huawei-cloud-cli-guidance

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:55 PM UTC
• Version: 1.0.0

Overview

This Huawei Cloud CLI guidance skill is mostly purpose-aligned, but it gives broad activation triggers and under-guarded examples involving credentials, remote installers, destructive cloud operations, and insecure troubleshooting commands.

Install only for explicit Huawei Cloud KooCLI work. Prefer scoped IAM users, SSO, ECS agency, or profiles over inline AK/SK; verify installer provenance before running remote scripts; require explicit confirmation before deletion, network, security group, or production changes; redact debug/raw logs before sharing; avoid disabling SSH host key checks except in tightly controlled temporary cases.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (19)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill explicitly tells users to pass long-lived credentials on the command line using --cli-access-key and --cli-secret-key, while elsewhere warning that plaintext credentials must never be exposed. Command-line secrets are commonly leaked via shell history, process listings, logs, CI job output, and terminal recordings, so this guidance materially increases credential exposure risk.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list is extremely broad, including generic terms like cloud, tool, 云, and 工具, which can cause this skill to activate in many unrelated contexts. Because the skill authorizes Bash usage and contains credential/configuration guidance, over-triggering can lead to inappropriate command suggestions, accidental cloud operations, or unnecessary handling of authentication-sensitive workflows.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The installation section instructs users to download and immediately execute a remote shell script with curl | bash-style behavior, but does not require checksum/signature verification or a trust warning. This creates a software supply-chain risk: if the download source, transport, or hosting path is compromised, users may execute attacker-controlled code.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The troubleshooting examples include a bulk instance deletion command as a format example without any warning that it performs destructive actions against live cloud resources. In a CLI guidance skill, users may copy commands verbatim, so presenting deletion syntax in an FAQ/troubleshooting context materially increases the chance of accidental resource loss.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Recommending raw HTTP request/response output without a warning can expose sensitive headers, authentication material, resource identifiers, internal endpoints, and environment details in terminal history, logs, screenshots, or shared tickets. In cloud troubleshooting workflows, these outputs are often copied to support channels, which raises the risk of credential or infrastructure data leakage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document advises enabling verbose debug logging but does not warn that such logs may capture request parameters, environment details, account identifiers, and possibly credentials or tokens. Because this skill is specifically for cloud CLI operations, debug output is likely to be archived, pasted into chats, or attached to tickets, making accidental disclosure more likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The cleanup workflow includes deletion of instances, public IPs, volumes, subnets, and VPCs, including flags that remove attached resources, but it does not prominently warn that these actions are destructive and may permanently erase data or disrupt services. In an agent skill context, users may copy commands directly, so omission of explicit confirmation guidance materially increases the chance of accidental destructive execution.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The SSH diagnostic workflow repeatedly uses StrictHostKeyChecking=no, which disables host authenticity verification and exposes users to man-in-the-middle attacks or connections to spoofed hosts. This is especially risky in a cloud operations skill because it conditions operators to bypass a core SSH security control while also transmitting privileged root access commands, sometimes alongside password-based automation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document includes destructive instance deletion commands with options to also delete public IPs and volumes, but it does not warn that these actions can permanently remove infrastructure and data. In an operational CLI guidance skill, users may copy-paste commands directly, increasing the chance of accidental irreversible deletion.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example creates an ingress security group rule allowing SSH from 0.0.0.0/0, which exposes remote administrative access to the entire internet. Without a caution or a safer alternative, this normalizes an insecure default that can materially increase brute-force, credential-stuffing, and unauthorized access risk.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The EIP deletion example can disrupt externally reachable services by removing a public address, yet the documentation does not warn about service interruption or dependency checks. In a cloud operations skill, omission of that warning makes accidental outages more likely during routine administrative use.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide recommends downloading and immediately executing a remote shell installer, including a non-interactive `-y` mode, without integrity verification, signature checking, or review guidance. This is dangerous because any compromise of the download host, CDN path, or script content can lead to arbitrary code execution on the user's machine.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document includes a batch server deletion example with `--delete_publicip=true` and `--delete_volume=true` but does not warn that these actions can permanently remove associated network and storage resources. In a CLI guidance skill, users may copy-paste examples directly, so omission of an explicit irreversible-deletion warning materially increases the risk of accidental destructive operations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The file includes create, delete, start, stop, and reboot ECS commands as quick references without adjacent cautionary language about destructive effects, downtime, or accidental targeting of production resources. In a broadly-triggered cloud operations skill, this omission can increase the chance that users copy and execute harmful commands without understanding consequences.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The security group rule creation and deletion examples modify network exposure but do not warn that opening ingress ports or removing rules can expose services or break connectivity. Because this skill is meant for terminal-based cloud operations, users may directly apply these commands, making the omission materially risky.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Public IP association, disassociation, and deletion directly affect external reachability and service availability, yet the examples present them as routine commands without caution. In cloud administration context, this can lead to accidental outages, loss of access paths, or unintended exposure when executed by inexperienced users.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Attach, detach, and extend volume operations can disrupt running workloads and risk filesystem or application issues if performed without proper preparation, but the document provides no warnings. Given this is an operational quick reference, users may interpret the commands as safe to run immediately, increasing risk of data loss or service interruption.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file

• Confidence: 90% confidence
• Finding: The uninstall section includes destructive deletion commands such as `rm -rf ~/.hcloud/` and privileged removal from system directories. Although intended for legitimate uninstallation, these commands are dangerous in an agent skill because they are high-impact filesystem operations that could cause data loss if misapplied, expanded incorrectly, or executed autonomously without confirmation.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match

Content

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file

• Confidence: 88% confidence
• Finding: The YARA hit is driven by the presence of destructive deletion commands and non-interactive behavior in the skill. In this documentation context it is not overtly malicious, but it still represents a real safety concern because it teaches irreversible filesystem deletion that an agent or user could execute without sufficient guardrails.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.exposed_secret_literal

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/installation-guide.md:212

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/core-commands.md:254