Security audit

huawei-cloud-ecs-alert

Security checks across malware telemetry and agentic risk

Overview

This Huawei Cloud alarm skill mostly matches its stated job, but it needs review because it can change cloud monitoring and notification settings while asking for broad permissions and using loose triggers and setup guidance.

Review this skill before installing. Use it only with a narrowly scoped Huawei Cloud IAM user, prefer the custom least-privilege policy over FullAccess, verify installer downloads before running them, avoid passing AK/SK on the command line, and require explicit confirmation before any create, update, or delete operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documents shell execution and environment-dependent behavior but does not declare corresponding permissions. This can cause the agent framework or user to underestimate the skill's ability to run commands and access local configuration, increasing the risk of unintended command execution or data exposure from the host environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared purpose focuses on ECS alarm management, but the documented behavior expands into adjacent capabilities such as listing ECS resources, managing SMN subscriptions, creating email subscriptions, and running environment diagnostics. This broader-than-declared scope can mislead users and reviewers about what the skill can do, enabling unexpected writes and operational changes in the cloud environment.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill claims delete alarm operations are prohibited, yet later normalizes delete-capable commands for related notification resources. Contradictory safety guidance weakens operator trust boundaries and may cause an agent or user to treat destructive operations as allowed when the policy intent is restrictive.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation gives inconsistent guidance on AK/SK handling, with one part rejecting environment-variable authentication while another says AK/SK may be supplied via environment variables or CLI config. Conflicting credential instructions can lead users to insecure handling, confusion about the real auth path, or accidental exposure through scripts and automation.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: Several triggers are broad and generic, such as 'create alert' and 'list alarms', making accidental invocation more likely during ordinary cloud-monitoring conversations. In a skill that performs write operations and can manage subscriptions, unintended activation raises the chance of confusing or unsafe operational suggestions.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes broad terms like "CPU alert", "memory alert", and generic Chinese monitoring/alarm phrases, which can cause the skill to activate for loosely related requests rather than only explicit Huawei ECS alarm-management tasks. In an agent setting, overly broad triggers increase the chance of unintended invocation of write-capable workflows, especially since this skill can create, update, and delete cloud alerting resources.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions download a shell script over the network and execute it directly without any integrity verification, signature check, or cautionary note. If the hosting location, transport path, or downloaded file were tampered with, users could execute arbitrary code on their systems; in this skill context, that risk is elevated because the same environment may also hold cloud credentials used for ECS/CES/SMN administration.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The document recommends CES FullAccess and SMN FullAccess as minimum requirements, which grants broad administrative capability beyond the stated operational needs. In an automation skill that creates and updates alarms, this overprivileging increases blast radius if the credentials are misused or the skill is compromised, enabling unnecessary changes to monitoring and notification infrastructure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The troubleshooting guide instructs users to pass AK/SK credentials directly on the command line via `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK>` without any warning about shell history, process inspection, or persistent local storage. In an infrastructure automation skill for cloud monitoring, these credentials can grant meaningful access to CES/ECS/SMN resources, so exposing them increases the risk of credential leakage and subsequent cloud account compromise.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script prints subscription endpoints directly to stdout, which may expose email addresses, phone numbers, webhook URLs, or internal service endpoints to users, logs, chat transcripts, or shared terminals. In an agent skill context, this is more dangerous because output is often surfaced verbatim to end users or stored in execution logs without any warning or masking.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 86% confidence
Finding: The trigger phrase 'create alert' overlaps with a generic built-in command pattern and may shadow or intercept unrelated user intents. Because this skill includes write operations, ambiguous triggering can steer users into an automation path that proposes or performs cloud changes they did not specifically intend.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 86% confidence
Finding: The trigger 'list alarms' is highly generic and may conflict with broader platform listing commands or other alarm-related skills. In context, accidental routing to this cloud-specific skill could expose infrastructure inventory details or lead to follow-on operational actions under the wrong assumption.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/common-commands.md:76