huawei-cloud-hss-query

• Outcome: Review
• Latest audit: Sep 3, 2026 · 12:29 PM UTC
• Version: 1.0.0

Overview

The skill is mostly purpose-aligned for Huawei Cloud HSS inspection, but it needs Review because it can change cloud security findings and includes a test script that executes package-provided command strings.

Install only if you need Huawei Cloud HSS inspection or incident-response help. Prefer the query-only IAM policy for routine use, grant HSS write permissions only when you intend to update alert or vulnerability status, and confirm every ChangeEvent or ChangeVulStatus action before execution. Avoid running the included test script from an untrusted or modified package because it executes command strings from its test JSON.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a severe description-behavior mismatch: the skill claims to be an HSS inspection tool, but the finding indicates it actually executes command strings from external JSON and uses eval. That combination creates a strong command-injection/arbitrary code execution risk and is especially dangerous because operators may trust the skill with privileged cloud credentials and security-sensitive workflows.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exposes shell-capable behavior without declaring any explicit tool scope or allowlist in the manifest. In an agent environment, undeclared shell access weakens policy enforcement and can permit command execution beyond what users and reviewers expect, especially given the skill’s security-operations theme and access to cloud credentials.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The scope section states the skill does not execute 'isolation, antivirus, or other high-risk actions' and frames management as alert handling status updates. Later sections document `ListAntiVirusHost` and especially `ChangeVulStatus`, which expands management beyond alert handling and introduces antivirus-related operational scope into the skill guidance. While `ListAntiVirusHost` is read-only, the overall documentation contradicts the earlier narrowly stated management boundary.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest says only alert-status marking is mutating, but the documentation also includes vulnerability status modification operations. This mismatch can cause users, reviewers, or policy systems to underestimate the write capabilities of the skill, leading to unauthorized or accidental state changes in security findings.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| ID | Criterion |
|----|-----------|
| NF-01 | All query operations are read-only and safe to execute without confirmation |
| NF-02 | All mutating operations (ChangeEvent, ChangeVulStatus) require explicit user confirmation |
| NF-03 | No AK/SK values are hardcoded in any file |
| NF-04 | Output is structured JSON suitable for programmatic consumption |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: At L35 the guide explicitly says hcloud CLI only reads ~/.hcloud/config.json or --cli-access-key/--cli-secret-key and that environment variables are ignored. L49 then says to prefer environment variables or interactive configuration, which directly contradicts the documented authentication behavior and could mislead users into an unsupported and insecure setup.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This is a real command-injection risk: the script reads `command` values from `templates/test-vars.json`, performs only a weak prefix-based whitelist check, and then executes the full string with `eval`. An attacker who can modify test data can keep an allowed prefix like `curl ` or `bash ` and append shell metacharacters, command substitutions, or additional commands, resulting in arbitrary code execution on the machine running the tests.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: Lines L29-L35 include Chinese text such as '推荐给脚本/CI 场景' and '只读取' in a primarily English installation guide. This creates a locale/language policy issue because the skill effectively forces bilingual comprehension without user opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The document hard-codes a Chinese description column alongside English without explaining locale choice or offering a user-selectable language preference. This can be interpreted as a locale policy issue because the file assumes a fixed bilingual presentation rather than documenting language selection or regional scope.

Static analysis

No suspicious patterns detected.