huawei-cloud-flexus-l-server-hermes-deployment

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:42 PM UTC
• Version: 1.0.0

Overview

This skill mostly does what it claims, but it handles powerful cloud credentials and remote execution in ways that need careful review before installation.

Review this skill before installing. Use a dedicated least-privilege temporary Huawei Cloud credential, avoid putting secrets in command-line arguments, disable or closely monitor auto-pay/auto-renew resources, and inspect any COC scripts before allowing non-interactive execution on production instances.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares powerful capabilities including environment access, file operations, network access, and shell execution, but does not explicitly declare permissions. This weakens transparency and reviewability, making it easier for a caller to invoke a skill with broader-than-expected access and increasing the chance of unsafe execution in sensitive environments.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented purpose emphasizes deployment and configuration, but the skill also supports remote gateway restart, execution-result querying, and UniAgent status checks. This mismatch can mislead users and reviewers about the operational scope, especially because these extra functions can affect remote systems and expose operational metadata.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The library exposes generic COC primitives to create and execute arbitrary scripts on remote instances, not just Hermes-specific deployment actions. In a skill advertised as a one-click Hermes deployment/configuration tool, this materially expands capability into general remote code execution on cloud assets, which could be abused if invoked with attacker-controlled content or targets.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module header and skill description focus on Hermes deployment, but the code also supports broader script management and execution capabilities. This mismatch reduces user transparency and can conceal a larger attack surface than expected, making risky operations easier to trigger without informed consent.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The skill can list arbitrary COC scripts and retrieve full script details, including content, beyond Hermes deployment artifacts. That enables inventorying and potentially exposing operational scripts in the account, which may reveal sensitive logic, infrastructure details, or embedded secrets.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation explicitly instructs users to pass cloud AK/SK and security tokens on the command line. Command-line secrets are commonly exposed through shell history, process listings, logging, CI output, and support transcripts, which can lead to full cloud account compromise if captured.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The examples place sensitive model API keys and bot/channel secrets directly on the command line. These values can leak via shell history, process inspection, terminal recording, logs, and automation systems, enabling unauthorized API use or takeover of messaging integrations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document recommends a combined IAM policy granting broad wildcard access to create, list, get, delete, and execute actions across HCSS, COC, and IAM resources. Although it briefly mentions least privilege in the notes, it does not clearly warn users about the destructive and high-trust nature of these permissions or scope them to specific resources, which can lead to over-privileged deployments and abuse if the credentials are compromised.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document instructs users to pass AK/SK and other secrets directly via command-line flags, which can expose credentials through shell history, process listings, audit logs, and screenshots. In a cloud deployment skill handling privileged Huawei Cloud credentials, this materially increases the chance of credential leakage and subsequent unauthorized access to cloud resources.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The automation section explicitly reinforces the practice of supplying credentials on the command line and even highlights that AK/SK are passed this way, normalizing insecure secret handling. Automated scripts often end up in repositories, CI logs, terminal scrollback, or shared runbooks, which further amplifies the risk of credential disclosure.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script collects AK, SK, and security token through plain input(), so secrets are echoed on screen and may be exposed to shoulder-surfing, terminal recording, shell session logging, or remote support captures. In a cloud-deployment tool handling privileged credentials, this materially increases the chance of credential leakage and subsequent account abuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: These functions perform remote script execution and restart services on target instances, but there is no enforced explicit warning or confirmation step before modifying remote systems. In an agent context, that increases the risk of accidental or socially engineered system changes with real operational impact.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code provisions a prepaid cloud instance with auto-renew and auto-pay enabled, but does not enforce a prominent billing-impact warning or confirmation. This can directly create financial exposure and persistent recurring charges if triggered unintentionally or abusively.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if ! command -v yq &> /dev/null; then
        echo "Package manager installation failed, trying direct download..."
        if command -v curl &> /dev/null; then
            sudo curl -sL https://github.com/mikefarah/yq/releases/download/v4.35.1/yq_linux_amd64 -o /usr/local/bin/yq
        else
            sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.35.1/yq_linux_amd64
        fi

• Confidence: 86% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v curl &> /dev/null; then
            sudo curl -sL https://github.com/mikefarah/yq/releases/download/v4.35.1/yq_linux_amd64 -o /usr/local/bin/yq
        else
            sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.35.1/yq_linux_amd64
        fi
        sudo chmod +x /usr/local/bin/yq
    fi

• Confidence: 86% confidence
• Finding: sudo

Credential Access

High

• Category: Privilege Escalation

Content

FEISHU_APP_SECRET='${feishu_app_secret}'
WECOM_BOT_ID='${wecom_bot_id}'
WECOM_SECRET='${wecom_secret}'
ENV_PATH='/home/hermes/.hermes/.env'

echo "⚙️  Configuring bot channel..."
echo " - Target Platform: $BOT_PLATFORM"

• Confidence: 88% confidence
• Finding: .env'

Credential Access

High

• Category: Privilege Escalation

Content

}


# ==================== Update .env File ====================
update_env_file() {
    echo "⚙️  Updating $ENV_PATH ..."

• Confidence: 89% confidence
• Finding: .env

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: pyyaml

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib.py:404