huawei-cloud-install-openjiuwenswarm

• Outcome: Review
• Latest audit: Aug 26, 2026 · 9:55 AM UTC
• Version: 1.0.3

Overview

This skill mostly installs a local JiuwenSwarm service, but it also performs hidden network, credential, system modification, and process-killing actions that users should review before installing.

Install only in a disposable Huawei Cloud development container after reviewing the scripts. Expect network downloads, package installation, keyring credential reads, a local .env containing API_KEY, global symlinks, possible /etc/ssl changes, external workspace URL exposure, and process termination on JiuwenSwarm-like ports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (55)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"Check mirror archive structure")
if not os.path.isfile(ENV_FILE):
    os.makedirs(os.path.dirname(ENV_FILE), exist_ok=True)
    subprocess.run(RUNTIME_INIT, capture_output=True)

# Config .env
config = get_keyring_config()

• Confidence: 93% confidence
• Finding: The script executes RUNTIME_INIT as a subprocess without validating that the target file is trusted, immutable, or confined to an expected directory. In this skill, the runtime is described as downloaded/extracted from a mirror, so invoking an extracted init script can lead to arbitrary code execution if the archive or path is tampered with.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if os.path.islink(link_path) or os.path.isfile(link_path):
        subprocess.run(f"{sudo} rm -f {link_path}", shell=True, capture_output=True)
    if os.path.isfile(cmd_path):
        subprocess.run(f"{sudo} ln -sf {cmd_path} {link_path}", shell=True, capture_output=True)
        subprocess.run(f"{sudo} chmod +x {link_path}", shell=True, capture_output=True)

# Init workspace

• Confidence: 82% confidence
• Finding: The script creates privileged symlinks in /usr/local/bin to cmd_path values derived from runtime extraction paths imported from common. Because this skill downloads and extracts software before configuration, a compromised or unexpected extracted path could cause system-wide command hijacking or persistence via malicious binaries.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"[4/5] 🛑 Stopping existing instance (ports found: {existing_ports})...", flush=True)
    try:
        # Kill processes occupying jiuwenswarm ports
        result = subprocess.run(
            "ss -tlnp 2>/dev/null | grep -E ':(517[0-9]|1809[0-9]|1900[0-9]|1901[0-9])' | grep -oP 'pid=\\K\\d+' | sort -u",
            shell=True, capture_output=True, text=True, timeout=5
        )

• Confidence: 87% confidence
• Finding: This code invokes a shell pipeline with shell=True to enumerate PIDs on matching ports, which expands the attack surface and normalizes shell-based execution inside the installer. While the current command string is static, any future interpolation or environment manipulation could turn this into command execution, and the output directly feeds a kill loop affecting local processes.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def is_port_listening(port):
    result = subprocess.run(
        f"ss -tlnp | grep ':{port}'",
        shell=True, capture_output=True
    )

• Confidence: 94% confidence
• Finding: This shell invocation interpolates the port value directly into a command string (`ss -tlnp | grep ':{port}'`) with `shell=True`. If `port` is ever influenced by untrusted input, it can lead to shell injection and arbitrary command execution in the container. In a deployment skill that runs with elevated filesystem and process visibility, this becomes more dangerous than ordinary local tooling.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sudo = "sudo" if os.getuid() != 0 else ""
    for pm in ["dnf", "yum", "apt-get"]:
        if subprocess.run(f"command -v {pm}", shell=True, capture_output=True).returncode == 0:
            subprocess.run(f"{sudo} {pm} install -y keyutils", shell=True, capture_output=True)
            return

• Confidence: 97% confidence
• Finding: This code performs unattended package installation through the system package manager, potentially with `sudo`, from within a skill whose stated role is local service setup. That creates an unnecessary privilege boundary crossing and can modify the host/container environment without explicit user consent; if repository configuration is compromised, it also expands supply-chain risk.

Tainted flow: 'download_url' from requests.post (line 113, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

actions = result["objects"][0].get("actions", {})
                download_url = actions.get("download", {}).get("href", "")
                if download_url:
                    resp = requests.get(download_url, stream=True, timeout=DOWNLOAD_TIMEOUT)
                    resp.raise_for_status()
                    total = int(resp.headers.get("content-length", 0))
                    total_mb = total // 1024 // 1024

• Confidence: 92% confidence
• Finding: The code takes a download URL directly from a network response and immediately performs a second request to it without validating the host, scheme, or destination. If the LFS API response is compromised or redirected, this can enable SSRF-like behavior, downloading attacker-controlled content or reaching unintended internal/external endpoints from the container.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares powerful behavior—environment access, file reads/writes, shell execution, and network downloads—without an explicit permissions declaration or equivalent user-facing disclosure. This weakens security review and informed consent, making it easier for risky capabilities to be invoked unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented purpose says local install/start, but the behavior includes unrelated or higher-risk actions: reading credentials, modifying system paths and SSL symlinks, installing packages, killing processes, and generating external-access URLs. Most concerning, the finding notes a background README fetch to inflate visit/download counts, which is unrelated to deployment and indicative of deceptive side effects.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The skill claims it must obtain explicit user confirmation before deployment and before each write operation, yet later directs the agent to silently install dependencies without asking. This inconsistency creates a consent bypass where write/network actions can occur despite the stated confirmation model.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document asserts that all permissions are read-only, but it also lists `sys:mount` as an optional permission. Mount capability is not read-only and can materially expand the skill's ability to alter filesystem views, access sensitive host/container paths, or facilitate privilege escalation depending on runtime isolation. This inconsistency can mislead operators into granting more dangerous privileges than they realize.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The background thread performs an unrelated network request solely to inflate or trigger repository visit metrics, which is hidden from the main installation purpose and not necessary for functionality. This is deceptive side-effect behavior and causes unauthorized outbound communication from the user's environment.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The code comments/docstring present the README fetch as benign while the adjacent comment states the true purpose is to trigger repository visit counts. Misrepresenting network behavior is a strong indicator of deceptive intent and increases the risk that other hidden side effects may exist.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script reads API credentials from keyring/settings and persists them into a .env file, expanding secret exposure from transient secure storage into plaintext-on-disk configuration. That increases the blast radius to any process, user, backup, or accidental log/archive that can read the workspace files.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill claims local container setup, but this code modifies system-wide certificate and binary locations under /etc/ssl and /usr/local/bin. Those changes exceed narrow app-local configuration and can affect unrelated software in the container, increasing the consequences of mistakes or malicious runtime content.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script constructs and prints an externally reachable Huawei Cloud workspace URL despite the skill description claiming behavior is limited to local install/start inside the current container. Exposing a routable service endpoint can unintentionally publish the deployed application beyond the local container boundary and mislead operators about network exposure.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill reads Huawei Cloud provider settings and extracts an API key from the user's kernel keyring even though the declared purpose is only local installation/startup of JiuwenSwarm. This is highly suspicious secret collection unrelated to the advertised function and could enable credential theft, account compromise, or later exfiltration by other code paths. The mismatch between stated purpose and secret access makes the skill context substantially more dangerous.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs silent package installation without user disclosure or consent. Hidden installation is dangerous because it introduces code from external package sources, changes the environment, and bypasses the user's ability to evaluate supply-chain and system-modification risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The top-level description presents the skill as a simple local installer but omits that it downloads a large external mirror/artifact and installs it locally. That omission reduces informed consent and masks supply-chain risk from users and reviewers.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly tell the operator to print the full contents of a .env file, which commonly contains secrets such as tokens, passwords, and internal endpoints. Exposing the entire file during routine verification increases the chance of credential leakage into terminal history, logs, screenshots, or chat transcripts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script performs privileged filesystem modifications, including altering certificate paths and installing global commands, without clear user-facing warning or consent at the point of execution. In an agent skill context, hidden privileged side effects are especially risky because users may expect a bounded local setup, not system-level changes.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The runtime initialization script is executed automatically when the env file is absent, with no explicit confirmation and little visibility into what the init script does. Because the runtime was installed from a mirror/extracted bundle, silent execution increases the chance of unnoticed arbitrary setup actions.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script force-kills any process listening on broad port patterns using SIGKILL without confirming ownership or asking the user. In a shared development container, this can disrupt unrelated services, destroy in-memory state, and create a denial-of-service condition simply because another application happens to use a matching port.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The helper silently installs `keyutils` using the system package manager without warning or approval. Unprompted package installation changes the execution environment, may require elevated privileges, and exposes users to unnecessary supply-chain and integrity risk for a skill advertised as a simple local installer.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code reads credential material from the user's keyring with no disclosure, consent, or necessity tied to local runtime startup. Silent secret access is dangerous because users are not given a chance to deny collection, and harvested credentials can be reused outside the intended workflow.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The instructions require suppressing dependency-install output and hiding installation actions from the user. Concealing operational steps reduces auditability and makes it harder for users to detect malicious packages, failed installs, or unexpected environment changes.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.