huawei-cloud-ecs-sqlbot-deploy

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:43 PM UTC
• Version: 1.0.0

Overview

This skill appears to deploy SQLBot as advertised, but it needs review because it can create paid cloud resources and handles credentials in unsafe ways.

Install only if you are comfortable with a deployment tool that can create paid Huawei Cloud resources, run root scripts on a new server, and expose initial passwords in terminal output and optional Feishu messages. Prefer temporary AK/SK credentials from environment variables, avoid command-line or chat secrets, disable notifications unless needed, change both default passwords immediately, and review cloud resources and charges after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (30)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'-i', 'https://repo.huaweicloud.com/repository/pypi/simple'
            ] + modules_to_install
            
            result = subprocess.run(
                pip_cmd,
                capture_output=True,
                text=True,

• Confidence: 93% confidence
• Finding: The code automatically runs pip install with --break-system-packages, modifying the local Python environment without an explicit confirmation step. Although subprocess.run is invoked with an argument list rather than a shell string, the dangerous behavior is the silent environment mutation and package retrieval from a network repository during execution of a deployment skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Use openclaw message send command to send notification
            # Run in background to avoid blocking
            result = subprocess.run(
                [
                    "openclaw", "message", "send",
                    "--channel", "feishu",

• Confidence: 88% confidence
• Finding: This invokes an external CLI to send notifications to Feishu, which can transmit deployment-related content off-host to a third-party service. The subprocess usage itself is not shell-injection-prone here, but it creates an external data egress capability controlled by runtime config and message content.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes sensitive capabilities including environment access, shell execution, network use, and file operations, but does not explicitly declare equivalent permissions or scope boundaries. In an agent setting, this reduces transparency and can lead to over-privileged execution or user misunderstanding about what the skill is allowed to do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose understates materially risky behaviors: local package installation, external notifications, infrastructure creation beyond a single server, and disclosure/propagation of generated and hardcoded credentials. This mismatch can cause users to approve a deployment workflow without realizing it may alter the local environment, contact third parties, or expose secrets.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document claims 'no hardcoded credentials' as a security acceptance criterion, yet it also includes credential-like AK/SK examples elsewhere and normalizes a default SQLBot login credential. Even if the AK/SK strings are placeholders, this creates contradictory guidance and encourages insecure deployment practices around embedded or default secrets.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script sends the server's initial password and the SQLBot application's default admin credentials through Feishu notifications. That exposes secrets to an external messaging channel, expands the trust boundary beyond the local operator/session, and can leak credentials through message retention, forwarding, compromised chat accounts, or misconfigured recipients.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The utility layer includes Feishu messaging via openclaw, which is not essential to provisioning an ECS instance or deploying SQLBot. In a cloud deployment skill, undisclosed outbound messaging increases the attack surface and creates a risk of leaking operational details to an external service.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The dependency checker escalates from validation into automatic package installation, changing the host environment as a side effect of running the skill. This exceeds a narrow 'deploy SQLBot to cloud' purpose and introduces supply-chain and system-integrity risk on the local execution host.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill allows users to submit AK/SK credentials directly in chat even while acknowledging those values are sensitive. Chat channels are often logged, retained, or visible to operators and integrations, so accepting cloud credentials through conversation significantly increases the risk of credential compromise and downstream cloud account takeover.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The acceptance test examples instruct users to pass AK/SK on the command line, which can expose secrets through shell history, process listings, logs, CI output, and support screenshots. In a cloud deployment skill, this is especially risky because compromise of AK/SK can allow unauthorized provisioning, data access, or account abuse.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Documenting a default admin credential and using successful login with that credential as an acceptance check normalizes shipping a known password. If the deployed service is internet-accessible, attackers can trivially attempt the documented default credential and gain administrative access.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Requiring port 8000 to be open to all IPs as a security acceptance criterion directly increases attack surface for the SQLBot service. Given the same document also references a default admin credential, exposing the service publicly makes opportunistic scanning, brute force, and exploitation substantially more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to download and execute a remote shell script directly with bash, which delegates code execution trust to the remote host and current network path without any integrity verification or warning. If the hosting endpoint, DNS, TLS trust chain, or script content is compromised, users could execute arbitrary code on their machines.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The embedded installation workflow downloads a shell script from a remote OBS URL and immediately executes it on the target ECS instance as part of deployment. This creates a supply-chain and remote-code-execution risk because the fetched content is not integrity-pinned, signature-verified, or reviewed at execution time, so any compromise of the remote artifact or path would result in arbitrary code running on customer infrastructure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The deployment function automatically creates a COC shell script and executes it on a remote ECS instance as root, with no explicit confirmation gate or safety warning in the code path. In this skill context, the behavior is central to the feature, but it is still dangerous because it enables one-click privileged remote execution and amplifies the impact of any malicious or tampered install content.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The deployment workflow transmits highly sensitive credentials in user notifications without strong safeguards or secure delivery semantics. Even when intended for the operator, pushing secrets into chat/notification systems creates persistent copies outside the deployment environment and materially increases the chance of credential compromise.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The script provisions billable cloud resources and performs remote deployment actions without an enforced confirmation step. In an agent or automation context, this can lead to unintended infrastructure creation, cost exposure, and execution of remote changes from a single command invocation.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The code disables TLS certificate verification for all signed Huawei Cloud API requests by passing verify=False and suppressing urllib3 warnings. This enables man-in-the-middle interception or tampering of AK/SK-authenticated cloud management traffic, which is especially dangerous because these requests create infrastructure and handle credentials, network configuration, and server provisioning.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill automatically creates a VPC and subnet when none exist, which causes infrastructure changes and potential billing impact without an explicit user confirmation step. In a deployment automation skill, silent resource provisioning increases the chance of unintended network exposure, policy violations, and unexpected charges.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The monthly-billed server creation path sets is_auto_pay="true" and initiates billable resource creation without an interactive confirmation or strong upfront warning. This can directly trigger unexpected financial loss, especially in an agent skill intended for one-click deployment where users may not realize a purchase is being executed.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script performs automatic pip installation without an explicit confirmation prompt at the point of action, and uses --break-system-packages. That can unexpectedly alter the operator's environment, introduce unreviewed packages, and create persistence or instability on the machine executing the skill.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The Feishu notification path can send status messages externally without a prominent runtime warning immediately before transmission. Even if config flags control it, a deployment skill handling cloud credentials and infrastructure actions should not quietly egress operational data to an external messaging platform.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill both recognizes AK/SK as sensitive and still instructs users to provide them through conversation as a fallback, creating an explicit secret-handling anti-pattern. Because these credentials can authorize cloud resource creation and account actions, exposure in chat can lead to unauthorized access, billing abuse, data exposure, or persistence in cloud environments.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The script deliberately includes server and application credentials in notifications and summary output, including a default SQLBot admin password. This creates immediate credential disclosure risk and, because the credentials grant administrative access, can lead to full compromise of the provisioned host and deployed application.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The initial server password is echoed multiple times in console output and final summaries, increasing the chance of disclosure through shell history captures, terminal logging, CI logs, screen sharing, or multi-user systems. Repetition unnecessarily amplifies exposure of a privileged secret.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/deploy_sqlbot.py:524

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud_ecs.py:280