Security audit

huawei-cloud-eip-cost-optimizer

Security checks across malware telemetry and agentic risk

Overview

This skill mainly performs read-only EIP analysis, but its documentation and helper scripts include overbroad cloud-management guidance, host changes, persistence, and credential-handling risks that users should review before installing.

Install only in an environment where local file writes, audit logs, optional cron jobs, package installation, and outbound alerts are acceptable. Use a minimal read-only IAM policy, avoid the full-management policy and mutating API examples, prefer hcloud configure or instance-role credentials over environment-variable AK/SK mode, and review webhook/email destinations before enabling monitoring.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (34)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no permissions while clearly requiring shell execution and cloud CLI access. This under-specification is dangerous because it hides the real execution surface from reviewers and users, making it easier to approve or run a skill that can modify the local environment and access cloud resources.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation repeatedly markets the skill as read-only, but it also describes package installation, execution of a downloaded installer, crontab modification, and local file generation. That mismatch can mislead operators into granting trust or running the skill in sensitive environments where system changes and persistence are not acceptable.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: Claiming 'read-only analysis only' while also supporting cron setup/removal and log/export file creation is a security-significant inconsistency. Users may rely on the read-only claim and run the skill under assumptions that no persistence or host modification will occur.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: Stating that all scripts are READ-ONLY while documenting scripts that alter the host environment weakens trust boundaries and review accuracy. In practice, this can cause unsafe deployment into environments that permit analysis but prohibit persistence, package changes, or unattended scheduling.

Scope Creep

Medium

Confidence: 90% confidence
Finding: The declared IAM scope does not fully reflect the documented behavior, which also includes IAM project listing and local system modifications. Even if cloud-side privileges remain low, incomplete permission modeling obscures the true risk and can bypass proper approval or sandboxing decisions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Saying the skill performs no write operations while it creates files and edits cron is materially misleading. This increases the chance of accidental execution in restricted environments and makes operational review less effective.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The reference guide includes destructive and state-changing commands such as create, delete, update, associate, and disassociate operations even though the skill metadata explicitly claims the skill is read-only and forbids bandwidth adjustment or EIP release/deletion. In an agent setting, documenting these commands inside the skill materially increases the chance that a downstream agent or user will invoke mutating operations despite the declared safety boundary, leading to unexpected resource changes, outages, or billing impact.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is explicitly described as read-only cost optimization, yet this section documents write permissions for create, delete, update, associate, disassociate, and tag mutation. That mismatch can cause operators to grant unnecessary privileges, enabling destructive or billable changes if the skill, a compromised agent, or a prompt-injection path invokes those capabilities.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The full-management policy JSON directly contradicts the skill’s stated no-adjustment/no-release read-only scope and provides a ready-to-copy policy that grants broad mutation rights on all resources. In practice, users often paste such examples verbatim, so this documentation materially increases the chance of overprivileged deployment and unauthorized EIP changes or deletion.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Claiming least privilege while presenting broad management permissions is security-significant because it can mislead administrators into trusting an overbroad policy. In the context of an agent skill, that discrepancy is more dangerous because operators may rely on the document’s framing when delegating cloud permissions to automation.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Claiming least privilege while presenting broad management permissions is security-significant because it can mislead administrators into trusting an overbroad policy. In the context of an agent skill, that discrepancy is more dangerous because operators may rely on the document’s framing when delegating cloud permissions to automation.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The script is explicitly described as read-only and no-mutation, but its human-readable report recommends releasing EIPs, lowering bandwidth, and managing tags. In an agent setting, these recommendations can be operationally unsafe because downstream users or higher-level automation may treat them as approved next steps, bypassing the intended non-destructive scope.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The per-EIP recommendation 'immediate release' directly contradicts the script's documented analysis-only behavior. Even though the script does not execute deletion itself, this kind of asset-specific destructive advice can cause operators or autonomous orchestrators to take irreversible action on incomplete evidence, especially for standby or disaster-recovery IPs.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The JSON output embeds recommendations to release EIPs, reduce bandwidth, and add tags, which are all outside the declared read-only scope. Structured JSON is especially risky because other agents or workflow tools are more likely to consume it programmatically and execute follow-on changes without human scrutiny.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script’s --fix path downloads and executes a remote installer for hcloud, which exceeds the skill’s declared read-only analysis scope and introduces code-execution risk on the host. The validation is weak because it only checks that the file is non-empty and contains the string 'hcloud', which does not meaningfully authenticate the downloaded script or protect against compromise of the download source.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The --fix logic invokes apt-get or yum to install jq and bc, modifying the host system despite the skill being described as read-only analysis only. This broadens the skill from analysis into system administration and could cause unintended package changes, privilege use, or policy violations in environments that trust the manifest’s stated scope.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Bundling host package-management capability into an EIP cost-analysis skill creates unnecessary system-level power unrelated to the core purpose of querying and reporting cloud EIP data. Even if intended for convenience, this violates least privilege and increases the blast radius if the script is run in sensitive environments.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script writes generated report content to an arbitrary user-supplied path via `--output` and creates parent directories if needed. In a skill advertised as read-only analysis only, this introduces filesystem side effects and possible overwriting of local files, which can be unsafe in agent/runtime contexts where output paths may be influenced by external input.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The EXIT trap unconditionally records audit logs, which means the script always performs a write-side action even on failure paths. This violates the stated read-only behavior and can leak execution metadata or create unintended persistence in environments expecting pure query/report generation.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The script can install and remove cron jobs, which is a state-changing persistence mechanism and contradicts the skill's claimed read-only analysis scope. Even though this behavior is user-invoked via flags, it expands the skill from passive inspection into local system modification and scheduled re-execution, increasing operational and security risk.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script sends webhook and email alerts, which transmits cloud inventory metadata outside the local execution context and exceeds a strict read-only analysis promise. Although intended for monitoring, outbound notification can disclose infrastructure details and create unexpected data exfiltration paths.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The manual installation flow downloads a shell script from a remote URL and immediately executes it with bash, without requiring checksum/signature verification, publisher validation, or a prominent warning about the risks of running fetched code. If the download source, DNS, TLS trust chain, or hosting bucket were compromised, users could execute attacker-controlled code on their systems.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The uninstall section removes both the CLI binary and the entire `~/.hcloud` directory, which can contain stored configuration and credentials, but does not explicitly warn the reader that secrets and local settings will be deleted. This can cause accidental credential loss, operational disruption, or unsafe recovery practices if users are surprised by the deletion.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The documented create and update operations can allocate resources or increase bandwidth, which directly affects spend, but the examples do not clearly warn that these actions may incur charges or modify production networking state. In a cost-optimization skill, omission of strong billing and change-impact warnings is especially risky because users may assume all included commands are safe and observational.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The wrapper intentionally supports an authentication mode that injects AK/SK and optional security token into the hcloud command line. Command-line arguments are commonly exposed via process listings, shell history, audit tooling, or /proc metadata to other local users or monitoring agents, so this creates a real credential disclosure risk. In this read-only cloud-audit skill, leaked credentials could still enable broader cloud access depending on IAM scope, making the issue more serious than a purely cosmetic warning omission.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.