huawei-cloud-modelarts-notebook-management

• Outcome: Review
• Latest audit: Sep 3, 2026 · 12:10 PM UTC
• Version: 1.0.1

Overview

This skill mostly matches Huawei Cloud notebook administration, but it includes unsafe install and credential-handling guidance that users should review before installing.

Install only if you are comfortable giving an agent guided access to manage Huawei Cloud ModelArts notebooks. Use a least-privilege IAM user, review every create/start/delete/storage/image action before confirming, avoid the curl-to-bash install command, and do not paste AK/SK secrets into chat, code, or commands the agent runs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description claims a broad notebook management skill handling creation, deletion, start/stop, image, tag, lease, flavor/cluster, and storage APIs. The actual code chunk only implements a pricing helper script for ModelArts Notebook flavors. It accepts a region and flavor IDs, resolves the project ID, calls the BSS pricing API in cn-north-1, and prints hourly pricing results. This is a materially different primary purpose and an undeclared capability (pricing inquiry) unrelated to the claimed 31 notebook management interfaces. Therefore the description does not accurately represent the supplied code.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The SDK fallback instructs construction of credentials with raw AK/SK values, directly contradicting earlier rules that the agent must never request, handle, or expose credentials. This creates a dangerous path where an agent or user may paste secrets into code, logs, prompts, shell history, or telemetry, defeating the documented security boundary.

External Script Fetching

High

• Category: Supply Chain

Content

### Linux/macOS

```bash
curl -sSL https://support.huaweicloud.com/qs-hcli/hcli_02_003.html | bash
```

Or download from: https://support.huaweicloud.com/qs-hcli/hcli_02_003.html

• Confidence: 98% confidence
• Finding: The guide instructs users to fetch remote content over the network and immediately execute it with the shell, which bypasses any opportunity to inspect, verify, or pin the installer. If the remote page, transport path, hosting account, or upstream content is compromised, arbitrary code will run on the user's machine with the user's privileges.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Linux/macOS

```bash
curl -sSL https://support.huaweicloud.com/qs-hcli/hcli_02_003.html | bash
```

Or download from: https://support.huaweicloud.com/qs-hcli/hcli_02_003.html

• Confidence: 99% confidence
• Finding: The pipe into bash is the dangerous execution primitive that turns downloaded content directly into shell commands. In a skill that manages cloud notebook infrastructure and asks users to configure cloud credentials, this increases risk because a malicious installer could steal AK/SK credentials, alter CLI behavior, or install persistent backdoors affecting cloud administration workflows.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill describes capability to inspect credential configuration and relies on CLI/environment-backed authentication behavior, but it does not declare any explicit tool scope or permission boundary. In an agent framework, missing allowed-tools/permissions can cause overbroad execution rights or unclear authorization for sensitive local/system interactions, increasing the chance of unintended secret or environment access.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: huawei-cloud-modelarts-notebook-management
description: |
  Manage Huawei Cloud ModelArts Notebook instances through full lifecycle operations via hcloud CLI. Covers 31 API interfaces across 7 functional domains: instance management (create/list/show/update/delete/start/stop), lease management (show/renew), tag management (show/create/delete), image management (create/list/register/show/delete/sync/group operations), flavor and cluster queries (list flavors/switchable flavors/clusters/features), and dynamic storage management (list/attach/show/detach). All write operations require user confirmation before execution. Triggers include: "ModelArts notebook", "notebook实例", "创建notebook", "查询notebook", "启动notebook", "停止notebook", "删除notebook", "notebook镜像", "notebook规格", "notebook存储", "notebook标签", "notebook租期", "manage notebook", "notebook management", "ModelArts notebook management".
tags: [huawei-cloud, modelarts, notebook, ai, devtools]
---

• Confidence: 77% confidence
• Finding: The skill supports destructive and billable operations and relies on conversational confirmation, which can be fragile if session context is reused or misinterpreted across turns. Without a stronger transaction boundary, previously supplied identifiers or stale confirmation may be applied to later actions, increasing the risk of unintended deletion, start/stop, or cost-incurring operations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Broad trigger phrases like 'manage notebook' or 'notebook management' can activate the skill for ordinary conversation that is not intended to perform cloud operations. In a skill capable of destructive actions such as start/stop/delete, accidental invocation increases the risk of social engineering, context confusion, and unintended access to cloud administration flows.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Line L323 presents a critical policy-style requirement entirely in Chinese: users must complete BSS pricing inquiry and be shown costs before CreateNotebook or StartNotebook. Because this is a key operational instruction and no language choice is offered, it creates a locale/language policy issue for non-Chinese users.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file includes sample code that initializes BasicCredentials with AK and SK values, which are sensitive credentials. The surrounding documentation does not warn users to protect these secrets, avoid hardcoding them, or prefer safer credential sources, so the example lacks disclosure about a privacy/security-impacting behavior.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: Several core scope and deletion-handling instructions are written only in Chinese, while the rest of the document is primarily in English. This creates an implicit language constraint without stating that the user can choose their preferred language or that the skill is region/language-specific.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This markdown file includes operational instructions in Chinese (for example the '前置条件' section) while the rest of the document is primarily in English. That creates a language/locale inconsistency without any user opt-in or explanation that the skill is intended for Chinese-speaking users only.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: These lines switch to Chinese for important usage notes and constraints, which can force a specific language on users reading an otherwise English command reference. The file does not explain that the skill is region- or language-specific, so this is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The dynamic storage prerequisite section contains critical operational constraints only in Chinese. Because the file does not provide user language selection or justify a Chinese-only locale requirement, it may violate language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This markdown file contains user-facing guidance in Chinese string literals and prose alongside English content, which can force a specific language experience for some users. The file does not indicate that the skill is intentionally China-region-only from a language perspective or offer any user opt-in for locale/language.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script's comments, usage text, and examples are written only in Chinese, and later runtime messages are also emitted only in Chinese. This creates a language/locale policy issue because the skill enforces a specific language without offering user opt-in or documenting a justified locale restriction.

Static analysis

No suspicious patterns detected.