Security audit

huawei-cloud-cloudrobo-dataset

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its CloudRobo task-management purpose, but it includes insecure TLS and credential-handling guidance that users should review before installing.

Install only in a trusted, isolated environment. Pin and review the hw-cloudrobo-client package version, keep TLS verification enabled, avoid CLOUDROBO_VERIFY_SSL=false except for tightly controlled debugging, use dedicated least-privileged AK/SK credentials, protect local config files, and treat logs, previews, temporary OBS URLs, deletes, restarts, and batch operations as sensitive actions requiring explicit review.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: references/cli-installation-guide.md:106
Finding: TLS Certificate Verification Is Documented as Disabled by Default<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md`, lines 106-119 **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ### Vulnerable Code Snippet ```markdown | SSL verification errors | Set `CLOUDROBO_VERIFY_SSL=false` (debug only) | ## Environment Variables 环境变量 | Variable | Description | Default | |----------|-------------|---------| | `CLOUDROBO_VERIFY_SSL` | SSL verification (true/false) | false | | `CLOUDROBO_LOG_TRAFFIC` | Traffic logging (true/false) | false | ``` Related guidance also appears in `references/iam-policies.md`, lines 60-61: ```markdown - **SSL verification** — Can be disabled for debugging (`CLOUDROBO_VERIFY_SSL=false`) but should be enabled in production ``` ### Technical Analysis The installation guide states that `CLOUDROBO_VERIFY_SSL` defaults to `false` and recommends disabling it when certificate errors occur. The Skill uses AK/SK-authenticated HTTPS requests to CloudRobo services and obtains task metadata, logs, dataset paths, and temporary OBS URLs. When certificate validation is disabled, the client cannot establish that it is communicating with the intended Huawei Cloud endpoint. TLS encryption without certificate authentication does not prevent an active network attacker from impersonating the service. Network communication is necessary for the declared functionality, but disabling server authentication exceeds what is required. Certificate validation should remain enabled for all normal operations. ### Attack Path 1. A user installs and configures the CloudRobo client according to the guide. 2. TLS verification remains disabled by default, or the user disables it in response to an SSL error. 3. An attacker obtains a network interception position, such as through a hostile proxy, compromised network gateway, or DNS manipulation. 4. The attacker presents an arbitrary TLS certificate for the CloudRobo endpoint. 5. The client accepts the forged cert ...[truncated 832 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the documented and implemented default for `CLOUDROBO_VERIFY_SSL` to `true`. 2. Remove disabling TLS verification as a routine troubleshooting recommendation. 3. For private certificate authorities, instruct users to install or configure the appropriate CA bundle instead of bypassing validation. 4. If a temporary bypass must remain available, require an explicit per-command opt-out and display a prominent warning. 5. Prevent production profiles from setting TLS verification to `false`. 6. Add automated tests that fail when HTTPS connections accept an untrusted or hostname-mismatched certificate. 7. Review the underlying `hw-cloudrobo-client` implementation to confirm hostname verification, certificate-chain validation, and secure proxy handling are enabled. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/test-cli-commands.sh:30
Finding: Test Script Enumerates Unrelated Cloud Credentials and Logs a Partial Access Key<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test-cli-commands.sh`, lines 30-44 **Vulnerability Type**: Excessive credential access and sensitive identifier disclosure **Risk Level**: Medium ### Vulnerable Code Snippet ```bash # Auto-scan for AK/SK environment variables scan_credentials() { local ak="" sk="" for var in $(env | grep -iE '^(HUAWEI|HW|HWC).*(_AK|ACCESS_KEY|_SK|SECRET_KEY)' | cut -d= -f1 | sort -u); do case "$var" in *_AK|*ACCESS_KEY) ak="${!var}" ;; *_SK|*SECRET_KEY) sk="${!var}" ;; esac done if [ -z "$ak" ] || [ -z "$sk" ]; then echo "ERROR: AK/SK not found in environment variables." echo "Set HUAWEI_CLOUD_AK and HUAWEI_CLOUD_SK environment variables." exit 1 fi echo "Credentials found: AK=${ak:0:8}..." } ``` ### Technical Analysis The script only needs to determine whether the documented `HUAWEI_CLOUD_AK` and `HUAWEI_CLOUD_SK` variables are available. Instead, it enumerates the complete process environment and dereferences every variable whose name resembles a Huawei access key or secret key. This behavior crosses the minimum-privilege boundary because unrelated credentials may be loaded into shell variables even though they are not required by the test suite. If multiple matching variables exist, the selected credential also depends on enumeration order rather than an explicit configuration. The script additionally writes the first eight characters of the selected access key to standard output. Access-key identifiers are less sensitive than secret keys, but this disclosure can still facilitate credential correlation, reconnaissance, and leakage through CI logs or shared terminals. The reviewed script does not directly transmit or print the secret key. The finding concerns unnecessary access to credentials and partial access-key disclosure, not confirmed secret-key exfiltration. ### Attack Path 1. A developer or CI runner has multipl ...[truncated 1310 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Check only the explicitly documented variables without enumerating the environment: ```bash scan_credentials() { if [ -z "${HUAWEI_CLOUD_AK:-}" ] || [ -z "${HUAWEI_CLOUD_SK:-}" ]; then echo "ERROR: Required CloudRobo credentials are not configured." >&2 exit 1 fi echo "Required CloudRobo credentials are configured." } ``` 2. Never print any portion of an access key or secret key. 3. Use short-lived, dedicated, least-privileged test credentials. 4. Run the test suite in a sanitized environment containing only variables required by the test. 5. Configure CI systems to mask relevant credential variables and restrict access to job logs. 6. Avoid shell constructs that parse `env` output, as they are unnecessary here and can behave unexpectedly with unusual variable contents. ]]>

T08 · Insecure Dependencies

Warning

Location: references/cli-installation-guide.md:12
Finding: Installation Instructions Use an Unpinned Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md`, lines 12-14 **Vulnerability Type**: Unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### Install cloudrobo-core (CLI framework) 安装核心包 ```bash pip install hw-cloudrobo-client ``` ``` The same unpinned installation command is repeated at lines 22, 30, 38, 101, and 102. ### Technical Analysis The instructions install `hw-cloudrobo-client` without a fixed version, package hash, lockfile, or explicitly authenticated package repository. As a result, the installed code can change over time without any corresponding change to the audited Skill. Python package installation may execute package-controlled build logic and installs command entry points that later run with the user's privileges. The installed client is also expected to process AK/SK credentials and communicate with cloud services, making supply-chain integrity particularly important. No evidence was found that the named package is currently malicious. The vulnerability is that the instructions do not provide a reproducible or integrity-verified dependency, leaving users exposed to a compromised, replaced, or unexpectedly changed release. ### Attack Path 1. An attacker compromises the package publisher account, distribution infrastructure, or an unprotected dependency in the package's dependency tree. 2. The attacker publishes a malicious or backdoored release under the expected package name. 3. A user follows the guide and runs `pip install hw-cloudrobo-client`. 4. Pip resolves and installs the attacker-controlled release because no audited version or hash is required. 5. Package build logic or installed entry-point code executes with the installing user's local privileges. 6. The malicious package can access local files, CloudRobo configuration, environment variables, and AK/SK credentials available to the process. 7. It may then alter cloud operations or transm ...[truncated 730 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the package to a specific audited version, for example: ```bash python -m pip install "hw-cloudrobo-client==<audited-version>" ``` 2. Publish and verify SHA-256 hashes using a requirements file with `--require-hashes`. 3. Pin and audit transitive dependencies through a lockfile or constraints file. 4. Use an authenticated official package repository and document its expected URL. 5. Recommend installation in an isolated virtual environment rather than a privileged or system-wide environment. 6. Avoid running pip as root or with elevated privileges. 7. Establish a dependency-update review process that includes provenance, signature, vulnerability, and behavior checks before changing the pinned version. 8. Where supported, publish signed artifacts and verify package attestations or provenance metadata. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (36)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: There is a material description-to-behavior mismatch. The description presents an operational skill that manages CloudRobo processing/evaluation tasks broadly, but the code chunk is a test harness used to verify a subset of CLI/SDK commands. Its primary purpose is automated validation, not end-user task orchestration or management. While some declared areas are partially represented (list/show tasks, retrieve logs, preview output, discover algorithms), many core declared capabilities are missing from the actual code. Additionally, the script performs credential discovery from environment variables, an implementation behavior not reflected in the description. This is more than a supporting detail because the code’s main role is testing, not the declared management functionality.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Delete tasks (SDK only) - **SDK:** `client.delete_tasks([task_id_1, task_id_2])` - **API:** `DELETE /v1/data-eng/proc-tasks?ids=id1,id2` #### Restart a task
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Delete an evaluation task (single granularity, SDK only) - **SDK:** `client.delete_eval_task(task_id)` - **API:** `DELETE /v1/data-eng/eval-tasks/{task_id}` **Note:** eval-tasks deletion is single-task granularity (`delete-task`), same as proc-tasks (`delete-task`). eval-tasks do not support restart.
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ae1

High

Category: analysis-evasion
Content: See `templates/test-vars.json` for the full test case list covering proc-tasks, eval-tasks,
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Missing User Warnings

High

Confidence: 98% confidence
Finding: The troubleshooting guidance tells users to disable SSL verification without a strong warning about man-in-the-middle risk. For a cloud CLI that handles authentication credentials and task/log data, turning off certificate validation can expose AK/SK secrets and service responses to interception or tampering.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: Agent->>CLI: delete-task CLI->>SDK: delete_tasks([task_id]) SDK->>API: DELETE /v1/data-eng/proc-tasks?ids=... API-->>SDK: deleted SDK-->>CLI: success CLI-->>Agent: cleanup done
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list includes broad terms like 'dataset', 'task management', and 'failure diagnosis', which can cause the skill to activate in contexts broader than intended. In a skill capable of mutating cloud tasks and retrieving logs/previews, overbroad activation increases the chance of unintended destructive actions or data exposure from ambiguous user requests.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill prominently supports log retrieval, output preview, frame listing, and temporary download links, all of which may expose sensitive dataset contents, file paths, or operational metadata. Without explicit user-facing warnings and guardrails, a user may unintentionally disclose confidential data when asking for troubleshooting or previews.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: L325-L328 document eval-task deletion as single-task granularity via SDK/API only, but L330-L331 then state it is the same as proc-tasks `delete-task`, even though earlier proc-task deletion is documented as batch deletion over multiple IDs. This is an active contradiction in the skill documentation about what delete behavior exists for eval vs. proc tasks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide explicitly shows AK/SK secrets being stored in a local YAML config file but does not warn that these are long-lived credentials requiring strict protection. In a CLI used for cloud task orchestration, local plaintext secret storage increases the risk of credential theft via filesystem exposure, backups, screenshots, shell history, or shared developer machines.

Unsafe Defaults

Medium

Category: Tool Misuse
Content: | `缺少 workspace_id 参数` | Run `cloudrobo workspace use --workspace-id <id>` | | `HTTP 401/403` | Check AK/SK credentials in environment or config | | `HTTP 404` | Check service endpoint in `~/.cloudrobo/config.yaml` | | SSL verification errors | Set `CLOUDROBO_VERIFY_SSL=false` (debug only) | ## Environment Variables 环境变量
Confidence: 98% confidence
Finding: The document presents `CLOUDROBO_VERIFY_SSL=false` as an available troubleshooting step, reinforcing an unsafe operational default/path. In the context of a cloud management CLI, this materially increases exposure to TLS stripping or MITM-style interception of credentials, logs, and control-plane requests.

Unsafe Defaults

Medium

Category: Tool Misuse
Content: - **Signing mechanism** — APIG HMAC-SHA256 signs each request with a timestamp to prevent replay attacks - **Proxy support** — Optional HTTP/HTTPS proxy can be configured for network isolation - **SSL verification** — Can be disabled for debugging (`CLOUDROBO_VERIFY_SSL=false`) but should be enabled in production - **Traffic logging** — `CLOUDROBO_LOG_TRAFFIC=true` enables request/response logging for debugging; disable in production to avoid credential leakage in logs
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The proc-task workflow is triggered by a broadly described user intent ('creating a data processing task without providing complete parameters') without precise gating criteria. In an agent setting, this can cause the workflow to activate on loosely related requests and drive tool-assisted state changes or resource-creating actions the user did not explicitly authorize.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The eval-task creation workflow similarly relies on an ambiguous activation condition ('creating a data evaluation task without providing complete parameters') and lacks narrow trigger constraints. This increases the chance that the agent will begin a task-creation sequence, solicit sensitive parameters, or prepare a submission command in response to ambiguous or merely exploratory user input.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## Optional Fields | Field | Description | |-----------------------|---------------------------------------------------------------------------------------------------------| | `algo_path` | Algorithm path (required when `algo_type=OBS_ASSETS`, OBS storage path for algorithm code/files) | | `job_local_path` | Container mount path (required when `algo_type=OBS_ASSETS`, mount path for algorithm data in container) |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## algo_type Values | Algorithm Source | algo_type Value | Required Fields | |---------------------------|--------------------|-----------------------------------------------------------------------------------------------------------------| | Preset algorithm | `PRESET_ASSETS` | `algo_id`, `algo_name`, `algo_entrance`, `image` (extract from operator ext_metadata) | | Workspace asset algorithm | `WORKSPACE_ASSETS` | `algo_id`, `algo_name`, `algo_entrance`, `image` (extract from workspace operator ext_metadata) |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ```bash # Check frontmatter exists grep '^---$' skills/cloudrobo-dataset/SKILL.md | head -2 # Check name field grep '^name:' skills/cloudrobo-dataset/SKILL.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ```bash # Check frontmatter exists grep '^---$' skills/cloudrobo-dataset/SKILL.md | head -2 # Check name field grep '^name:' skills/cloudrobo-dataset/SKILL.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ```bash # Check frontmatter exists grep '^---$' skills/cloudrobo-dataset/SKILL.md | head -2 # Check name field grep '^name:' skills/cloudrobo-dataset/SKILL.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ```bash # Check frontmatter exists grep '^---$' skills/cloudrobo-dataset/SKILL.md | head -2 # Check name field grep '^name:' skills/cloudrobo-dataset/SKILL.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ```bash # Check frontmatter exists grep '^---$' skills/cloudrobo-dataset/SKILL.md | head -2 # Check name field grep '^name:' skills/cloudrobo-dataset/SKILL.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ```bash # Check frontmatter exists grep '^---$' skills/cloudrobo-dataset/SKILL.md | head -2 # Check name field grep '^name:' skills/cloudrobo-dataset/SKILL.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ```bash # Check frontmatter exists grep '^---$' skills/cloudrobo-dataset/SKILL.md | head -2 # Check name field grep '^name:' skills/cloudrobo-dataset/SKILL.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ```bash # Check frontmatter exists grep '^---$' skills/cloudrobo-dataset/SKILL.md | head -2 # Check name field grep '^name:' skills/cloudrobo-dataset/SKILL.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ```bash # Check frontmatter exists grep '^---$' skills/cloudrobo-dataset/SKILL.md | head -2 # Check name field grep '^name:' skills/cloudrobo-dataset/SKILL.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.