huawei-cloud-cce-env-assessment

• Outcome: Review
• Latest audit: Aug 22, 2026 · 2:34 PM UTC
• Version: 1.0.1

Overview

This skill is mostly a cloud assessment tool, but it needs careful review because it uses raw cloud credentials, may escalate privileges, downloads code and tools, and can overstate some security-check results.

Install only in an isolated environment and use least-privilege, temporary Huawei Cloud credentials. Review the generated report critically because some checks may be asserted without direct evidence. Avoid running the sudo, remote installer, pip install, and rm -rf guidance unless you explicitly intend those host changes, and treat cloned source plus data/artifacts outputs as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (20)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Cloning {DOCKERFILE_REPO_URL} -> {app_repo} (depth=1, sparse on api/web)...", file=sys.stderr)
    # Use sparse-checkout to only pull needed directories, speeding up download
    try:
        subprocess.run(["git", "clone", "--filter=blob:none", "--depth=1", "--no-checkout",
                        DOCKERFILE_REPO_URL, str(app_repo)],
                       check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        subprocess.run(["git", "-C", str(app_repo), "sparse-checkout", "init", "--cone"],

• Confidence: 87% confidence
• Finding: The script clones a repository from an environment-controlled URL without validating or constraining the destination source. In an agent-skill context, this expands the trust boundary from cloud assessment into arbitrary remote content retrieval, which can be abused for unexpected network access, collection of attacker-chosen content, or storage of untrusted material on disk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

date_str = now.strftime("%Y-%m-%dT%H:%M:%S") + "Z"
        
        def make_request():
            r = subprocess.run(
                ["curl", "-s", "-X", "POST", url,
                 "-H", "Content-Type: application/json",
                 "-d", json.dumps({

• Confidence: 84% confidence
• Finding: This subprocess sends cloud credentials from environment variables to an outbound network request using `curl`. While argument-list execution avoids shell injection, the code transmits highly sensitive AK/SK material to an external endpoint and lacks strong verification and user-facing safeguards around that credential use.

Tainted flow: 'cmd' from os.environ.get (line 171, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

"-H", f"Host: {host}",
        url
    ]
    r = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=30)
    
    if log_mode:
        return r.stdout if r.returncode == 0 else None

• Confidence: 92% confidence
• Finding: The request target is built from environment-derived region data and executed with `curl -k`, disabling TLS certificate validation while sending AK/SK-derived authorization material. In this context, an attacker controlling environment inputs or network position could redirect requests or exploit the insecure transport to intercept signed requests and cluster metadata.

Tainted flow: 'DOCKERFILE_REPO_URL' from os.environ.get (line 16, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

print(f"Cloning {DOCKERFILE_REPO_URL} -> {app_repo} (depth=1, sparse on api/web)...", file=sys.stderr)
    # Use sparse-checkout to only pull needed directories, speeding up download
    try:
        subprocess.run(["git", "clone", "--filter=blob:none", "--depth=1", "--no-checkout",
                        DOCKERFILE_REPO_URL, str(app_repo)],
                       check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        subprocess.run(["git", "-C", str(app_repo), "sparse-checkout", "init", "--cone"],

• Confidence: 95% confidence
• Finding: `DOCKERFILE_REPO_URL` comes directly from the environment and is used to clone an arbitrary remote repository. In an assessment skill, this means a caller can force the agent to initiate outbound connections and persist attacker-selected content locally, which is a meaningful trust-boundary violation even without shell injection.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

date_str = now.strftime("%Y-%m-%dT%H:%M:%S") + "Z"
        
        def make_request():
            r = subprocess.run(
                ["curl", "-s", "-X", "POST", url,
                 "-H", "Content-Type: application/json",
                 "-d", json.dumps({

• Confidence: 97% confidence
• Finding: Environment-sourced cloud credentials are directly embedded into an outbound authentication request. In an agent skill, this is dangerous because it normalizes automatic transmission of privileged AK/SK secrets to external services without strong runtime controls, increasing the risk of credential exposure, misuse, or redirection if the request path is tampered with.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill performs sensitive actions such as reading and writing files, using shell commands, handling environment variables, and reaching external cloud APIs, yet it declares no permissions or user-visible consent boundary for those capabilities. This creates a transparency and authorization gap: the agent may execute materially risky operations without the manifest clearly disclosing them to users or enforcement layers.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The instruction to retry with sudo on permission errors encourages privilege escalation during a task whose stated purpose is assessment and reporting. If followed, this could grant the skill broad system access, increasing the blast radius of any mistake, malicious dependency, or unsafe command executed later in the workflow.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The prerequisites direct the agent to upgrade pip and potentially alter the local Python environment, which exceeds a passive assessment role. Local package-management changes can introduce supply-chain risk, modify host state unexpectedly, and create persistence outside the skill's stated purpose of gathering metrics and producing a report.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: Step 2 explicitly instructs installation of Python dependencies and modification of local directories, expanding the skill from assessment into system administration. While clearing data and artifacts directories may be expected for report generation, combining that with package installation makes the workflow materially more invasive and increases the chance of unintended host changes or dependency abuse.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill's stated purpose is Huawei Cloud CCE environment assessment, but it silently expands into cloning and inspecting arbitrary application source repositories. That broader capability increases data-access scope and enables remote content retrieval not strictly necessary for infrastructure assessment, making the skill more dangerous in an automated-agent setting.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The script recursively scans application source for hardcoded IP addresses, which goes beyond the claimed cloud-environment assessment function. While not destructive, this widens the inspection scope into source-code auditing and can unintentionally process sensitive application content without clear user expectation.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The script reports that stdout/stderr and JSON log format checks were performed even though it never reads logs and instead fabricates results from container enumeration. In a security assessment tool, false attestation is dangerous because it can mislead operators into believing logging controls are verified when they are not, undermining detection and compliance decisions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file claims completion of RBAC, Ingress TLS, and security-group checks without issuing the corresponding queries in this code path. This creates false assurance in a security-assessment context, potentially causing users to miss serious misconfigurations because the report states they were reviewed.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill asks for Huawei Cloud AK/SK credentials and performs cloud environment collection without an explicit warning about sensitive credential handling, exposure in logs, or data transmission risks. In context, this is more dangerous because the workflow also mandates printing step output and saving intermediate files, which could inadvertently expose secrets or sensitive infrastructure details.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The configuration examples instruct users to initialize multiple CLI profiles but do not warn that these profiles may store credential-bearing configuration locally under the user's home directory. In an agent skill context, this increases the risk of creating sensitive material on disk without prompting users to secure permissions, use least-privilege credentials, or avoid persistence in shared environments.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script automatically consumes AK/SK credentials from environment variables and uses them in outbound operations without prominent user-facing disclosure or approval. In an agent skill, implicit secret use is more dangerous because the caller may not realize privileged credentials will be exercised across multiple cloud APIs.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The script writes a cloned repository to local storage without clear upfront notice. In isolation this is low impact, but in an automated skill it matters because it persists untrusted remote content and may surprise operators regarding local disk usage and data retention.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

#   - make_report_html.py → 内联 SVG + CSS font-family，无 ReportLab，无 TTF 依赖

openpyxl>=3.0,<4
huaweicloudsdkcore>=3.1

• Confidence: 86% confidence
• Finding: The dependency `huaweicloudsdkcore>=3.1` is only lower-bounded and allows installation of any future major or minor release, which can introduce unreviewed code, breaking changes, or newly compromised versions into the skill's execution environment. In a cloud assessment skill that likely handles Huawei Cloud credentials and API interactions, dependency drift increases supply-chain risk and could affect confidentiality or integrity if a malicious or vulnerable upstream release is pulled.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file

• Confidence: 88% confidence
• Finding: The uninstall section includes recursive deletion of `~/.hcloud/`, which can remove locally stored profiles, cached data, and potentially credential material. In an agent skill, destructive filesystem commands are more dangerous because they may be surfaced or automated without sufficient confirmation, causing loss of configuration or credentials.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match

Content

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file

• Confidence: 86% confidence
• Finding: The YARA hit is triggered by destructive deletion patterns and non-interactive installation language. Although the commands appear in a legitimate uninstall/cleanup context rather than obvious malicious sabotage, they still present real risk in an agent-executable skill because recursive deletion and unattended install patterns can amplify accidental or unsafe autonomous actions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/koocli-installation-guide.md:212