huawei-cloud-ecs-dsh-deploy

• Outcome: Review
• Latest audit: Aug 31, 2026 · 7:35 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Huawei Cloud deployment tool, but it can create and delete cloud servers, modify systems, and handle credentials in ways that need careful review before use.

Install only if you intend to let this skill manage real Huawei Cloud resources and accept possible charges. Use temporary least-privilege AK/SK credentials, avoid passing secrets on the command line, do not use --auto-confirm or --force-delete, verify exact server IDs before deletion, and rotate or protect any generated root password or pre-seeded API key.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents capabilities to read/write files, access environment variables, use the network, and execute shell-like actions, yet it declares no permissions boundary. For a skill that can create paid cloud resources and handle credentials, missing explicit permission declarations weakens reviewability and increases the chance of over-privileged or unintended execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description frames the skill as a deployment helper, but the documented behavior includes additional high-impact actions such as purchasing instances, deleting servers, managing networking, and installing from external mirrors. This mismatch can mislead reviewers and users about the true operational and financial blast radius, increasing the risk of unauthorized or surprising destructive actions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a deployment tool, but it also exposes server inventory, status inspection, and deletion capabilities. This expands its authority beyond the advertised purpose and increases the chance that a user or agent invokes broader cloud-management actions than intended, especially when operating with high-privilege credentials.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script supports destructive deletion of ECS servers even though the stated purpose is deploying DeepSeek Harness. With cloud credentials provided, this enables an agent or operator to remove arbitrary servers by name or ID, creating a real risk of data loss, downtime, and accidental destruction of unrelated infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This wrapper is framed as a DeepSeek Harness deployment helper, but it also provisions general VPC/subnet/security-group resources and can delete ECS servers by ID or name. That materially expands the skill's authority beyond deployment into broader infrastructure lifecycle control, increasing the blast radius if the skill is triggered unintentionally, misused by another agent step, or supplied ambiguous inputs.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: When no subnet exists, the code automatically creates a VPC and subnet instead of failing closed and asking for user approval. For a skill advertised as ECS deployment, silent network-environment creation is an unjustified capability expansion that can create billable resources, alter account topology, and bypass expected change-control or architectural review.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill includes a general-purpose server deletion function unrelated to its stated deployment purpose, and it can resolve targets by a name filter rather than a tightly scoped identifier. In an agent setting, that creates a real risk of destructive actions against unintended or arbitrary ECS instances, especially if names are ambiguous or prompts are manipulated.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The utility goes beyond cloud deployment by automatically installing local Python packages with pip, including use of --break-system-packages. This expands the blast radius from remote resource provisioning to host modification, which can alter the operator environment, introduce supply-chain risk, and violate least-privilege expectations for a deployment skill.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill includes an external messaging capability via the openclaw CLI to send Feishu notifications, which is not essential to core ECS deployment. That creates an additional outbound data channel that can disclose deployment status, identifiers, or user-related data to third-party systems from the execution host.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Several triggers such as 'dsh', 'DeepSeek Harness', 'Flexus X', and 'AI智能体' are broad enough to match casual discussion rather than clear deployment intent. In a skill that can create billable cloud resources or delete infrastructure, overly broad invocation increases the chance of accidental activation and unintended actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The acceptance criteria embeds AK/SK directly in command-line examples, which can expose credentials through shell history, process listings, terminal scrollback, CI logs, and screenshots. Because this skill is for real cloud resource deployment, the example may be copied verbatim by users, making accidental credential disclosure plausible and operationally significant.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The example passes a DeepSeek API key directly via `--api-key sk-...`, which is especially risky because API keys are long-lived secrets and are commonly captured by shell history, `ps` output, logging systems, and shared terminals. In this deployment context, compromise of the API key could enable unauthorized API usage, billing abuse, and downstream access to the deployed agent workflow.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to download and execute a remote shell installer via curl and bash without any integrity verification, signature check, pinning to a specific version, or warning about the risks of running remote scripts. If the download source, DNS, transport, or hosting bucket is compromised, users could execute arbitrary code on their systems.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document instructs users to enter a DeepSeek API key into the Web UI but does not clearly label the key as sensitive, warn against sharing/logging it, or explain how it will be stored. In a deployment/verification context for a remotely hosted service, this can lead to credential exposure through screenshots, browser autofill, shell history, copied notes, or insecure server-side persistence, especially because the guide also has users operate as root and inspect service configuration files.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The deployment path creates and executes a root-level bootstrap script that installs packages, rewrites APT sources, modifies systemd, Nginx, firewall rules, and starts services on a remote ECS instance, but this function contains no explicit confirmation gate. In a skill that triggers on broad phrases like 'dsh' and 'AI智能体', this increases the risk of unintended destructive changes and cloud-cost-incurring actions from ambiguous or insufficiently confirmed user intent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The CLI accepts AK, SK, security token, and API key directly as command-line arguments, which can leak via shell history, process listings, job control tools, audit logs, or orchestration telemetry. These credentials can permit cloud API access or model account abuse if observed by another local user, admin, or logging system.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script silently reads Huawei Cloud credentials from environment variables, which can cause users or higher-level agents to grant sensitive account access without an explicit warning at the point of use. In a skill context, this weakens informed consent and can broaden the blast radius if the tool is triggered unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The optional API key is sent into remote deployment to be pre-seeded on the target server, but the script does not prominently warn that the secret will be stored remotely in service configuration. This creates risk of secret persistence on a provisioned host, possible exposure through logs/configuration, and user misunderstanding about where the credential resides.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The server creation path returns the administrator password in the result object, making it easy for downstream logs, transcripts, tool traces, or other agents to expose privileged credentials. In this skill context, the returned credential grants root/administrator access to a newly internet-reachable server, so accidental disclosure can directly lead to host compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function queries multiple third-party IP-discovery services from the local host, disclosing that the host is running this workflow and exposing its public IP to external services without an explicit warning in this file. In enterprise or sensitive environments, this kind of undisclosed outbound network activity can violate privacy, policy, or operational constraints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The notification helper transmits title and message content to Feishu through an external CLI, creating a data-sharing path outside the immediate deployment function. Depending on message contents, this may leak operational details, usernames, deployment state, or other contextual metadata without sufficiently clear disclosure.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| --zone | Specify availability zone | Auto-select |
| --random-zone | Randomly select availability zone | Off |
| --no-eip | Do not create elastic public IP | Off |
| --auto-confirm | Skip interactive confirmation (use with caution!) | Off |

### Credential Configuration Examples

• Confidence: 82% confidence
• Finding: The presence of an '--auto-confirm' path can bypass the manual confirmation safeguard for a workflow that creates paid infrastructure. Even if labeled 'use with caution', a confirmation bypass materially raises the risk of unintended charges or automated provisioning without explicit contemporaneous user consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

parser.add_argument('--list-servers', action='store_true',
                        help='List all servers in the region')
    parser.add_argument('--force-delete', action='store_true',
                        help='Force delete without confirmation')

    parser.add_argument('--status', type=str, metavar='SERVER_ID_OR_NAME',
                        help='Check deployment status of a server')

• Confidence: 90% confidence
• Finding: The presence of a force-delete path that bypasses confirmation enables destructive cloud actions without an interactive safety check. In an agent setting, this materially increases the chance of accidental or unauthorized deletion because a single tool invocation can remove resources immediately.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

parser.add_argument('--api-key', type=str,
                        help='DEEPSEEK_API_KEY to pre-seed into the dsh service (optional)')

    parser.add_argument('--auto-confirm', action='store_true',
                        help='Skip interactive confirmation (use with caution!)')

    args = parser.parse_args()

• Confidence: 93% confidence
• Finding: The --auto-confirm option allows the script to create paid cloud resources without interactive confirmation. In an agent-driven environment, this weakens a key billing and safety safeguard and can lead to unintended provisioning and charges.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

else:
                    print("❌ Invalid input, please enter 'yes', 'no' or 'CONFIRM'")
        else:
            print("⚠️ Auto-confirm enabled, proceeding with deployment...")

        zone_info = f"Zone: {zone}\n" if zone else ""
        send_progress_notification(

• Confidence: 94% confidence
• Finding: This code path explicitly proceeds with provisioning when auto-confirm is enabled, bypassing the manual billing acknowledgment. In context, the skill can create chargeable cloud resources, so skipping confirmation is operationally dangerous and unsuitable for autonomous invocation.

Static analysis

No suspicious patterns detected.