huawei-cloud-devkit-webui-create

• Outcome: Review
• Latest audit: Aug 22, 2026 · 2:43 PM UTC
• Version: 1.0.0

Overview

The skill fits its DevKit installation purpose, but it needs Review because it combines cloud provisioning, root SSH installation, public network exposure, weak trust checks, and explicit guard-bypass polling guidance.

Install only if you are comfortable granting cloud credentials that can create ECS/EIP/security-group resources and use KMS decrypt. Before running it, restrict security group sources to your IP or VPN instead of 0.0.0.0/0, confirm all package sources, rotate or protect the DevKit admin password and logs, verify SSH host keys, and run KMS cleanup after successful verification. I found no artifact-backed evidence of hidden exfiltration or unrelated destructive behavior, but the defaults are too powerful and too loosely scoped for automatic trust.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs use of environment variables, file reads/writes, and shell/CLI execution, but it does not declare permissions. This creates a transparency and policy-enforcement gap: an agent may execute sensitive operations without users or the platform having an explicit capability declaration to review or restrict.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The guide explicitly frames the procedure as 'doom-loop safe' and instructs the agent to avoid a built-in safeguard by moving repeated status checks into a background script and varying read operations. Even if the operational goal is progress monitoring, documenting a method to bypass safety controls weakens enforcement boundaries and normalizes circumvention patterns that could be reused for riskier repeated actions.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: This section explicitly recommends incrementing parameters so each call appears distinct and therefore avoids repeated-command detection. Guidance on parameter variation to evade a guard is a direct safeguard circumvention technique; in a security-sensitive automation context, that increases the chance agents will bypass platform protections rather than operate within them.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring promises that the KMS key will be scheduled for deletion after DevKit installation, but the implementation leaves cleanup to a separate manual subcommand. This mismatch can cause operators to assume credentials become unrecoverable automatically when they do not, leaving the encrypted administrator password decryptable for longer than intended.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger list includes broad phrases like 'DevKit' and related generic mentions that may activate the skill outside a clear installation request. In this skill's context, activation can lead to guidance for cloud provisioning, credential handling, and remote installation steps, so over-triggering increases the chance of unintended sensitive actions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide documents a default administrative account (`devadmin`) and states that the default password is available in the installation log, but does not prominently require immediate password rotation or log protection. In this skill context, the installation is automated on a cloud-exposed WebUI host and logs are written to predictable locations, which materially increases the chance of credential disclosure and unauthorized admin access.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The workflow performs broad system modifications: installing many packages, downloading and extracting a large archive, and launching a multi-minute installer that alters services and ports. While this appears operationally intended rather than malicious, the instructions do not prominently require explicit user approval, integrity verification of the downloaded package, or clear warnings about persistent host changes, which increases the chance of unsafe execution on the wrong system.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs creating ingress rules for SSH (22) and the DevKit WebUI port (8086) from 0.0.0.0/0, exposing administrative services to the entire internet. In the context of a newly created cloud VM with password-based SSH and a management web interface, this significantly increases the attack surface for brute force, credential stuffing, and direct exploitation of service vulnerabilities.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The document grants highly sensitive KMS permissions including decrypt and key lifecycle operations, but provides no caution about their security implications or the risk of exposing plaintext credentials. In this skill context, those permissions directly support password handling for SSH access to newly created cloud instances, so omission of warnings increases the chance of over-privileged deployment and unsafe reuse of the policy.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The recommended IAM policy is broad and includes create/update permissions for ECS, EIP, VPC security group rules, and KMS without any warning about infrastructure changes, network exposure, or cost impact. In this skill, those permissions can create compute resources, alter network access, and manage secrets, making the absence of guardrails more dangerous than in a purely informational document.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The process writes installation progress into predictable temp-file paths such as /tmp/devkit_poll_progress.log without any retention, access-control, or cleanup guidance. In this skill's context, logs may contain infrastructure metadata and operational state, so leaving them in shared temporary storage creates avoidable local data exposure and persistence risk.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The guide silently switches package installation to a region-specific mirror based only on system timezone, which is a weak proxy for user intent and trust preference. This can cause unexpected dependency sourcing from a different repository than the default, reducing supply-chain transparency and potentially violating policy or compliance expectations in sensitive environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The verification instructions use `curl -k` against an HTTPS endpoint without warning that certificate validation is being bypassed. This can mask invalid, self-signed, mismatched, or intercepted certificates, causing operators to wrongly conclude the WebUI is securely reachable when TLS trust is actually broken.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script automatically answers 'yes' to multiple prompts that authorize environment check failures, image source changes, firewall/port decisions, and dependency installation without any independent validation or operator confirmation. In this skill's context, those prompts can trigger system configuration changes on a newly provisioned cloud host, so blind acceptance increases the chance of unsafe deployment, unintended package source changes, or proceeding despite failed prerequisite checks.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The SSH client uses AutoAddPolicy, which blindly trusts any host key presented by the remote endpoint. In this skill, the script decrypts an administrator password from KMS and uses it for root SSH, so a man-in-the-middle or misrouted IP could capture credentials and receive uploaded install scripts while the client believes it connected safely.

Missing User Warnings

High

• Confidence: 84% confidence
• Finding: The script generates and executes an Expect script that blindly answers installer prompts, including authorizations, image source changes, dependency installation, and plugin selection. In this skill context, that reduces operator visibility into what privileged installer actions are being approved and can cause unsafe or unexpected system changes if the upstream install.sh behavior changes or prompts are manipulated.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The script writes an executable Expect script, PID file, log, and working artifacts into predictable paths under /tmp, then executes from there. In a multi-user environment, predictable /tmp usage can enable symlink or race-condition attacks, file clobbering, tampering with the executed script, or disclosure of sensitive installation details through world-readable artifacts depending on umask and system configuration.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **2a. KMS decrypt** — Python SDK reads cipher text from file and decrypts password from `kms_key_id`
2. **2b. paramiko SSH connect** — `SSHClient.connect(password=decrypted)` — password in Python memory only
3. **2c. Upload scripts** — SFTP upload `install_devkit_webui.sh`, `auto_install_devkit.expect`, `verify_devkit.sh` to `/tmp/`
4. **2d. Start DevKit install** — Execute `nohup bash /tmp/install_devkit_webui.sh <url> &` on remote ECS (background)
5. **2e. Poll install progress** — Launch `poll_devkit_status.py` in background (output to log file), then use `read` tool with incrementing offset to read the log every 10-20s and report to user (doom-loop safe, continuous visibility; see Polling Progress below)
6. **2f. Verify installation** — Run `verify_devkit.sh` and check results
7. **2g. Report result** — If verification passed, prompt agent to proceed to Task 4 (cleanup-kms); if failed, KMS key is preserved for retry

• Confidence: 79% confidence
• Finding: The skill intentionally starts long-running background processes with `nohup` and instructs polling via background status scripts, which creates session persistence on the remote host. In a remote administration context this can outlive the initiating session, complicate auditability, and leave unattended processes or logs running if cleanup and process ownership are not tightly controlled.

Session Persistence

Medium

• Category: Rogue Agent

Content

cd /tmp/DevKit-All/DevKit-All-26.1.RC1-Linux-Kunpeng
# Previous extraction directory retained for inspection
PID_FILE="/tmp/devkit_install.pid"
nohup /tmp/auto_install_devkit.expect > /tmp/devkit_install.log 2>&1 &
INSTALL_PID=$!
echo "${INSTALL_PID}" > "${PID_FILE}"
echo "Install PID: ${INSTALL_PID} (saved to ${PID_FILE})"

• Confidence: 79% confidence
• Finding: Using nohup to detach the installer creates a persistent background process that continues after the session ends, which can hide long-running changes from the initiating operator and complicate monitoring or containment if the install behaves unexpectedly. In this skill's context, the process runs an automated interactive installer as root-like administrative workflow, so persistence materially increases operational risk.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo ""
echo "[5] WebUI Access"
http_code=$(curl -k -s -o /dev/null -w "%{http_code}" https://localhost:8086 2>/dev/null || echo "000")
check "WebUI (HTTP $http_code)" "$([ "$http_code" == "200" ] || [ "$http_code" == "302" ] && echo ok || echo fail)"

echo ""

• Confidence: 97% confidence
• Finding: The end-to-end script uses `curl -k` to determine success of the HTTPS WebUI check, which turns off certificate verification entirely. In a cloud-installed admin interface context, this encourages insecure validation and could allow man-in-the-middle, misissued certificate, or hostname mismatch issues to go unnoticed during deployment verification.

Static analysis

No suspicious patterns detected.