangerous in an agent skill that may receive indirectly user-influenced inputs.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The parallel FLOPS implementation performs shell orchestration and filesystem manipulation on the remote host using mkdir, output redirection, background jobs, cat, and rm -rf. Even though intended for testing, this expands the skill from device management into generic host-side command execution patterns and introduces additional abuse and operational risk on the managed system.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list includes many generic terms such as `power`, `memory`, `compute`, `health`, `temperature`, and multilingual variants, making accidental activation likely during normal conversation. Because this skill can invoke shell and SSH-backed administrative actions, over-broad triggering increases the chance that an unrelated user request is routed into a powerful execution path.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The best-practices section repeats broad keyword guidance without defining precise activation boundaries, so the agent may select this skill on ambiguous inputs. In a skill that supports remote SSH access, firmware upgrades, vNPU creation, and configuration changes, ambiguous invocation materially raises the risk of unintended execution or unnecessary exposure of privileged workflows.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The verification commands are described as broad natural-language phrases for operational queries and controls, which can blur the boundary between harmless conversation and actionable command execution. In an agent skill that interfaces with hardware management functions, ambiguous triggering can cause unintended execution of monitoring or control actions when a user is merely asking about capabilities or discussing device state.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The document describes remote SSH operations and virtualization management using vague action phrases without clear activation constraints, authorization expectations, or separation between read-only and state-changing actions. Because these capabilities can create/delete vNPUs and execute commands on remote hosts, trigger ambiguity materially raises the risk of unintended destructive or security-sensitive operations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The acceptance criteria explicitly support password-based SSH command execution but do not require any user warning, consent messaging, or safeguards around credential entry, storage, transmission, or the impact of running commands on a remote system. In the context of a remote hardware-management skill, this is dangerous because it normalizes sensitive credential handling and remote execution without transparent risk communication or guardrails.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The natural-language triggers in this section are generic terms such as temperature, power, memory, usage, and ECC that can easily appear in unrelated conversations. In an agentic system, overly broad triggers can cause unintended skill activation and execution of hardware-management commands in the wrong context, which is a real security and safety concern even if the file is only a reference document.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: Defaulting to NPU 0 and Chip 0 when the user does not specify a target can broaden the scope of actions beyond explicit user intent. In a management skill that may later be paired with mutating operations, implicit targeting increases the chance of querying or acting on the wrong device, especially in multi-device or remote SSH environments.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The troubleshooting guide recommends `chmod 666 /dev/davinci*`, which grants read/write access on NPU device nodes to all local users. In a hardware-management skill that supports configuration, firmware, virtualization, and monitoring, this can expose sensitive device control and telemetry to unauthorized local processes and weaken host isolation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The verification examples show SSH passwords passed directly on the command line (`--password xxx`). Command-line arguments are commonly exposed through shell history, process listings, audit logs, and CI job logs, which can leak credentials to other local users or operators. In a remote device management skill that may be used against production NPU hosts, this creates a realistic credential exposure risk.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The direct `npu-smi` passthrough executes any user-supplied subcommand immediately via `self.client._run_npu_smi(text[7:].strip())`, bypassing the confirmation flow used for sensitive natural-language operations. In this skill context, `npu-smi` supports configuration changes, firmware actions, virtualization management, and certificate operations, so a user can trigger destructive or high-risk device actions without warning or policy checks.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The interactive interface advertises destructive operations such as ECC changes, fan control, firmware upgrade, activation, and vNPU management without any confirmation, privilege warning, or safety interlock. In a hardware-management skill, this increases the chance of accidental or socially engineered misuse that could disrupt accelerator availability, degrade performance, or cause operational downtime.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code allows direct execution of arbitrary npu-smi arguments, including over SSH with username and password parameters, without guardrails, confirmation, or restrictions to safe subcommands. Because this skill is specifically for remote NPU administration, exposing a raw pass-through command path raises the risk of unintended remote configuration changes, misuse of privileged credentials, and execution of disruptive hardware-management actions on production devices.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The client directly exposes state-changing and potentially disruptive operations such as ECC changes, fan changes, vNPU creation/destruction, certificate threshold changes, and firmware upload/activation without any built-in confirmation, dry-run, or safeguard layer. In an agent context, this raises the chance of accidental or unauthorized destructive actions affecting hardware availability, stability, or security posture.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The module executes local subprocesses and remote SSH commands transparently, but there is no user-facing disclosure or policy gate in this layer to distinguish read-only inspection from active command execution on the host. In an agent skill, hidden execution can materially increase risk because users may not realize their prompt can trigger commands on local or remote infrastructure.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Solution:**
1. Check resource allocation
2. Update firmware
3. Run as root

### Issue: vNPU performance slow

• Confidence: 88% confidence
• Finding: Run as root

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.