huawei-cloud-flexus-l-server-openclaw-deployment

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:44 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its cloud deployment purpose, but it needs review because it can create paid cloud resources, run remote scripts, and mishandles sensitive credentials in documentation and logs.

Review before installing. Use only narrowly scoped, preferably temporary Huawei Cloud credentials; avoid passing secrets on the command line; expect billable cloud resources with renewal behavior; and do not run model or channel setup unless you accept remote shell execution of unpinned scripts on the target instance.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (35)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Executing command: {install_command}")
        
        result = subprocess.run(
            install_command,
            shell=True,
            capture_output=True,

• Confidence: 99% confidence
• Finding: result = subprocess.run( install_command, shell=True, capture_output=True, text=True )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Executing command: {install_command}")
        
        result = subprocess.run(
            install_command,
            shell=True,
            capture_output=True,

• Confidence: 99% confidence
• Finding: result = subprocess.run( install_command, shell=True, capture_output=True, text=True )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes shell commands, uses environment-provided cloud credentials, and performs networked cloud operations, yet declares no permissions. That undermines least-privilege controls and informed consent, because a caller may not realize the skill can create resources and run remote operations against cloud infrastructure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented purpose is deployment and configuration, but the described behavior extends to remote status probing, creation/execution of COC scripts, and downloading/executing remote shell scripts from external URLs. That broader execution surface materially increases risk of remote code execution, supply-chain compromise, and unexpected actions on user-owned instances beyond what the high-level description suggests.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill states that credentials must never be exposed in conversation, yet the usage guidance repeatedly tells users to pass AK/SK/token via command-line flags. Command-line arguments are commonly exposed in shell history, process listings, logs, and debugging output, so this directly contradicts the stated security model and creates a realistic secret-leak path.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation says credentials are automatically inherited from environment variables and need not be passed as command-line arguments, but later instructions require explicit secret-bearing flags. This inconsistency is dangerous because users may follow the less secure path and inadvertently disclose cloud credentials in logs or command history.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The local model installation function executes arbitrary shell commands on the host and performs system-level changes, which exceeds a cloud deployment skill's expected boundary. In this context, a skill intended to provision cloud resources should not directly execute fetched scripts on the agent host, making compromise of the host or operator workstation much more dangerous.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The local channel installation function downloads and executes code locally, changes system symlinks, and restarts services, which goes beyond the skill's stated remote cloud deployment/configuration purpose. Because channel data may include secrets, this local execution path also risks secret exposure and host compromise.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill exposes generic script creation and execution on target instances, enabling arbitrary code execution beyond the narrow purpose of deploying OpenClaw and configuring models/channels. In a deployment skill, this broad capability materially increases abuse potential because an attacker or prompt-injected agent could repurpose it for full remote instance control.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The module advertises generic COC script management and listing features that exceed the manifest's described OpenClaw deployment scope. This scope expansion is dangerous because it increases the chance the skill can be misused for unrelated remote operations not expected by users or policy.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill documents a non-interactive mode that directly creates cloud resources without prominently warning about billing, infrastructure changes, and downstream execution on target instances. In a deployment skill with cloud credentials and automation, lack of explicit consent and impact disclosure increases the chance of unintended resource creation and operational cost.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The examples instruct users to supply AK/SK and temporary security tokens directly on the command line without warning that these secrets may be captured by shell history, process monitors, CI logs, or support transcripts. Because these are cloud account credentials, exposure can lead to unauthorized resource creation, data access, and broader account compromise.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation instructs users to pass Huawei Cloud AK/SK directly on the command line in example commands. Command-line secrets can be exposed through shell history, process listings, terminal logging, CI logs, and screenshots, which creates a realistic credential leakage risk for cloud accounts.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The channel installation example embeds sensitive values such as AK/SK and channel `secret` in plaintext arguments. This is dangerous because these secrets may be captured in shell history, process inspection tools, automation logs, and copied documentation, potentially exposing both cloud credentials and downstream messaging-channel credentials.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Instance creation is configured with is_auto_pay=True and is_auto_renew=True, causing real billable purchases and recurring charges without an explicit confirmation step at execution time. For a one-click deployment skill, this materially raises the risk of accidental financial impact and unauthorized resource provisioning.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The function prints Authorization headers, full request headers, and request body, which may expose signed credentials, project identifiers, and other sensitive request details in logs. Such logs are often accessible to operators, support systems, or other tooling, making credential misuse and information disclosure more likely.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The remote script execution flow can run scripts on target instances without any built-in confirmation, warning, or interactive safeguard. In the context of an infrastructure skill, silent remote execution is especially dangerous because it can lead to broad system compromise or destructive changes on provisioned servers.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This local path downloads and executes a remote script, modifies /usr/local/bin symlinks, and restarts services, all without an explicit safety warning or confirmation. Running these actions on the host where the skill executes is substantially more dangerous than normal cloud configuration because it can compromise the local machine itself.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This channel installation path performs the same unsafe local execution pattern with downloaded code and privileged host modifications, again without explicit warning or consent. Because channel configuration includes credentials, the combination of secret handling and local shell execution makes the behavior especially risky.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The channel installation flow accepts secret-bearing configuration such as IDs and secrets and forwards them into script content/execution without clear warnings about sensitivity, storage, or logging exposure. In an agent skill, users may not realize these values could be embedded in scripts, transmitted to remote systems, or surface in logs and job history.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function sends AK/SK credentials, optional security tokens, and model parameters to a remote installation routine without any explicit warning, consent gate, or redaction path in non-interactive execution. In a deployment skill that manages cloud resources and model API keys, this creates a real risk of unintended secret disclosure to remote systems, logs, or downstream command-execution channels if operators assume the action is purely local.

Unvalidated Output Injection

High

• Category: Output Handling

Content

print(f"Executing command: {install_command}")
        
        result = subprocess.run(
            install_command,
            shell=True,
            capture_output=True,

• Confidence: 87% confidence
• Finding: subprocess.run( install_command, shell=True, capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

restart_cmd = f"sudo -i -u openclaw env DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus {cmd_name} gateway restart >> /var/manage_operate.log 2>&1"
            subprocess.run(restart_cmd, shell=True)
            status_cmd = f"sudo -i -u openclaw env DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus {cmd_name} gateway status 2>&1"
            status_result = subprocess.run(status_cmd, shell=True, capture_output=True, text=True)
            print(f"Gateway status:\n{status_result.stdout}")
            
        elif os.path.exists("/root/.local/share/pnpm/openclaw"):

• Confidence: 84% confidence
• Finding: subprocess.run(status_cmd, shell=True, capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

subprocess.run("ln -sf /root/.nvm/versions/node/v22.22.0/bin/npm /usr/local/bin/npm", shell=True)
            cmd_name = "/root/.local/share/pnpm/openclaw"
            subprocess.run(f"{cmd_name} gateway restart >> /var/manage_operate.log 2>&1", shell=True)
            status_result = subprocess.run(f"{cmd_name} gateway status 2>&1", shell=True, capture_output=True, text=True)
            print(f"Gateway status:\n{status_result.stdout}")
        
        if result.returncode == 0:

• Confidence: 84% confidence
• Finding: subprocess.run(f"{cmd_name} gateway status 2>&1", shell=True, capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

print(f"Executing command: {install_command}")
        
        result = subprocess.run(
            install_command,
            shell=True,
            capture_output=True,

• Confidence: 87% confidence
• Finding: subprocess.run( install_command, shell=True, capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.