Security audit

huawei-cloud-dws-mem-diag

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Huawei DWS memory diagnostic, but its setup and output handling can expose sensitive cloud credentials and operational report data without enough user control.

Install only if you are comfortable granting read-only DWS monitoring access and handling the output as sensitive. Prefer least-privilege temporary credentials, avoid putting AK/SK on command lines, protect any generated HTML report, and delete it when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to persist a generated HTML report to the local workspace, which goes beyond merely returning a diagnosis to the user. Local file writes create an unnecessary side effect, can leave sensitive operational data at rest, and may violate least-privilege expectations for a diagnostic skill.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Writing an HTML file is not necessary to perform memory diagnosis and introduces persistence of potentially sensitive cluster metadata, SQL text, usernames, and memory statistics. This broadens the skill's capabilities from read-only diagnostics to local state modification, increasing risk if the workspace is shared, synced, or later processed by other tools.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs saving an HTML report locally without warning the user that data will be written to disk. Because the report may contain infrastructure identifiers, hostnames, usernames, and SQL statements, silently persisting it can expose sensitive information and surprise users who expected transient analysis only.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation explicitly tells users to place AK/SK secrets in plaintext in a YAML file and states they will be auto-encrypted later, but it does not warn that the initial plaintext entry is itself sensitive and may be exposed through editor backups, file permissions, source control, screenshots, or accidental sharing before encryption occurs. In the context of a cloud operations MCP server, these credentials can grant access to production monitoring and potentially broader cloud resources, so normalizing plaintext secret handling increases the chance of credential compromise.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The CLI example includes `--ak` and `--sk` directly on the command line, which can expose secrets through shell history, process listings, audit logs, terminal recording, and CI/CD logs. Because these are Huawei Cloud access credentials used by an MCP server for live DWS access, compromise of the values could enable unauthorized API access and cloud resource abuse.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.