huawei-cloud-ascend-small-model-migrate

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:33 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent NPU migration purpose, but it exposes root SSH credentials and normalizes privileged server/container actions without enough safeguards.

Do not install or use this skill as-is against real infrastructure. Remove the plaintext root credential, rotate any affected password, use authorized least-privilege SSH access, run commands only in disposable or approved test environments, pin and review package changes, and load only trusted model artifacts or safer checkpoint formats.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill exposes hardcoded root SSH credentials in plaintext and presents them as the default environment for use. Anyone with access to the skill can attempt privileged access to the referenced server, enabling full system compromise, data theft, service disruption, and lateral movement.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The ResNet example uses `getattr(models, model_name)(pretrained=True)`, which can trigger an implicit network download of model weights if they are not already cached. That expands the skill from local migration/verification into remote resource retrieval, which introduces unnecessary supply-chain and policy risk, especially in restricted or offline environments.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Publishing default root SSH credentials without warnings or secure handling guidance normalizes unsafe operational behavior and creates a direct credential exposure path. In the context of a skill that allows ssh and docker access to infrastructure, this significantly increases the chance of unauthorized privileged access and misuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The troubleshooting guidance tells users to SSH as root to a remote host and execute system-management commands without any warning about privilege, host verification, or environment ownership. In a skill that may be followed by operators verbatim, normalized root remote access increases the chance of credential misuse, accidental changes on production systems, and unsafe copy-paste administration.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The instructions recommend uninstalling and reinstalling torch_npu directly in the active environment without warning that this mutates the runtime and can break dependency compatibility. While common in troubleshooting, presenting destructive package-management steps without isolation guidance can cause service disruption, irreproducible environments, or accidental modification of shared systems.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to run privileged SSH commands as root on a remote server and to inspect Docker containers, but provides no warning that these actions touch production-like infrastructure and may expose sensitive system details or enable unsafe follow-on actions. In a migration/verification skill this may be operationally normal, but the absence of guardrails, least-privilege guidance, or environment-safety warnings makes it a real security issue rather than a false positive.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The verification step uses torch.load on a model file, which can execute arbitrary code during Python pickle deserialization if the model artifact is untrusted or tampered with. In a model-migration skill, handling third-party model files is common, so this context increases the danger because users are likely to test externally sourced checkpoints.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The instructions tell users to install packages directly inside the running container without warning that this mutates the environment and can affect reproducibility, dependency integrity, and subsequent workloads. This is lower severity than the other findings, but it is still a legitimate operational security weakness because ad hoc package installation can introduce unreviewed code and drift.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.