huawei-cloud-cloudrobo-train

• Outcome: Review
• Latest audit: Sep 9, 2026 · 11:46 AM UTC
• Version: 1.0.0

Overview

The skill is for CloudRobo training management, but it tells agents to perform real cloud changes that can consume resources without final user confirmation.

Review this skill before installing. Use narrowly scoped CloudRobo credentials and a dedicated test workspace, do not run the included test script against production, and require an explicit final confirmation before any create, restart, save-draft, checkpoint registration, update, stop, resume, clone, or delete operation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:665
• Finding: Cloud Write Operations Are Submitted Without Explicit User Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:665-671` **Vulnerability Type**: Missing authorization checkpoint for cloud mutations **Risk Level**: High ### Complete Code Snippet ```markdown **Silent submit by default.** Creation commands (`create-task`/`restart-task`/ `register-checkpoint`/`save-draft`) submit without prompting. The agent **MUST NOT** print raw JSON or code. With `--verbose/-v`, present a user-friendly grouped summary (tables/lists), then submit directly — no yes/no. **Destructive ops** (`stop-task`/`delete-tasks`/`resume-task`): agent confirms `task_id` before acting. **`restart-task`**: if config edited, show diff briefly then submit; if no edits, submit silently. ``` ### Technical Analysis The Skill explicitly instructs the Agent to perform several authenticated cloud write operations without obtaining affirmative user approval immediately before execution. The affected operations include: - Creating training and SimRL tasks - Restarting or resubmitting tasks - Registering checkpoints - Saving drafts Creating or restarting a training task can allocate costly compute resources and transmit task configuration, model identifiers, dataset identifiers, environment values, and object-storage paths to CloudRobo services. Merely displaying a summary does not establish authorization when the instructions explicitly prohibit a final yes/no confirmation. The behavior also conflicts with `references/iam-policies.md:87`, which states that create, stop, restart, delete, save-draft, update, and resume operations require user confirmation. Confirmation is only consistently required for a subset of destructive operations in `SKILL.md`. This issue does not demonstrate malicious intent or privilege escalation. The commands use the user's existing credentials and declared CloudRobo functionality. The flaw is the lack of a reliable authorization boundary before consequential network mutations. ### Attack Path 1. A user makes an exp ...[truncated 1389 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, affirmative confirmation immediately before every cloud mutation, including: - `create-task` - `restart-task` - `register-checkpoint` - `save-draft` - `update-task` - `stop-task` - `resume-task` - `delete-tasks` - `clone-task` 2. Before requesting confirmation, display a concise operation summary containing: - Operation type - Account, region, and workspace - Task name and mode - Model and dataset sources - Resource pool, accelerator specification, and worker count - Output model behavior - Whether the operation can start compute usage or incur cost 3. Require a response such as “Confirm” rather than treating silence, “OK” from an earlier workflow step, or a request to inspect configuration as execution approval. 4. Apply stronger confirmation to irreversible deletion and potentially expensive task creation. For deletion, require the exact task ID or task name to be repeated. 5. Reconcile `SKILL.md` with `references/iam-policies.md` so that all documentation enforces the same confirmation policy. 6. If non-interactive automation is required, introduce an explicit user-controlled flag such as `--approve-mutation`, disabled by default. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/test-cli-commands.sh:56
• Finding: Verification Script Performs Real Cloud Mutations Without Affirmative Consent<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test-cli-commands.sh:56-147` **Vulnerability Type**: Unsafe integration-test behavior using ambient cloud credentials **Risk Level**: Medium ### Complete Code Snippet ```bash # Test 5: Save draft task echo "Test 5: Save draft task" DRAFT_RESULT=$(cloudrobo train save-draft --config '{"name": "test-draft", "train_mode": "MODEL_TUNING"}') echo "$DRAFT_RESULT" DRAFT_TASK_ID=$(echo "$DRAFT_RESULT" | python3 -c "import sys, json; print(json.load(sys.stdin).get('id', ''))" 2>/dev/null || echo "") echo "Draft task ID: $DRAFT_TASK_ID" echo "" # Test 12: Restart draft task (submit it) if [ -n "$DRAFT_TASK_ID" ]; then echo "Test 12: Restart draft task (submit it)" echo "WARNING: This will submit the draft task. Press Ctrl+C to cancel." sleep 2 cloudrobo train restart-task --task-id "$DRAFT_TASK_ID" || echo "Expected: may fail if draft config is incomplete" echo "" fi # Test 18: Delete draft task (cleanup) — CLI now supports delete-tasks if [ -n "$DRAFT_TASK_ID" ]; then echo "Test 18: Delete draft task (cleanup)" echo "WARNING: This will delete the draft task. Press Ctrl+C to cancel." sleep 2 cloudrobo train delete-tasks --task-id "$DRAFT_TASK_ID" || echo "Delete may fail if task already submitted" echo "" fi ``` ### Technical Analysis The test script is presented as a general verification utility, but it is not read-only. It uses whatever CloudRobo credentials and default workspace are active in the environment to: 1. Create a draft task 2. Attempt to restart and submit that task 3. Attempt to delete that task The script displays warnings before restart and deletion, but a two-second sleep is not an affirmative confirmation mechanism. The initial draft creation has no warning or opt-in at all. Because the CLI lacks a dry-run mode, executing the script against a production or shared workspace changes real cloud state. Although the draft is created by the same s ...[truncated 1716 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make the script read-only by default. 2. Require an explicit mutation flag before draft creation, restart, or deletion, for example: ```bash if [ "${ALLOW_MUTATIONS:-false}" != "true" ]; then echo "Mutating tests skipped. Set ALLOW_MUTATIONS=true to enable them." exit 0 fi ``` 3. Add interactive confirmation when running in a terminal: ```bash printf 'Type MUTATE to run cloud write tests: ' read -r confirmation [ "$confirmation" = "MUTATE" ] || exit 1 ``` 4. Require the user to supply a dedicated test workspace ID. Refuse to run mutating tests when relying on automatic workspace resolution. 5. Use unique test names containing a timestamp or random suffix to prevent collisions. 6. Install an `EXIT`, `INT`, and `TERM` trap that attempts cleanup, while clearly reporting cleanup failures. 7. Before deletion, fetch the task and verify that: - Its ID equals the ID created during the current run - Its name contains the generated test-run identifier - It belongs to the explicitly selected test workspace 8. Separate read-only smoke tests from mutating integration tests into different scripts. 9. Prevent signed URLs, detailed logs, and potentially sensitive task output from being written to shared CI logs unless explicitly requested. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:8
• Finding: CloudRobo CLI Dependency Is Installed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md:8-26` **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Complete Code Snippet ```markdown ### Option 1: Install all packages (recommended) ```bash pip install hw-cloudrobo-client ``` This installs the aggregate package with all functional modules (asset, dataset, train, eval, infer, robot, dispatch, workspace). ### Option 2: Install only train package ```bash pip install hw-cloudrobo-client ``` This installs `cloudrobo-core` (CLI framework) + `cloudrobo-asset` (cross-package dependency for algorithm/dataset/model queries) + `cloudrobo-train`. ### Option 3: Development install (editable) ```bash git clone <cloudrobo-client-repo> cd cloudrobo-client pip install hw-cloudrobo-client ``` ``` ### Technical Analysis The installation guide directs users to install `hw-cloudrobo-client` without: - A fixed version - Package hashes - A specified trusted package index - A verified repository URL or commit - Signature or provenance verification Python package installation executes package build and installation logic with the invoking user's local privileges. The unpinned command resolves whichever package version the configured package index currently serves. A future compromised, malicious, or unexpectedly incompatible release would therefore be installed without review. The development-install section is also not reproducible: the repository is a placeholder, no trusted origin is identified, no commit is pinned, and the command shown after `git clone` still installs the index package rather than clearly installing the checked-out source. No evidence was found that the named dependency is currently malicious. This finding concerns avoidable supply-chain exposure rather than a confirmed compromised package. ### Attack Path 1. A user follows the installation guide and runs `pip install hw-cloudrobo-client`. 2. The package ...[truncated 1325 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a reviewed release: ```bash python -m pip install "hw-cloudrobo-client==<reviewed-version>" ``` 2. Publish an official lock file or requirements file with cryptographic hashes and recommend: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Identify the official package index and package publisher. Where practical, configure pip to use only the trusted index. 4. Document how users can verify package provenance, signatures, release checksums, or attestations. 5. Pin all transitive dependencies through a generated lock file and update them through a controlled review process. 6. Recommend installation in an isolated virtual environment rather than into the system Python environment. 7. Correct the development-install instructions to: - Provide the exact official HTTPS repository URL - Pin a reviewed tag or commit - Verify the tag or commit signature - Install the checked-out source explicitly, such as `python -m pip install .` 8. Advise users not to expose long-lived AK/SK credentials during installation and to use narrowly scoped credentials when operating the CLI. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file documents a cross-package capability to list algorithms through a different service (`cloudrobo-asset-manager`) that is outside the primary service surface described for this skill. Even though it is only documentation, exposing undeclared capabilities can mislead agents into invoking functionality not covered by the manifest, weakening permission boundaries and enabling unintended data access or service interaction.

Static analysis

No suspicious patterns detected.