huawei-cloud-cloudrobo-resource

• Outcome: Review
• Latest audit: Sep 8, 2026 · 2:08 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent read-only CloudRobo resource-query helper, but its credentialed cloud workflow includes unsafe TLS guidance and an unsafe test script that users should review before installing or running.

Install only if you are comfortable reviewing and hardening the CloudRobo client setup. Keep TLS verification enabled, avoid CLOUDROBO_VERIFY_SSL=false with real credentials, use least-privilege AK/SK credentials, avoid storing long-lived secrets in plaintext config where possible, and do not run the bundled SDK test script with untrusted POOL_ID or broad credential-rich environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/test-cli-commands.sh:143
• Finding: Arbitrary Python Code Injection Through POOL_ID<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test-cli-commands.sh`, lines 143-160 **Vulnerability Type**: Python source-code injection through unsafe string interpolation **Risk Level**: High ### Vulnerable Code ```bash test_pool_show() { local pool_id="${POOL_ID:-}" if [ -z "$pool_id" ]; then echo "=== TC-10: show-pool (SKIPPED - no POOL_ID) ===" return fi echo "=== TC-10: show-pool --pool-id $pool_id ===" if [ "$EXECUTOR" = "cli" ]; then cloudrobo resource show-pool --pool-id "$pool_id" 2>&1 | head -20 elif [ "$EXECUTOR" = "sdk" ]; then python3 -c " from cloudrobo_resource.client import ResourceClient from cloudrobo_core.sdk import Config, HttpClient client = ResourceClient(HttpClient(Config())) result = client.show_pool('$pool_id') print(str(result)[:500]) " 2>&1 | head -20 fi } ``` ### Technical Analysis The `POOL_ID` environment variable is interpolated directly into source code passed to `python3 -c`. Although the shell variable appears inside a Python single-quoted string, no escaping or UUID validation is applied. An attacker can include a single quote, Python statement separators, and arbitrary Python expressions in `POOL_ID`. The resulting text breaks out of the intended `client.show_pool()` argument and becomes executable Python code. Shell quoting around the outer multiline argument does not prevent this vulnerability because the shell deliberately expands `$pool_id` before passing the generated program to Python. ### Attack Path 1. An attacker controls or influences the `POOL_ID` environment variable, such as through an untrusted CI parameter. 2. The test suite is executed in SDK mode: ```bash bash scripts/test-cli-commands.sh -s . -e sdk ``` 3. The script expands the malicious value into the `python3 -c` program. 4. The injected value terminates the intended Python string and inserts additional Python statements. 5. Python executes those statements with ...[truncated 826 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Do not construct Python source code using an environment variable. Pass the pool ID as data through a positional argument: ```bash python3 - "$pool_id" <<'PY' import sys from cloudrobo_resource.client import ResourceClient from cloudrobo_core.sdk import Config, HttpClient pool_id = sys.argv[1] client = ResourceClient(HttpClient(Config())) result = client.show_pool(pool_id) print(str(result)[:500]) PY ``` Additionally: 1. Validate `POOL_ID` as a UUID before using it: ```bash if ! [[ "$pool_id" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ ]]; then echo "ERROR: POOL_ID must be a valid UUID." >&2 exit 1 fi ``` 2. Avoid embedding any externally controlled value in `python3 -c`, shell commands, or generated source code. 3. Add negative tests containing quotes, newlines, semicolons, and Python expressions to verify that input remains data rather than code. 4. Run tests with narrowly scoped credentials and an isolated, non-privileged runner. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/test-cli-commands.sh:30
• Finding: Broad Credential Discovery and Partial Access-Key Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test-cli-commands.sh`, lines 30-45 **Vulnerability Type**: Overbroad credential enumeration and sensitive-data logging **Risk Level**: Medium ### Vulnerable Code ```bash # Auto-scan for AK/SK environment variables scan_credentials() { local ak="" sk="" for var in $(env | grep -iE '^(HUAWEI|HW|HWC).*(_AK|ACCESS_KEY|_SK|SECRET_KEY)' | cut -d= -f1 | sort -u); do case "$var" in *_AK|*ACCESS_KEY) ak="${!var}" ;; *_SK|*SECRET_KEY) sk="${!var}" ;; esac done if [ -z "$ak" ] || [ -z "$sk" ]; then echo "ERROR: AK/SK not found in environment variables." echo "Set HUAWEI_CLOUD_AK and HUAWEI_CLOUD_SK environment variables." exit 1 fi echo "Credentials found: AK=${ak:0:8}..." } ``` ### Technical Analysis The script does not limit credential access to the documented `HUAWEI_CLOUD_AK` and `HUAWEI_CLOUD_SK` variables. Instead, it enumerates the complete process environment and matches a broad set of names beginning with `HUAWEI`, `HW`, or `HWC`. For each match, indirect expansion (`${!var}`) reads the corresponding secret value. If multiple variables match, later entries can silently replace earlier values. This can select unrelated credentials and unnecessarily exposes additional secrets to the script's process context. The script also writes the first eight characters of the selected access key to standard output. Access keys are identifiers rather than secret signing keys, but they remain credential material and should not be exposed in shared CI logs or support transcripts. ### Attack Path 1. The test suite runs in a shell or CI worker containing multiple cloud credential environment variables. 2. `scan_credentials` enumerates the environment and reads every matching AK/SK-style variable. 3. Sorting and repeated assignments cause one matching pair to be selected without confirming that it is the intended Huawei Cloud c ...[truncated 961 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Read only the explicitly documented variables and never print their contents: ```bash scan_credentials() { if [ -z "${HUAWEI_CLOUD_AK:-}" ] || [ -z "${HUAWEI_CLOUD_SK:-}" ]; then echo "ERROR: HUAWEI_CLOUD_AK and HUAWEI_CLOUD_SK must be set." >&2 exit 1 fi echo "Required credentials are configured." } ``` Further hardening should include: 1. Remove the `env` enumeration and indirect variable expansion. 2. Never print full or partial AK/SK values. 3. Keep CI secret masking enabled, while not relying on masking as a substitute for safe logging. 4. Use a dedicated, least-privilege test credential rather than a general-purpose account key. 5. Fail if the exact expected variables are absent instead of silently selecting similarly named credentials. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:11
• Finding: Unpinned Installation of Credential-Handling Executable Dependency<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md`, lines 11-33 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```markdown ### Install cloudrobo-core (CLI framework) 安装核心包 ```bash pip install hw-cloudrobo-client ``` This provides the `cloudrobo` main CLI entry point. ### Install cloudrobo-resource (resource commands) 安装资源包 ```bash pip install hw-cloudrobo-client ``` This registers the `resource` command group via entry points. ### Install all packages (recommended) 安装全部包 ```bash pip install hw-cloudrobo-client ``` The root `pyproject.toml` (`cloudrobo-client`) installs all sub-packages. ``` ### Technical Analysis The installation guide directs users to install `hw-cloudrobo-client` without a pinned version, cryptographic hash, lock file, or explicit trusted source. Consequently, package resolution is mutable: the installed code depends on whichever release the configured package index considers current when the command is run. This dependency is particularly sensitive because it provides the executable CLI, imports SDK code, handles Huawei Cloud AK/SK credentials, signs API requests, and can run Python package installation hooks or arbitrary runtime code. The audit did not establish that the current package is malicious. The vulnerability is the absence of controls preventing a future compromised, replaced, or unexpected release from being installed automatically. ### Attack Path 1. A user follows the documented installation command. 2. `pip` resolves the latest available package version from its configured package index. 3. A compromised publisher account, malicious future release, package-index compromise, or dependency-chain compromise supplies altered code. 4. The package is installed and subsequently invoked as `cloudrobo`. 5. Malicious package code executes with the installing or invoking user's privileges. 6. When the CLI is used, that c ...[truncated 656 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version: ```bash python -m pip install "hw-cloudrobo-client==<reviewed-version>" ``` 2. Publish a locked requirements file containing cryptographic hashes and install it with: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Document the verified package publisher and authoritative source repository. 4. Use a controlled package index or allowlisted internal mirror for production and CI installations. 5. Review transitive dependencies and regenerate the lock file only through an approved update process. 6. Add dependency vulnerability and provenance checks to release workflows. 7. Avoid privileged installation and use an isolated virtual environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:95
• Finding: TLS Certificate Verification Documented as Disabled by Default<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md`, lines 95-115 **Vulnerability Type**: Insecure TLS configuration guidance **Risk Level**: Medium ### Vulnerable Code ```markdown ## Troubleshooting 故障排查 | Issue | Solution | |-------|----------| | `command not found: cloudrobo` | Reinstall: `pip install hw-cloudrobo-client` | | `resource command not found` | Reinstall: `pip install hw-cloudrobo-client` | | `HTTP 401/403` | Check AK/SK credentials in environment or config | | `HTTP 403 ABAC` | Quota list and pool list require ABAC permission; check IAM policies | | `HTTP 404` | Pool ID not found; verify with `list-pools` first | | SSL verification errors | Set `CLOUDROBO_VERIFY_SSL=false` (debug only) | ## Environment Variables 环境变量 | Variable | Description | Default | |----------|-------------|---------| | `HUAWEI_CLOUD_AK` | Access key ID | — | | `HUAWEI_CLOUD_SK` | Secret access key | — | | `CLOUDROBO_SERVICE_CONFIG` | Custom config file path | `~/.cloudrobo/config.yaml` | | `CLOUDROBO_ENDPOINT_cloudrobo-service` | Override service endpoint | — | | `CLOUDROBO_HTTP_PROXY` | HTTP proxy | — | | `CLOUDROBO_HTTPS_PROXY` | HTTPS proxy | — | | `CLOUDROBO_VERIFY_SSL` | SSL verification (true/false) | false | | `CLOUDROBO_LOG_TRAFFIC` | Traffic logging (true/false) | false | ``` ### Technical Analysis The installation guide states that `CLOUDROBO_VERIFY_SSL` defaults to `false`, indicating that TLS certificate verification is disabled unless users explicitly enable it. The troubleshooting section also recommends disabling verification when certificate errors occur. Without certificate verification, HTTPS encryption does not authenticate the remote server. An attacker able to control a network path, DNS resolution, configured proxy, or endpoint override could present an arbitrary certificate and impersonate the CloudRobo service. This guidance conflicts with `references/iam-policies.md`, which states that SSL verificati ...[truncated 1369 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change and document the default as certificate verification enabled: ```text CLOUDROBO_VERIFY_SSL=true ``` 2. Remove advice to disable TLS verification as the primary response to certificate failures. 3. Support a configurable CA bundle for private endpoints or enterprise interception proxies. 4. If disabling verification remains available for diagnostics, require an explicit temporary override and display a prominent warning. 5. Ensure diagnostic configuration is not persisted automatically. 6. Add tests confirming that invalid, expired, self-signed, or hostname-mismatched certificates are rejected by default. 7. Reconcile the installation guide with the production security guidance in `references/iam-policies.md`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script enumerates the entire process environment with a broad Huawei-style credential regex and automatically selects any matching AK/SK pair. That behavior exceeds the minimum needed for a test harness, risks unintentionally consuming unrelated credentials present in CI or a developer shell, and also prints part of the access key, increasing exposure of sensitive material.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly instructs users to place long-lived AK/SK credentials into a local plaintext config file without warning about secret handling, filesystem permissions, or safer alternatives. For cloud credentials, this increases the chance of credential theft via local compromise, accidental backups, screen sharing, or source-control inclusion.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documentation advises users to set CLOUDROBO_VERIFY_SSL=false to work around SSL verification errors, but does not warn that this disables TLS certificate validation and exposes users to man-in-the-middle attacks. In a CLI that handles cloud AK/SK credentials and resource-management requests, this can lead to credential interception and tampering with API responses.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

| `HTTP 401/403` | Check AK/SK credentials in environment or config |
| `HTTP 403 ABAC` | Quota list and pool list require ABAC permission; check IAM policies |
| `HTTP 404` | Pool ID not found; verify with `list-pools` first |
| SSL verification errors | Set `CLOUDROBO_VERIFY_SSL=false` (debug only) |

## Environment Variables 环境变量

• Confidence: 99% confidence
• Finding: The documented default/troubleshooting path uses VERIFY_SSL=false, which is an unsafe default because it normalizes operation without certificate validation. Given this CLI manages cloud resources and uses sensitive credentials, disabling TLS verification materially increases the risk of interception, spoofed endpoints, and manipulated responses.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

- **Signing mechanism** — APIG HMAC-SHA256 signs each request with a timestamp to prevent
  replay attacks
- **Proxy support** — Optional HTTP/HTTPS proxy can be configured for network isolation
- **SSL verification** — Can be disabled for debugging (`CLOUDROBO_VERIFY_SSL=false`) but
  should be enabled in production
- **Traffic logging** — `CLOUDROBO_LOG_TRAFFIC=true` enables request/response logging for
  debugging; disable in production to avoid credential leakage in logs

• Confidence: 91% confidence
• Finding: The document explicitly advertises a configuration that disables TLS certificate verification (`CLOUDROBO_VERIFY_SSL=false`). Even though it says this is for debugging and should be enabled in production, documenting an easy insecure toggle in credentialed AK/SK workflows can normalize unsafe use and expose signed API traffic to man-in-the-middle interception or endpoint spoofing, especially in enterprise/proxy environments.

Static analysis

No suspicious patterns detected.