Security audit

huawei-cloud-ces-ecs-monitoring

Security checks across malware telemetry and agentic risk

Overview

The skill's core monitoring flow is legitimate, but its bundled guidance asks for broader cloud/admin powers and risky local setup/cleanup than monitoring requires.

Install only if you need Huawei Cloud ECS/CES monitoring and can constrain it to the minimum read-only policy. Avoid the recommended full-access policy, remote console, instance action, broad alarm mutation, and IAM enumeration permissions unless you deliberately need a separate admin workflow. Do not run the sudo, curl-to-bash, or rm -rf cleanup commands unless you have verified the source, understand what local configuration will be changed or deleted, and have backups of any needed Huawei CLI profiles.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill is described as a monitoring/query capability, but this best-practices document includes a command that modifies cloud resources by applying tags to ECS instances. Expanding a read-oriented skill with write-capable operational guidance increases the chance that an agent or user will perform unintended state-changing actions under the guise of monitoring, violating least privilege and broadening blast radius.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The automation section recommends alert delivery integrations, webhooks, email reporting, and auto-scaling triggers, which go beyond passive monitoring into external communication and infrastructure-changing actions. In an agent skill, this scope creep can cause unauthorized data egress, unintended notifications, or automated resource changes if downstream systems trust the skill's guidance or execution path.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The referenced file is a full KooCLI installation and system setup guide, which is materially broader than an ECS monitoring skill needs. This expands the agent's operational scope from read-only monitoring into software installation, environment modification, and privileged administration, increasing the chance an agent will take unnecessary and risky actions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The guide includes broad administrative capabilities such as package installation, PATH changes, Docker image building, shell configuration, and multi-environment CLI setup that are not justified by a monitoring-only use case. In an agent context, this can normalize privileged system changes and make lateral misuse easier if the skill is invoked for simple metric queries.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill is described as an ECS monitoring capability, but this policy guidance expands into operational control such as remote console and instance actions. That violates least privilege and creates unnecessary authority that could be abused to stop, restart, or otherwise access instances if the skill, its operator, or its credentials are compromised.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The 'full access' recommendation includes alarm-management and IAM inspection permissions that exceed the stated monitoring scope. Extra permissions broaden the blast radius from passive observability into account reconnaissance and resource-management capabilities, making post-compromise abuse easier.

Context-Inappropriate Capability

Low

Confidence: 93% confidence
Finding: IAM user and permission enumeration is not necessary for core ECS metric retrieval, yet the document recommends permissions that reveal identity and authorization details. Even if read-only, this enables reconnaissance of users and privilege structure that can aid lateral movement or targeting after credential theft.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Remote console and instance action permissions are materially more dangerous than monitoring permissions because they allow interactive access or lifecycle changes to compute resources. In the context of a monitoring skill, these capabilities are unnecessary and increase the chance of service disruption or unauthorized access.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list contains very broad phrases such as 'CPU usage', 'memory usage', and 'network traffic' that can match many ordinary requests unrelated to Huawei Cloud ECS monitoring. Overbroad activation can cause the wrong skill to engage, increasing the chance of unintended cloud-environment probing, irrelevant command suggestions, or accidental use of configured credentials in contexts the user did not intend.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The uninstall and cache-cleaning sections contain destructive deletion commands, including removal of local configuration directories, without explicit warning that credentials, profiles, and cached state may be lost. In an agent-assisted workflow, users may execute these commands without understanding the irreversible loss of local CLI configuration.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document normalizes storing long-lived access keys in environment variables and a local credentials file without strong handling guidance, which increases the chance of credential exposure through shell history, process inspection, backups, logs, or overly permissive file permissions. Compromise of these keys would grant the documented cloud permissions directly.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: # AMD 64-bit system curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz" tar -zxvf huaweicloud-cli-linux-amd64.tar.gz sudo mv hcloud /usr/local/bin/ # ARM 64-bit system curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
Confidence: 84% confidence
Finding: sudo

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: # Intel chips (AMD 64-bit) curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz" tar -zxvf huaweicloud-cli-mac-amd64.tar.gz sudo mv hcloud /usr/local/bin/ # Apple Silicon (ARM 64-bit) curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
Confidence: 84% confidence
Finding: sudo

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # Linux/macOS manual uninstallation: sudo rm -f /usr/local/bin/hcloud sudo rm -rf /usr/local/hcloud/ rm -rf ~/.hcloud/ # Windows manual uninstallation: # 1. Delete hcloud.exe file
Confidence: 96% confidence
Finding: rm -rf ~/.hcloud/

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

Category: YARA Match
Content: # Linux/macOS manual uninstallation: sudo rm -f /usr/local/bin/hcloud sudo rm -rf /usr/local/hcloud/ rm -rf ~/.hcloud/ # Windows manual uninstallation: # 1. Delete hcloud.exe file
Confidence: 94% confidence
Finding: rm -rf ~/; rm -rf ~/; Non-interactive

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: references/cli-installation-guide.md:212