huawei-cloud-cloudrobo-model-workflow

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:54 AM UTC
• Version: 1.0.0

Overview

This is a coherent CloudRobo workflow skill, but it needs review because it can change cloud resources, create robot credential bundles, and dispatch tasks to real robots with incomplete safety and credential-handling gates.

Review this skill carefully before installing. Use least-privilege CloudRobo credentials, install the CLI in an isolated environment before setting production AK/SK values, do not paste secrets into chat or logs, and require a human operator to confirm robot identity, workspace safety, emergency stop readiness, and intended physical execution before any dispatch create-task command. Store exported robot credential ZIPs outside project folders with restrictive permissions, transfer them securely, and delete or rotate them after onboarding.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:15
• Finding: Unpinned Third-Party CLI Dependency<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md:15-24` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```bash ### Install ```bash pip install hw-cloudrobo-client ``` Verify installation: ```bash cloudrobo --version ``` ``` ### Technical Analysis The installation procedure retrieves the latest available release of `hw-cloudrobo-client` and its transitive dependencies without specifying a reviewed version or verifying package hashes. The project does not provide a lockfile, integrity manifest, or trusted package-index configuration. Because Python package installation may execute package build hooks and subsequently places executable code in the user's environment, a compromised, replaced, or unexpectedly changed package release could execute code with the installing user's privileges. This is particularly sensitive because the installed CLI is expected to operate in an environment containing Huawei Cloud AK/SK credentials. ### Attack Path 1. An attacker compromises the upstream package, a transitive dependency, or the configured Python package index. 2. The malicious package is published under the expected package name or introduced as a dependency of its latest release. 3. A user follows the documented `pip install hw-cloudrobo-client` instruction. 4. Pip retrieves the unverified release and executes its installation logic. 5. Malicious code reads environment variables such as `HUAWEI_CLOUD_AK` and `HUAWEI_CLOUD_SK`, modifies local files, or invokes CloudRobo APIs using the user's authority. ### Impact Assessment Successful exploitation could provide code execution with the privileges of the user performing the installation. It could expose Huawei Cloud credentials and permit access to CloudRobo resources available to those credentials, including assets, training tasks, inference services, and registered robots. The precise cloud impact is limi ...[truncated 67 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a specifically reviewed version, for example: ```bash python -m pip install "hw-cloudrobo-client==<reviewed-version>" ``` 2. Generate and publish a requirements file containing cryptographic hashes, then require verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin and hash all transitive dependencies rather than only the top-level package. 4. Explicitly configure a trusted package index and prevent fallback to untrusted indexes. 5. Install the CLI in an isolated virtual environment using a non-privileged account. 6. Document a process for reviewing and updating the pinned version. 7. Avoid exposing production AK/SK credentials to package installation processes; configure credentials only after installation and verification are complete. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:179
• Finding: Unsafe Shell Interpolation of User-Controlled CLI Arguments<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:179` - `references/robot-selection-guide.md:85` **Vulnerability Type**: Potential command injection through unquoted user-controlled arguments **Risk Level**: High ### Vulnerable Code ```bash cloudrobo asset import-asset --catalog-id <catalog_id> --type dataset --local-path <local_dir_path> --name <dataset_name> ``` ```bash cloudrobo robot create --name <robot_name> --type <TYPE> --manufacturer <manufacturer> --robot-model <robot_model> --workspace-id <workspace_id> [--description "<description>"] ``` ### Technical Analysis The command templates place user-originated values—including local paths, dataset names, robot names, manufacturers, and robot model identifiers—into shell commands without consistently quoting or validating them. If an Agent or user constructs these commands as shell strings, whitespace can change argument boundaries and shell metacharacters such as `;`, `|`, `&`, command substitutions, or redirections can introduce additional commands. The risk is not present when the CLI is invoked through a correctly constructed argument array with shell interpretation disabled, but the affected instructions do not require that safe execution method. The project demonstrates argument-array use for one training command, but does not apply the same control to these dataset-import and robot-registration commands. ### Attack Path 1. An attacker supplies a crafted dataset path, dataset name, manufacturer, or model identifier containing shell syntax. 2. The Agent substitutes the supplied value directly into one of the documented command templates. 3. The completed command is passed to a shell rather than executed as an argument array. 4. The shell parses the attacker's metacharacters as command syntax. 5. The injected command executes with the local privileges and environment of the Agent or user. For example, a malicious value could terminate the intended argument and append another ...[truncated 756 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require every CLI invocation containing dynamic values to use an argument array with shell execution disabled: ```python subprocess.run( [ "cloudrobo", "asset", "import-asset", "--catalog-id", catalog_id, "--type", "dataset", "--local-path", local_dir_path, "--name", dataset_name, ], shell=False, check=True, capture_output=True, text=True, ) ``` 2. Apply the same pattern to `cloudrobo robot create` and every other command receiving user-originated values. 3. Do not build commands by concatenating strings or pass them through `bash -c`, `sh -c`, PowerShell expression evaluation, or equivalent shell execution interfaces. 4. Validate identifiers against narrow allowlists. For example, restrict robot and dataset names to documented alphanumeric, hyphen, and underscore characters. 5. Validate enum values such as robot type against the documented set rather than accepting arbitrary strings. 6. Resolve and validate local dataset paths before use, and reject unexpected control characters or null bytes. 7. If a shell command must be displayed for manual use, quote every substituted argument according to the target shell and clearly state that argument-array execution is the required automated method. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/robot-selection-guide.md:33
• Finding: Robot Credential Bundles Stored Without Required Permission Controls or Cleanup<![CDATA[ ## Vulnerability Details **File Locations**: - `references/robot-selection-guide.md:33-41` - `references/robot-selection-guide.md:90-100` - `SKILL.md:472` **Vulnerability Type**: Insecure local handling of exported credential bundles **Risk Level**: High ### Vulnerable Code ```bash ### Step B.2: Export Access Certificate ```bash mkdir -p ./certs cloudrobo robot export-certificate --robot-id <robot_id> --output ./certs # Output: ./certs/cert_config_{robot_name}_{timestamp}.zip ``` > **Security**: The exported `cert_config_*.zip` is a credential bundle. Store it securely and never commit to source control. ``` The new-robot workflow repeats the same storage pattern: ```bash ### Step C.3: Export Access Certificate ```bash mkdir -p ./certs cloudrobo robot export-certificate --robot-id <robot_id> --output ./certs # Output: ./certs/cert_config_{robot_name}_{timestamp}.zip ``` ``` ### Technical Analysis The documentation correctly identifies the exported ZIP as a credential bundle, but directs users to place it in a predictable `./certs` directory created with the process's default permissions. It does not require a restrictive `umask`, directory mode, file mode, secure temporary location, post-transfer deletion, or credential rotation. Depending on the host's umask and workspace configuration, the directory or exported ZIP may be readable by other local users or processes. Storing the bundle beneath the current project directory also increases the chance that it will be collected by workspace archiving, backup, synchronization, or artifact-upload tooling. A warning not to commit the file does not address these other disclosure channels. ### Attack Path 1. The workflow creates `./certs` using inherited default permissions. 2. `cloudrobo robot export-certificate` writes a robot credential bundle into that directory. 3. The bundle remains present after onboarding because no cleanup procedure is specified. 4. Another local user, process, backup agen ...[truncated 852 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private directory outside the project tree: ```bash umask 077 cert_dir="$(mktemp -d)" chmod 700 "$cert_dir" cloudrobo robot export-certificate --robot-id "$robot_id" --output "$cert_dir" ``` 2. Verify that exported files have mode `0600` before transfer. 3. Do not store credential bundles in source repositories, shared workspaces, synchronized folders, or general build-artifact directories. 4. Transfer the bundle through an authenticated and encrypted channel. 5. Delete the local bundle immediately after successful onboarding and verify that no temporary copies remain. 6. Exclude credential directories from backup, indexing, telemetry, and artifact-collection systems. 7. Document credential revocation or rotation procedures for suspected exposure. 8. Prefer short-lived or one-time onboarding credentials if supported by the platform. 9. Add failure-handling logic that securely removes partially exported credentials when onboarding is cancelled or errors occur. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Set required environment variables
# ⚠️ NEVER commit real keys. Use a secrets manager or .env file.
export HUAWEI_CLOUD_AK="your-access-key-id"
export HUAWEI_CLOUD_SK="your-secret-access-key"
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes generic phrases such as "训练部署", "部署评测", "model workflow", and "train and deploy" that can match broad user requests and cause this powerful orchestration skill to activate when a narrower, safer, or less-privileged skill would be more appropriate. Because this skill performs multi-stage cloud and real-robot operations, over-broad routing increases the chance of unintended training, deployment, or robot-task execution from ambiguous prompts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill requires authentication via `HUAWEI_CLOUD_AK` / `HUAWEI_CLOUD_SK` and performs cloud operations, but it does not prominently instruct users not to paste secrets into prompts, logs, JSON configs, or shell history. In a workflow that repeatedly constructs CLI commands and subprocess calls, insufficient secret-handling guidance raises the risk of accidental credential disclosure or insecure operational practices.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: Line L30 embeds Chinese-only terminology and instructions such as "具身广场" and "不该带的参数不要带" within operational guidance, without offering a language choice or indicating that the skill is region- or language-specific. This can violate language/locale policy because it forces part of the interaction/documentation into a specific language for all users.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The diagram explicitly includes real-robot evaluation where a dispatch command both creates and executes tasks on physical robots, but it does not show any safety interlock, operator confirmation, environment check, or warning about physical-world consequences. In a workflow skill that orchestrates training, deployment, and real-robot execution end-to-end, omission of an explicit safety gate increases the chance that a user or agent will trigger movement or task execution on actual hardware without adequate review.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Task `FAILED` | Model inference error or robot execution exception | Check `show-task-result` logs |
| Task `CANCELLED` | Manually cancelled | Recreate task |

> After fixing, create a new task to retry (`create-task` auto-executes).

• Confidence: 90% confidence
• Finding: The guide instructs operators to recreate a task using a command that auto-executes after remediation. In the context of real-robot evaluation, this can trigger physical robot actions without an explicit revalidation or confirmation step, increasing the risk of unintended motion, repeated unsafe behavior, or damage if the root cause was not fully resolved.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Only run the pipeline stages the user actually needs — a query-only workflow touches
  only read endpoints
- Write operations (asset create/import, train create-task, infer create/start, dispatch
  create-task/cancel-task) require explicit user confirmation before execution
- AK/SK must come from environment variables or `~/.cloudrobo/config.yaml` — never hardcode
- Keep all pipeline resources within a single workspace to keep the blast radius contained

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template instructs the agent to create and immediately execute a real-robot task via `cloudrobo dispatch create-task` without requiring an explicit confirmation, safety interlock, or operator warning that physical hardware will move. In a robotics workflow skill, this is especially dangerous because a natural-language task description can translate directly into live actuation, creating risk of collision, equipment damage, or injury if triggered unintentionally or with incorrect constraints.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This step creates a credential bundle on disk that can be used to onboard and authenticate a robot, but the procedure does not require an explicit pre-execution warning or user confirmation immediately before generating it. In an agent-driven workflow, silent creation of sensitive credentials increases the chance of accidental exposure through local files, shared workspaces, logging, or later misuse.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The onboarding guidance tells the user to deploy the access configuration ZIP to the robot but does not explicitly warn that this file is sensitive credential material that grants platform access. Without handling guidance, users may copy it insecurely, leave it on removable media or the robot filesystem, or expose it to other operators, enabling unauthorized robot registration or control.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This repeated certificate export step again generates a credential bundle on disk without an explicit warning or confirmation directly tied to the action. Repetition in a registration flow makes accidental credential sprawl more likely, especially because newly created robots may be onboarded quickly without the operator pausing to consider secure storage and handling.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: Line L26 instructs the user to run `cloudrobo infer start --service-id <id>` to retry a failed service deployment, which changes remote service state. The guide gives no warning about possible effects such as service restart behavior, resource consumption, or impact on an existing deployment workflow.

Static analysis

No suspicious patterns detected.