huawei-cloud-cci-instance-management

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:52 PM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent for managing Huawei Cloud CCI resources, but it includes a real local command-injection risk and broad cloud-control references that need review before installation.

Install only if you intend to let the agent manage Huawei Cloud CCI resources. Use least-privilege temporary credentials, verify region/project/namespace before every mutating command, and fix or avoid scripts/cci_network_helper.py until the shell=True region command is replaced with validated argument-list subprocess usage.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import subprocess
    try:
        cmd = f"hcloud IAM KeystoneListProjects --cli-region={region} --cli-output=json"
        result = subprocess.run(
            cmd, capture_output=True, timeout=15,
            encoding="utf-8", errors="replace", shell=True,
        )

• Confidence: 98% confidence
• Finding: The script builds a shell command with an attacker-controlled region value and executes it with shell=True. If a user can supply a crafted region string, this can lead to command injection and arbitrary command execution in the local environment running the skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs use of shell commands, environment variables, network access, and a Python helper script, yet no explicit permissions are declared. This weakens containment and review because the runtime capabilities required to manipulate cloud resources and credentials are not transparently documented, increasing the chance of overbroad execution in an agent environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description presents the skill as operating through hcloud CLI, but the content introduces a Python helper that performs direct signed OpenAPI calls for Network creation. This hidden behavioral expansion matters because it bypasses the stated control surface, may use a separate credential source, and can evade operator expectations, policy checks, or CLI-level safeguards.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The catalog exposes capabilities significantly beyond basic CCI instance lifecycle management, including Secrets, RBAC, API discovery, storage, endpoints, and batch workloads. Expanding the documented and likely implemented action surface increases the chance an agent will perform sensitive infrastructure changes that users did not intend, creating privilege and scope creep risks.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Pod exec provides interactive code execution inside running workloads, which goes far beyond ordinary lifecycle management such as create, update, delete, and status checks. If invoked by an agent, it can expose secrets, alter application state, pivot within the environment, or run arbitrary commands inside containers.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: RBAC management allows creation and modification of RoleBindings and visibility into ClusterRoles, enabling privilege changes unrelated to basic CCI container instance management. In an agent context, this can be abused to grant broader permissions, weaken isolation, or facilitate privilege escalation across namespaces.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documentation introduces a second, independent credential path for a Python helper script using different environment variables than the advertised hcloud CLI flow. In an agent skill, this creates security-relevant ambiguity: operators may believe one credential context governs all actions, while network creation actually runs under a separate identity with different permissions, audit trails, and token-handling behavior. That mismatch can cause unintended privilege use, failed access-control assumptions, or accidental use of broader long-term credentials.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest describes the skill as hcloud CLI-based full lifecycle management, but the documentation reveals that network creation depends on an external Python helper script with separate credentials. In a security-sensitive automation context, this is a real design inconsistency because it can bypass user expectations about what code executes and which secrets are consumed, increasing the chance of unauthorized actions, credential misuse, or incomplete review of the true execution path.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: Although the script's stated purpose is direct OpenAPI management, it still shells out to hcloud for project discovery. That design expands the attack surface and, combined with shell=True and unsanitized input, creates a real command-execution path.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The catalog lists many destructive and sensitive actions, including bulk deletions, secret operations, and RBAC changes, without embedded warnings or safety guidance. In a reference used by an autonomous or semi-autonomous agent, omission of impact cues increases the likelihood of unsafe execution and user misunderstanding.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The workflow documentation hard-codes a default region (`cn-north-4`) and repeats it across commands without requiring explicit user confirmation. In cloud-operation skills, this can cause actions to be executed in the wrong environment or geography, especially for destructive commands, leading to unintended resource creation, modification, or deletion and possible compliance issues.

Unvalidated Output Injection

High

• Category: Output Handling

Content

import subprocess
    try:
        cmd = f"hcloud IAM KeystoneListProjects --cli-region={region} --cli-output=json"
        result = subprocess.run(
            cmd, capture_output=True, timeout=15,
            encoding="utf-8", errors="replace", shell=True,
        )

• Confidence: 97% confidence
• Finding: The subprocess call uses a shell with a command string that includes the user-controlled region parameter. This is effectively a shell injection sink, allowing crafted input to alter the executed command and potentially run arbitrary programs.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

import subprocess
    try:
        cmd = f"hcloud IAM KeystoneListProjects --cli-region={region} --cli-output=json"
        result = subprocess.run(
            cmd, capture_output=True, timeout=15,
            encoding="utf-8", errors="replace", shell=True,
        )

• Confidence: 97% confidence
• Finding: This is a tool parameter abuse issue because untrusted input is embedded into a command used to invoke an external tool. In an agent skill context, where parameters may come from user prompts, this is especially dangerous because it can turn a cloud-management helper into a local command-execution primitive.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.