huawei-cloud-flexus-l-deploy-jiuwenswarm

• Outcome: Review
• Latest audit: Aug 29, 2026 · 1:49 AM UTC
• Version: 1.0.2

Overview

This looks like a real Huawei Cloud deployment skill, but it needs Review because it weakens stored cloud credentials and handles secrets, public access, and root cloud execution in risky ways.

Review before installing. Use a least-privilege or temporary Huawei Cloud credential, avoid letting the skill read an encrypted hcloud profile unless you are prepared for it to be rewritten as plaintext, restrict or close public port 5173 unless you add proper access controls, and rotate model/channel API keys if outputs or COC logs may have exposed them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (43)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill describes capabilities to read/write files, access environment variables, invoke shell commands, and make network calls, but it does not declare any permissions. That mismatch prevents meaningful user review or policy enforcement and can hide sensitive operations such as credential access and remote cloud changes.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill states that Huawei Cloud credentials must never be collected interactively, but later phases instruct interactive collection of secrets such as API keys and channel credentials. This inconsistency creates a high risk that an agent will solicit, mishandle, or expose sensitive secrets in conversation or logs.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document says that if the hcloud config uses encryption, the script will automatically disable it to read plaintext credentials. That behavior weakens credential protection at rest and normalizes decryption or rewriting of secrets into plaintext, increasing the chance of theft from disk or logs.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The helper explicitly detects encrypted Huawei Cloud CLI credentials and runs `hcloud configure set --cli-auth-encrypt=false`, causing `~/.hcloud/config.json` to be rewritten with plaintext AK/SK. This weakens local secret protection, increases exposure to other local processes/users, and persists the exposure beyond the lifetime of this skill.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The `_run_hcloud` docstring claims the code bypasses local config 'without modifying any local files', but credential loading elsewhere can rewrite `~/.hcloud/config.json` to plaintext first. This discrepancy is security-relevant because it conceals a persistent credential-handling side effect from maintainers and users, making risky behavior harder to detect and review.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger keywords and description are broad enough to match ordinary requests about deployment or AI platform setup. In a skill that can create cloud instances and deploy remote workloads, overly broad activation increases the risk of unintended invocation and execution of costly or sensitive actions.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: The example phrases are conversational and overlap with common help requests, which can cause accidental activation. In this context, accidental triggering is more dangerous because the skill performs infrastructure deployment and configuration, not simple read-only assistance.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The acceptance criteria explicitly require binding the application ports to 0.0.0.0 and publishing a public URL, which makes the JiuwenSwarm interface and related services reachable from the internet. In the context of an automated deployment skill for an AI agent platform, this increases the attack surface substantially and is dangerous because there is no accompanying requirement for TLS, authentication hardening, IP allowlisting, or a user-facing warning about external exposure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs operators to place API keys and channel credentials into .env and config.yaml files, but does not include handling guidance beyond basic file permissions and backups. In a deployment automation context, this is risky because secrets may be exposed through backups, logs, shell history, misconfigured permissions, or later operational handling, especially when the same system is internet-exposed.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The checklist directs operators to configure Huawei Cloud AK/SK credentials and later model API keys, but it provides no warning about secure storage, least-privilege scoping, redaction, or avoiding disclosure in logs and files. In a deployment skill that automates cloud instance creation and service configuration, mishandling these secrets could lead to cloud account abuse, unauthorized instance creation, or compromise of downstream model-provider accounts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The checklist explicitly requires binding services to 0.0.0.0 and making the web interface externally reachable on port 5173, but it omits any warning about network exposure, authentication, TLS, or source-IP restriction. In the context of deploying a multi-agent platform to a public cloud instance, this can expose an administrative or sensitive interface directly to the internet, increasing the risk of unauthorized access, scanning, exploitation of service flaws, and data leakage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This document requests broad permissions for remote script creation/execution, instance power control, and optional instance creation, but it does not prominently warn users about the operational and security impact of granting those capabilities. In the context of an agent skill that automates cloud deployment, these permissions materially increase risk because misuse, prompt injection, or user misunderstanding could lead to arbitrary command execution on cloud hosts or unintended infrastructure changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The troubleshooting guide explicitly tells users to print cloud access key material from environment variables, which can expose secrets to terminals, shell history capture, screen sharing, logs, or copied support bundles. Even though it does not transmit the values itself, it encourages unsafe handling of credentials without an adjacent warning to redact or avoid sharing them.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide instructs users to display the full .env file and then test APIs with bearer tokens, which risks exposing API keys and service endpoints during troubleshooting. In deployment/support contexts, users commonly copy terminal output into tickets or chats, so this materially increases the chance of credential leakage.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide tells users to print config.yaml, which may include channel webhook secrets, tokens, and credentials, but does not immediately warn against exposing them. This creates a realistic path to accidental disclosure during support and debugging workflows.

Missing User Warnings

High

• Confidence: 92% confidence
• Finding: The instance deletion section provides destructive API instructions without a warning about irreversibility, validation steps, or backup prerequisites. In an operational troubleshooting guide, this can lead to accidental deletion of production infrastructure and permanent data loss.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The generated scripts write API secrets into /root/.jiuwenswarm/config/config.yaml and then set permissions to 0644, making the file world-readable to all local users on the instance. This exposes long-lived channel credentials that could be stolen by any unprivileged account or process compromise, enabling impersonation or takeover of connected messaging integrations.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The generated remote shell script prints the entire .env file after updating it, which includes API_KEY in cleartext. Because the script is executed through Huawei Cloud COC, the secret may be exposed in job output, logs, consoles, or audit records far beyond the target host, creating a credential disclosure path.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: In non-interactive modes, the script accepts parameters or a JSON config and immediately pushes a remote configuration change and restarts the service without an explicit confirmation gate. This increases the risk of accidental or automated misconfiguration, unintended downtime, and secret deployment to the wrong instance, especially in an infrastructure automation skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script submits and executes a shell script on a remote cloud instance as the root user without an explicit confirmation gate, dry-run mode, or prominent safety prompt. In this skill’s context, the behavior is intended for one-click deployment, but it still creates a meaningful risk of accidental destructive changes or execution against the wrong target, especially because the script content is loaded from a local template and then run with full privileges via COC.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The script accesses cloud credentials and only prints a partial AK identifier to stdout, without clearly warning the user that privileged Huawei Cloud credentials are being consumed to create and execute remote scripts. In an agent/skill setting, undisclosed use of operator credentials to run remote root actions increases the risk of confused-deputy behavior and unintended privilege use.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The function is designed to downgrade credential protection automatically, without informed user consent, in order to make secrets readable in plaintext. In a deployment skill that handles cloud credentials and infrastructure operations, silently weakening local auth storage is especially dangerous because it expands the blast radius from one deployment run to future compromise of the cloud account.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This subprocess invocation changes the user's global `hcloud` authentication configuration and does so silently. Because it persists outside the process and affects future CLI usage, it introduces a hidden security regression that can expose cloud credentials to local theft or accidental disclosure.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `--region` | Region (cn-north-4/cn-east-3/cn-south-1/cn-southwest-2). If not specified, interactive selection will be shown. | (Interactive) |
| `--wait` | Wait for creation completion (polls RMS every **30s** for instance status) | False |
| --timeout | Maximum time to wait in seconds when `--wait` is used | 600 (10 minutes) |
| --confirm | Skip confirmation prompt | False |

#### deploy_service.py
| Parameter | Description | Default Value |

• Confidence: 96% confidence
• Finding: The presence of a `--confirm` option that skips the confirmation prompt undermines the document's own requirement for explicit customer consent before resource creation or modification. An agent or wrapper could invoke this flag and create billable infrastructure or change systems without a fresh human approval step.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

parser.add_argument('--region', type=str, default=None, choices=list(SUPPORTED_REGIONS.keys()), help='Region to create instance in. If not specified, interactive selection will be shown.')
    parser.add_argument('--wait', action='store_true', help='Wait for instance creation to complete')
    parser.add_argument('--timeout', type=int, default=600, help='Timeout in seconds')
    parser.add_argument('--confirm', action='store_true', help='Skip confirmation prompt')
    return parser.parse_args()

def main():

• Confidence: 86% confidence
• Finding: The script supports a `--confirm` flag that bypasses the interactive approval step and proceeds directly to paid cloud resource creation with `is_auto_pay` and `is_auto_renew` enabled. In an agent skill whose purpose is one-click infrastructure deployment, this materially increases the risk of unintended or automated spending if the flag is invoked without clear user consent at runtime.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/utils.py:210