Security audit

huawei-cloud-dws-io-diag

Security checks across malware telemetry and agentic risk

Overview

This DWS diagnostic skill is mostly read-only and purpose-aligned, but it needs Review because it expands beyond its declared tool list, handles cloud credentials in risky ways, and saves potentially sensitive reports locally.

Review this skill before installing if you are comfortable with it running local hcloud/Python commands, querying DWS monitoring and active-query data, and saving an HTML report locally. Prefer interactive credential setup or a secret manager, avoid putting AK/SK values in command lines or committed YAML files, restrict config file permissions, and treat generated reports as sensitive operational data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs execution of arbitrary local Python one-liners to read local files and format timestamps, which exceeds the declared allowed tool surface. Even though the examples are simple, they normalize shell/Python execution from within the skill and create a path for local file access and environment interaction not constrained by the manifest.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The manifest allows only MCP tools, but the body directs direct KooCLI command execution. This mismatch expands the effective capability of the skill beyond what a policy reviewer or runtime might expect, undermining tool allowlisting and enabling command execution paths outside the declared interface.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill directs writing an HTML report into the local workspace, which is a filesystem side effect not reflected in the declared tool list. Unannounced file creation can overwrite artifacts, leak sensitive diagnostic content into persistent storage, or be abused as a stepping stone for further local manipulation.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Saving a report file without clear user warning or consent introduces an unexpected side effect. In a diagnostic context, the generated HTML may contain cluster identifiers, usernames, SQL text, or operational data that persists locally and may later be accessed by other users or processes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The installation guide explicitly tells users to place plaintext AK/SK values in a YAML file and to pass them on the command line, with encryption only occurring later on startup or via a separate command. This creates a real credential-handling risk because secrets may be exposed in shell history, process listings, editor backups, CI logs, or accidentally committed config files before encryption occurs.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.