huawei-cloud-cloudrobo-robot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:53 AM UTC
• Version: 1.0.0

Overview

The skill’s robot-management purpose is coherent, but its included verification script can update, export credentials for, and delete a real robot without affirmative confirmation.

Review this before installing or running tests. Do not run scripts/test-cli-commands.sh in an environment with a real ROBOT_ID unless you are prepared for that robot to be modified, have its access credentials exported, and possibly be deleted. Use non-production credentials and workspaces, avoid the hardcoded certificate-export password, store any exported ZIP as a secret, and prefer dry-run or manual read-only verification until the script requires explicit confirmations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:5
• Finding: Unpinned Aggregate Dependency Expands the Supply-Chain Attack Surface<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md:5-19` **Vulnerability Type**: Unpinned and unnecessarily broad third-party dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ### Option 1: Install all packages (recommended) ```bash pip install hw-cloudrobo-client ``` This installs the aggregate package with all functional modules (asset, dataset, train, eval, infer, robot, dispatch, workspace). ### Option 2: Install only robot package ```bash pip install hw-cloudrobo-client ``` This installs `cloudrobo-core` (CLI framework) + `cloudrobo-robot`. ``` ### Technical Analysis The installation command does not pin an audited package version or verify package hashes. Consequently, installation resolves whichever release the configured Python package index currently considers appropriate. If a future release or its distribution channel is compromised, installation can execute altered package installation logic without any corresponding change to this Skill. The purported minimal installation option also installs the same aggregate package as the full installation option. According to the guide, the aggregate package includes asset, dataset, training, evaluation, inference, dispatch, and workspace functionality. Those components exceed the robot-management functionality needed by this Skill and unnecessarily enlarge the dependency and executable-code surface. This finding does not establish that the current `hw-cloudrobo-client` package is malicious. The risk arises from mutable, unverified dependency resolution and installation of components beyond the declared minimum scope. ### Attack Path 1. An attacker compromises the package publisher account, distribution infrastructure, or a future release of `hw-cloudrobo-client`. 2. Malicious installation or runtime logic is added to the release selected by `pip`. 3. A user follows the Skill documentation and runs `pip install hw-cloudrobo-client`. 4. Pip d ...[truncated 840 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example: ```bash python -m pip install "hw-cloudrobo-client==<reviewed-version>" ``` 2. Publish and use a lock file or requirements file containing SHA-256 hashes, and install with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Explicitly configure an approved package index and disable unintended fallback indexes where operationally feasible. 4. Provide a genuine robot-only distribution containing only `cloudrobo-core`, `cloudrobo-robot`, and their necessary transitive dependencies. 5. Generate and verify a software bill of materials, scan dependencies before release, and document the exact package version covered by the Skill audit. 6. Avoid recommending editable or mutable-source installations unless a commit hash is pinned and repository authenticity is verified. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/test-cli-commands.sh:73
• Finding: Verification Script Performs Destructive Cloud Operations Without Affirmative Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test-cli-commands.sh:73-99` **Vulnerability Type**: Unsafe automatic execution of mutating and irreversible operations **Risk Level**: High ### Vulnerable Code ```bash # Test 6: Robot detail (if ROBOT_ID env var is set) ROBOT_ID=${ROBOT_ID:-} if [ -n "$ROBOT_ID" ]; then echo "Test 6: Show robot detail" cloudrobo robot show --robot-id "$ROBOT_ID" echo "" echo "Test 7: Update robot (user must confirm)" echo "WARNING: This updates the robot. Press Ctrl+C to cancel." sleep 2 cloudrobo robot update --robot-id "$ROBOT_ID" --description "Updated by test" echo "" echo "Test 8: Export access config / certificate (user must confirm)" echo "WARNING: This exports the robot access config (zip) with password. Press Ctrl+C to cancel." sleep 2 mkdir -p ./certs cloudrobo robot export-certificate --robot-id "$ROBOT_ID" --password "temp-export-pw" --output ./certs || echo "Export may fail if certificate unavailable" echo "" echo "Test 9: Delete robot (user must confirm)" echo "WARNING: This deletes the robot. Press Ctrl+C to cancel." sleep 2 cloudrobo robot delete --robot-id "$ROBOT_ID" || echo "Delete may fail if robot already gone" echo "" fi ``` ### Technical Analysis The script treats the presence of the `ROBOT_ID` environment variable as authorization to update the corresponding robot, export its access credentials, and delete it. A two-second delay and an instruction to press Ctrl+C are opt-out warnings, not affirmative user confirmation. Deletion is irreversible, and certificate export creates a sensitive robot onboarding credential. These commands therefore require explicit, operation-specific consent. The implementation contradicts the Skill's documented requirement that create, update, delete, and certificate-export operations prompt the user for confirmation before execution. The script is advertised as the functional and s ...[truncated 1728 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make the default test workflow read-only and use `--dry-run` for all supported mutation tests. 2. Require a separate explicit flag such as `--enable-destructive-tests` before any real update, export, or deletion is considered. 3. Add an exact interactive confirmation before each operation. For deletion, require the user to type the complete `ROBOT_ID`. 4. Abort destructive operations when standard input is not an interactive terminal unless a separately designed CI authorization mechanism is provided. 5. Separate lifecycle tests from cleanup. Do not delete an externally supplied robot; create a uniquely named, test-owned resource and delete only that exact resource after verifying ownership. 6. Re-query the robot immediately before each mutation and display the workspace, name, status, and ID in the confirmation prompt. 7. Use narrowly scoped test credentials and an isolated test workspace without production robots. 8. Record whether each operation succeeded and stop safely on certificate-export or identity-verification failures rather than continuing to deletion. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/test-cli-commands.sh:86
• Finding: Robot Credential Bundle Is Protected by a Hardcoded Predictable Password and Weak Local File Controls<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test-cli-commands.sh:86-90` **Vulnerability Type**: Hardcoded credential-protection password and insecure sensitive-file handling **Risk Level**: High ### Vulnerable Code ```bash echo "Test 8: Export access config / certificate (user must confirm)" echo "WARNING: This exports the robot access config (zip) with password. Press Ctrl+C to cancel." sleep 2 mkdir -p ./certs cloudrobo robot export-certificate --robot-id "$ROBOT_ID" --password "temp-export-pw" --output ./certs || echo "Export may fail if certificate unavailable" ``` ### Technical Analysis The script exports a robot access credential bundle using the fixed password `temp-export-pw`. Because the password is embedded in a distributed script, it provides no meaningful confidentiality against anyone who can inspect the project or infer that the documented test was used. The password is passed through a command-line argument. On systems where process arguments are visible to other users, process monitors, audit tools, shell tracing, or CI logs, this can expose the password while the command is running. The output directory is created with `mkdir -p` and no restrictive mode. Its effective permissions depend on the user's umask and any pre-existing directory state. The script also does not verify or enforce restrictive permissions on the generated archive, does not prevent writing through an attacker-controlled pre-existing `./certs` path, and does not securely remove the credential bundle after testing. The exported archive is explicitly described elsewhere in the project as a credential bundle used by a robot to access the platform. It must therefore be handled as a secret rather than an ordinary test artifact. ### Attack Path 1. A user runs the script with valid CloudRobo credentials and a valid `ROBOT_ID`. 2. The backend generates the robot's access credential bundle encrypted with the known password `temp-export-pw`. 3. The archive i ...[truncated 1121 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hardcoded password. Generate a unique, cryptographically strong password for each export or prompt securely without echoing input. 2. Avoid passing secrets in command-line arguments. Extend the CLI to accept the password from a protected file descriptor, standard input, or a supported secret provider. 3. Create a private output directory with restrictive permissions: ```bash umask 077 CERT_DIR="$(mktemp -d)" chmod 700 "$CERT_DIR" ``` 4. Verify generated archives are regular files owned by the current user and enforce mode `0600`. 5. Reject pre-existing symbolic links and avoid a predictable relative output directory. 6. Do not upload credential archives as CI artifacts or include them in backups and source control. 7. Securely transfer the archive to its intended onboarding destination and remove the local test copy as soon as it is no longer needed. 8. Use a non-production test robot and short-lived or revocable onboarding credentials where the platform supports them. 9. Add automated checks ensuring certificate archives and output directories cannot be read by group or other users. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (14)

Credential Access

High

• Category: Privilege Escalation

Content

> **"导出配置文件" = 导出接入配置（证书）**. A robot has **two** configurations:
> - **本体配置（robot body/main config）** — built into `r2c_sdk`, or distributed together with the
>   robot adapter alongside other robots. It is **not** what "download/export config" refers to.
> - **接入配置（access config）** — the robot's access credential bundle used to connect to the
>   platform. This is the one you download/export, and it is produced by `export-certificate`.
>
> The downloaded access config is a **zip** package — treat it as a sensitive credential bundle and

• Confidence: 94% confidence
• Finding: This skill explicitly enables exporting a robot access-configuration certificate bundle, which is a credential artifact used for platform access. Even though the document warns to store it securely, the capability materially facilitates credential extraction/download and handling of sensitive access material, so misuse or weak operational controls could enable unauthorized robot/platform access.

Self-Modification

High

• Category: Rogue Agent

Content

record the `service_id` / `exec_model_id`.
4. Pass the `robot_id` and model to `robo-dispatcher`: `cloudrobo dispatch create-task --session-id <sid> --name <name> --task "<task>" --constraints-json '{"model":{"exec_model_id":"<exec_model_id>"},"robot_id":"<robot_id>","exec_constraints":{"max_run_time":10,"max_iter_num":100}}'`.
   > This skill does not call cloudrobo-infer/dispatch by name; the agent orchestrates across
   > skills by first obtaining the robot_id here, then using the infer and dispatch skills.

### Cleanup Workflow (module)

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Create robot | Write access to `cloudrobo-service` (`POST /v1/robots`) |
| Show robot detail | Read access to `cloudrobo-service` (`GET /v1/robots/{robot_id}`) |
| Update robot | Write access to `cloudrobo-service` (`PUT /v1/robots/{robot_id}`) |
| Delete robot | Delete access to `cloudrobo-service` (`DELETE /v1/robots/{robot_id}`) |
| Export certificate | Write access to `cloudrobo-service` (`POST /v1/robots/{robot_id}/certificate/export`) |
| Query SDK info | Read access to `cloudrobo-service` (`GET /v1/robots/sdk`) |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| list_robots | `list_robots(**params)` | `list` | `GET /v1/robots` |
| show_robot | `show_robot(robot_id)` | `show` | `GET /v1/robots/{robot_id}` |
| update_robot | `update_robot(robot_id, req)` | `update` | `PUT /v1/robots/{robot_id}` |
| delete_robot | `delete_robot(robot_id)` | `delete` | `DELETE /v1/robots/{robot_id}` |
| export_robot_certificate | `export_robot_certificate(robot_id, req)` | `export-certificate` | `POST /v1/robots/{robot_id}/certificate/export` |
| show_sdk | `show_sdk()` | `show-sdk` | `GET /v1/robots/sdk` |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

# → Expected click usage error: "not one of arm/humanoid/operation/other/quadruped/wheeled" (exit 2)

# 2. Path traversal rejected via validate_safe_id
cloudrobo robot show --robot-id "../etc/passwd"
# → Expected validation error

# 3. Missing workspace rejected

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# → Expected click usage error: "not one of arm/humanoid/operation/other/quadruped/wheeled" (exit 2)

# 2. Path traversal rejected via validate_safe_id
cloudrobo robot show --robot-id "../etc/passwd"
# → Expected validation error

# 3. Missing workspace rejected

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

it.
3. **Store securely** — After export, place the downloaded zip under secure storage (a protected
   directory, secret manager, or the robot-side onboarding location). Do not leave it in a shared /
   world-readable path. This zip is consumed on the robot side (e.g. by `r2c_sdk` / the R2C client)
   together with the body config already carried inside the SDK or adapter.
4. **Feedback** — Prompt the user that the access-config zip was written to the specified file, and
   that it can be used for robot-side access configuration (e.g. with `r2c_sdk.cloudroboclient`).

• Confidence: 70% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to place long-lived Huawei Cloud access keys in shell environment variables and optionally persist them in local CLI config without any warning about plaintext storage, shell history/process exposure, or host compromise risk. In a robot-management context, these credentials can grant access to robot inventory, metadata, certificate export, and workspace operations, increasing the sensitivity of poor secret-handling guidance.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The dataflow explicitly shows exporting an access-configuration or certificate ZIP to local disk, which is sensitive credential material that could enable robot access if mishandled. Even though this is only documentation, describing the workflow without strong warnings, secure-storage guidance, or restrictions normalizes writing secrets to disk in a way that increases the chance of credential exposure through weak filesystem permissions, shared directories, backups, or accidental redistribution.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file contains all user-facing content in a single language, which can constitute a language/locale policy issue when no opt-in or alternative is provided. There is no indication that the skill is intentionally limited to Chinese-speaking users or a specific region.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The acceptance criteria explicitly require exporting a robot access configuration/certificate zip to a local file, but they do not require any warning, masking, or handling guidance for sensitive output. In this skill context, exported access-config/certificate bundles are security-relevant credentials for robot access, so documenting local file creation without explicit safeguards increases the risk of accidental credential exposure, insecure storage, or unsafe automation behavior.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Lines L38-L40 introduce key operational terms using Chinese phrases such as 本体配置, 接入配置, and 下载/导出配置文件 inside an otherwise English reference document. Because the file does not state a locale requirement or offer user language choice, this can create a language/locale policy issue for users who are expected to follow the instructions.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The markdown instructs users to set `HUAWEI_CLOUD_AK/SK` environment variables, which are sensitive credentials. While this appears in a troubleshooting table, the document does not include any warning about treating these values as secrets or avoiding accidental exposure in shell history, logs, or shared environments.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: The manifest describes managing CloudRobo robot instances and related robot-specific metadata, certificates, and SDK information. The test script additionally invokes `cloudrobo workspace list`, which exercises a separate workspace-management capability rather than a robot-management operation.

Static analysis

No suspicious patterns detected.