huawei-cloud-flexus-l-server-ops

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:43 PM UTC
• Version: 1.0.0

Overview

This skill is meant for Huawei Cloud server operations, but it needs review because it can use cloud credentials to change server state and its credential and permission guidance is incomplete or unsafe.

Install only if you intend to let an agent operate Huawei Cloud Flexus L resources. Use temporary least-privilege credentials, do not paste AK/SK/Token into chat, avoid commands that print secrets, verify the exact ECS/BSS/Config/IAM permissions before use, and require explicit confirmation before any lifecycle, password, or metadata change.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly instructs the agent to read Huawei Cloud credentials from environment variables, which is a privileged capability, yet no declared permissions are present in the metadata. This creates a transparency and policy-enforcement gap: users and the platform may not realize the skill can access sensitive secrets needed to operate cloud resources.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The IAM policy documentation lists permissions for listing, querying, power operations, and password reset, but omits permissions needed for the advertised ability to modify instance information. This mismatch can cause operators to compensate by granting broader ad hoc permissions or debugging in production, increasing the chance of over-privileged access and unsafe operational workarounds.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The authentication helper builds a Huawei Config client even though the skill is described as Flexus L instance operations and traffic/package queries. This expands the reachable privilege surface to a broader inventory/configuration service, increasing the chance of unintended data access or misuse if the skill or downstream code is abused.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases include broad operational language such as query instance, start, stop, reboot, modify info, and traffic-related terms that can overlap with ordinary admin requests. A broad trigger surface increases the chance the skill activates in contexts where the user did not intend Huawei Cloud actions, which is especially risky because the skill supports destructive and account-scoped operations.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The markdown keyword list contains ambiguous phrases like 'My Servers', 'List All Servers', and 'query instance' without strong scope constraints tying them to Huawei Cloud Flexus L. In an agent setting, these phrases could capture general infrastructure-management requests and cause unintended enumeration of account resources or follow-on destructive workflows.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The overview describes operational capabilities but does not clearly warn that even read-only listing and detail queries access the user's cloud account and send authenticated requests to Huawei Cloud APIs. This weakens informed consent and can lead users to underestimate the privacy and account-enumeration implications of seemingly harmless queries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The verification guide instructs users to expose cloud access credentials via environment variables and even demonstrates listing them with `env | grep CLOUD_SDK`, which can reveal secrets in terminal history, logs, screenshots, or shared sessions. While using environment variables for SDK authentication is common, presenting and echoing the secret key without any masking or secure-handling warning increases the chance of credential leakage.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill repeatedly states that AK/SK/Token are sensitive and should not be provided in conversation, but then explicitly allows parsing credentials voluntarily supplied through conversation input or other ad hoc methods. This undermines its own safeguards and creates a direct path for secrets to enter chat context, logs, agent memory, or downstream tooling, where they may be exposed or mishandled.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:309