ClawHub
Back to skill

Security audit

huawei-cloud-cc-gcb-query

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only Huawei Cloud GCB lookup helper, with no evidence of hidden writes, exfiltration, or automatic privileged actions.

Install only if you intend to query Huawei Cloud Cloud Connect Global Connection Bandwidth resources. Use a least-privilege user with CC ReadOnlyAccess, avoid hardcoding AK/SK values, and review any hcloud installer or credential-profile setup before running it.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The description's trigger list includes generic phrases such as "bandwidth config" and "绑定带宽", which are not narrowly scoped to Huawei Cloud CC Global Connection Bandwidth queries. Because the file does not provide exclusion conditions or negative examples, these triggers could cause unintended invocation for unrelated bandwidth configuration or binding tasks.

Static analysis

No suspicious patterns detected.