ClawHub
Back to skill

Security audit

huawei-cloud-lts-manage

Security checks for vulnerabilities and agentic risk

Overview

This cloud log-management skill is mostly transparent, but it can change or delete important Huawei Cloud logging resources and its setup and permissions are broad enough to require review before installation.

Install only if you intend to let the agent help administer Huawei Cloud LTS. Prefer the read-only IAM policy for search and diagnosis, scope permissions to the smallest project/resources available, verify the hcloud installer before running it, and require explicit approval for any create, update, transfer, alarm-status, TTL, or delete action in production.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared description says the skill manages Huawei Cloud LTS resources through hcloud CLI, including operational actions on log groups, streams, indexes, transfers, alarms, and searches. The actual code chunk is only a test harness/reporting script: it checks for a local test-vars.json file, parses test_cases from it with Python, and echoes the stored command metadata and results. While the script references 'LTS' in comments/output, it does not itself perform the described LTS management capabilities. This is a material description-versus-behavior mismatch for the supplied code chunk.

Self-Modification

High
Category
Rogue Agent
Content
| `--start_time` / `--end_time` | For log search | Time range (ms) | `1700000000000` |
| `--log_transfer_type` | For transfer filter | Transfer type | `OBS`, `DIS`, `DMS` |

### Delete Safety Rules

1. **Single resource deletion only** — each Delete call must specify exactly one resource ID
2. **No wildcard/batch delete** — `DeleteLogGroup` deletes all streams under the group; always confirm the cascade impact
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes broad generic terms such as 'log search', 'structured log', and operational phrases that could match normal conversations unrelated to Huawei Cloud LTS administration. Overbroad activation can cause the agent to enter a privileged cloud-management skill in the wrong context, increasing the chance of unintended data access, destructive actions, or disclosure of cloud resource details.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| ID | Requirement |
|----|-------------|
| NF-01 | All query operations are read-only and safe to execute without confirmation |
| NF-02 | All Create/Update operations return a resource configuration snapshot |
| NF-03 | All Delete operations require explicit user confirmation (confirm/ok/确认) |
| NF-04 | Batch deletion of all LTS resources is prohibited |
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The guide instructs users to download and execute a remote shell script directly via curl and bash without integrity verification, signature checking, pinning to a known version, or any warning about the risks. If the hosting bucket, network path, or referenced script is compromised, users could execute arbitrary code on their systems with the privileges of the invoking user.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documented 'least-privilege' policy includes broad create, modify, and delete permissions across LTS resources on all resources using "Resource": "*", but it does not clearly warn users that these permissions enable destructive changes such as deleting log groups, streams, transfers, and alarm rules. In an operational logging service, excessive write/delete permissions can impair monitoring, erase evidence, or disrupt incident response if copied into production without careful scoping.

Static analysis

No suspicious patterns detected.