huawei-cloud-flexus-l-server-scripts-excute

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:41 PM UTC
• Version: 1.0.0

Overview

The skill matches its stated Huawei Cloud purpose, but it can run scripts on cloud servers and handle cloud credentials with weak safeguards that users should review first.

Install only if you intend to manage Huawei Cloud COC scripts. Use least-privilege temporary credentials, prefer environment variables or hidden interactive input, avoid putting AK/SK/tokens in prompts or command lines, and manually confirm the script UUID, target resource ID, region, and execution user before running anything on a server.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The top-level security rules say AK/SK/Token must never appear in conversation and should be passed via environment variables, but later examples document direct use of `--ak`, `--sk`, and `--security-token` values. That is an active contradiction in the skill's own guidance because the documented invocation pattern would cause users or agents to include secrets in requests and transcripts.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description lists trigger keywords such as 'cloud operations', 'script management', and 'script execution', which are broad phrases likely to overlap with many unrelated operational requests. The file does not provide exclusion conditions or negative examples to clarify when this skill should not activate.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The dedicated trigger section uses generic terms like 'script management', 'script execution', and 'cloud operations' as routing keywords. Because these phrases are common across many admin contexts and no invocation boundary is defined, the skill may be selected unintentionally.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The markdown explains that the skill can batch execute scripts, deploy applications, update configuration files, and handle emergency response on target hosts. Although there are operational and credential notes, there is no clear user-facing warning that these actions may change remote systems, impact availability, or cause destructive effects if misused.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This code file handles sensitive credentials through --ak, --sk, and --security-token arguments and the examples encourage passing secrets directly on the command line. Although the tool supports interactive entry, there is no visible warning in comments, help text, or runtime output that command-line secrets may be exposed via shell history or process inspection.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The execute flow triggers a potentially destructive remote operation against a target L instance by calling execute_script, but the user-facing text only says "Executing script..." and does not warn that this will run code on the specified instance. For a safety-critical subprocess/remote execution action, the file lacks a clear confirmation prompt or cautionary disclosure immediately before execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code exposes a function that executes arbitrary scripts on target instances via the cloud API, which can materially affect systems and data. Although the docstring describes the API, it does not warn the user about the operational risk, require confirmation, or emit any user-facing disclosure before execution.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The client is constructed from AK/SK/security token credentials and is then used throughout the library to make remote API requests that send authentication material and potentially script content or instance metadata. The file contains technical docstrings but no clear user-facing warning about credential use, remote transmission, or the sensitivity of the data being sent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The usage docstring instructs users to pass the access key, secret key, and security token directly as command-line arguments. Supplying credentials this way can expose them through shell history or process listings, and the file does not include any warning or safer alternative guidance.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The usage string presents `cn-north-4` as the default region, and the script later enforces the same default. This creates a locale/region-specific default behavior without explaining why that region is required or obtaining explicit user choice.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.