Security audit

huawei-cloud-dws-dymem-diag

Security checks across malware telemetry and agentic risk

Overview

The skill mostly performs the promised DWS memory diagnosis, but it deserves Review because it persists sensitive reports locally and documents risky cloud credential setup methods.

Review before installing. Use a least-privileged IAM identity, avoid putting AK/SK on command lines, keep config files out of version control, and prefer interactive, environment, temporary, or secret-manager based credential handling. Treat generated dws_mem_diagnosis_report_*.html files as sensitive because they may contain cluster, IP, user, and SQL details.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill’s stated purpose is to generate and return a diagnosis report, but it additionally instructs the agent to write an HTML file into the local workspace. Unnecessary filesystem writes expand the skill’s side effects, can leave sensitive diagnostic artifacts on disk, and create persistence beyond the user-visible response.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Writing a report to the current working directory is not necessary for performing memory diagnosis itself and introduces an avoidable capability: local persistence. Diagnostic reports may contain cluster identifiers, node names, IPs, usernames, and SQL text, so saving them locally increases the risk of unintended disclosure to other processes, users, or later workflows.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill silently creates a local HTML file without warning or consent, which is a security-relevant side effect even if the content is legitimate. Hidden file creation undermines user expectations and may result in sensitive operational data being stored on disk where it can be discovered or exfiltrated later.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The installation guide explicitly instructs users to place plaintext AK/SK cloud credentials into a YAML configuration file before startup encryption occurs. Even if the server later auto-encrypts them, the secrets exist in plaintext at rest during setup and may be exposed through editors, backups, filesystem access, version control mistakes, or copied documentation snippets. In the context of a cloud operations MCP server, compromised AK/SK can grant direct API access to DWS and potentially broader cloud resources, making this more dangerous than ordinary application config guidance.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The CLI example passes `--ak` and `--sk` directly on the command line, which can expose secrets via shell history, process listings, audit logs, and terminal recording tools. Because these are Huawei Cloud credentials for an MCP server that can query operational data, disclosure could allow unauthorized access to cluster metrics and possibly other cloud APIs tied to the account. The skill context increases risk because it targets infrastructure diagnosis, where operators are likely to run commands on shared bastions or admin workstations with monitoring and logging enabled.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.