huawei-cloud-ascend-models-deploy

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:32 PM UTC
• Version: 1.0.0

Overview

The skill is coherent for model deployment, but it asks agents to run unverified downloaded shell scripts and long-running commands on DevServers, so it needs careful review before use.

Install only if you are comfortable letting the agent generate and, after confirmation, run deployment commands on your Ascend DevServer. Before executing any generated command, inspect the downloaded script source, prefer pinned versions with checksums or signatures, avoid running as root where possible, and verify any process before terminating it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill contains extensive shell command generation and remote execution behavior but does not declare corresponding permissions or capability boundaries. This creates a transparency and policy-enforcement gap: an agent or reviewer may underestimate that the skill can drive SSH, shell, wget, nohup, and script execution on remote infrastructure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description frames the skill as deployment/testing assistance, but the body goes further by constructing concrete commands that download and execute remote scripts from Huawei OBS using wget and shell. That mismatch is dangerous because users and orchestration layers may invoke the skill expecting informational help, while it actually enables execution of externally hosted code on privileged remote servers.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The deployment instructions download shell scripts from a remote URL with wget and immediately execute them via sh, without any integrity verification, pinning, or warning to the operator. This creates a supply-chain execution risk: if the remote object, hosting bucket, DNS, or network path is compromised, arbitrary code would run on the Ascend DevServer with the user's privileges, likely affecting model hosts and credentials.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The troubleshooting guide instructs users to run `kill -9 <PID>` after identifying a process on port 8080, but it provides no warning to verify process ownership, service criticality, or to prefer graceful termination first. In an operational deployment skill, this can cause accidental termination of unrelated or critical services, leading to avoidable denial of service or data loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The helper generates a one-line command that downloads a shell script from a remote URL and immediately executes it in the background. This creates a supply-chain and arbitrary code execution risk because there is no integrity verification, trust prompt, pinning to an immutable artifact, or review step before execution; in a deployment skill that is specifically meant to run on target infrastructure, this is more dangerous than in a purely informational tool.

Unbounded Output

Medium

• Category: Output Handling

Content

| finish_reason | stop |

Model Response:
[Extract full content, no truncation]

Raw Response:
[Full JSON, no truncation]

• Confidence: 88% confidence
• Finding: no truncation

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.