huawei-cloud-modelarts-resource-pool-management

• Outcome: Review
• Latest audit: Sep 3, 2026 · 12:10 PM UTC
• Version: 1.0.0

Overview

This Huawei Cloud administration skill is mostly coherent, but it needs review because it combines powerful cloud-changing access with a credential-handling contradiction and a recommended remote installer script.

Install only if you intend to let an agent help administer Huawei Cloud ModelArts resource pools. Use a least-privilege IAM user, review installer scripts before running them, do not paste AK/SK into chat or agent-run code, and require explicit confirmation before any create, update, delete, resize, reboot, accept, or chargeable action.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The SDK fallback instructs construction of BasicCredentials with raw AK/SK values even though earlier sections forbid the agent from handling credentials directly. This contradiction can cause agents or users to paste secrets into prompts, code, or command history, creating a direct credential exposure path and weakening the stated security boundary.

External Script Fetching

High

• Category: Supply Chain

Content

### Method 1: One-line Install (Recommended)

```bash
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
```

Default install path: `/usr/local/hcloud/`, symlinked to `/usr/local/bin/hcloud`.

• Confidence: 99% confidence
• Finding: The command fetches a shell script from the network and executes it immediately in a single pipeline-like step, preventing meaningful review before execution. In an agent skill context, this is more dangerous because users may treat the documentation as trusted automation guidance and run the command verbatim, amplifying supply-chain compromise risk.

External Script Fetching

High

• Category: Supply Chain

Content

### Method 1: One-line Install (Recommended)

```bash
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
```

Default install path: `/usr/local/hcloud/`, symlinked to `/usr/local/bin/hcloud`.

• Confidence: 99% confidence
• Finding: The command fetches a shell script from the network and executes it immediately in a single pipeline-like step, preventing meaningful review before execution. In an agent skill context, this is more dangerous because users may treat the documentation as trusted automation guidance and run the command verbatim, amplifying supply-chain compromise risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill clearly expects command execution and environment-aware behavior, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where an agent runtime may grant broader capabilities than intended, increasing the chance of unintended command execution or environment access.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: huawei-cloud-modelarts-resource-pool-management
description: "Manage Huawei Cloud ModelArts dedicated resource pools (专属资源池) and node pools through full lifecycle operations via hcloud CLI. Covers 53 operations across 10 functional domains: resource pool management, pool nodes, node pool management, network resources, tag management, plugin management, jobs/tasks, scheduled events, OS configuration, and resource flavor/event queries. Includes BSS on-demand pricing inquiry before chargeable operations (create/expand) to inform users of costs. All write operations require user confirmation.\nTriggers include: \"资源池\", \"专属资源池\", \"resource pool\", \"创建资源池\", \"查询资源池\", \"删除资源池\", \"更新资源池\", \"资源池监控\", \"资源池节点\", \"pool node\", \"节点池\", \"node pool\", \"资源池网络\", \"pool network\", \"资源池标签\", \"pool tags\", \"插件\", \"plugin\", \"工作负载\", \"workload\", \"定时事件\", \"scheduled event\", \"OS配置\", \"规格列表\", \"ModelArts resource pool\", \"manage resource pool\", \"询价\", \"pricing\", \"按需价格\", \"价格查询\".\n"
---

# Huawei Cloud ModelArts Resource Pool Management

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list includes broad phrases like "plugin," "workload," "pricing," and "resource pool," which can match routine conversation outside the intended cloud-administration context. Overbroad activation increases the chance that the skill is invoked unintentionally and may steer an agent toward privileged operational workflows when the user did not mean to manage infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The document promises confirmation before all write operations, but the separate SDK fallback path is not bound to the same control in a concrete, enforceable way. In practice, an agent could interpret fallback as an exception path and perform modifying operations without the same confirmation and pricing checks, leading to unauthorized changes or charges.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide recommends downloading and immediately executing a remote shell script without first instructing the user to inspect it, verify its integrity, or understand that it will modify the system. This creates a supply-chain risk: if the hosting location, DNS, TLS trust chain, or script contents are compromised, arbitrary commands could run on the user's machine with the user's privileges.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

```mermaid
graph LR
    subgraph "Read-Only (No Confirmation)"
        R1[List Pools]
        R2[Show Pool]
        R3[Pool Monitor]

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

```mermaid
graph LR
    subgraph "Read-Only (No Confirmation)"
        R1[List Pools]
        R2[Show Pool]
        R3[Pool Monitor]

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The combined IAM policy grants `modelarts:pool:*` on `Resource: "*"`, which provides broad create, update, and delete capability across all ModelArts resource pools without any inline warning about its destructive scope. In the context of a skill that manages full lifecycle operations for dedicated resource pools, this increases the risk of accidental overprovisioning, service disruption, or deletion if users apply the example policy as-is.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Read vs Write Operations

- **Read operations** (list, show, query): Execute without confirmation
- **Write operations** (create, delete, update, patch, reboot, etc.): Require explicit user confirmation
- **Destructive operations** (delete pool, delete node pool, batch delete nodes): Show warning + require confirmation

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script's title, usage, examples, and dependency notes are presented only in Chinese, and all subsequent user-facing output is also hard-coded in Chinese. For a general-purpose shell script, this imposes a specific language on users without offering a locale choice or documenting that the tool is intentionally region/language-specific.

Natural-Language Policy Violations

Low

• Confidence: 70% confidence
• Finding: The trigger specification hardcodes bilingual activation terms in Chinese and English, but the document does not state whether users may interact in other languages or that the bilingual scope is an intentional locale limitation. Because policy findings for this rule concern language or locale constraints, the fixed-language trigger set is a mild documentation-level concern.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This markdown file documents a write operation and marks it as requiring confirmation, but the CreateNetwork example asks for `--spec.vpcId` and `--spec.subnetId` without any privacy or handling warning for those potentially sensitive cloud network identifiers. Under the markdown-file criteria, behaviours affecting system integrity or exposing infrastructure details should be disclosed more explicitly.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: Moving a binary into `/usr/local/bin` changes a system PATH location and can overwrite an existing file or fail due to permissions, but the guide does not warn users about these effects. While less severe than remote code execution, unclear system-modifying instructions can still lead to accidental replacement of trusted binaries or unsafe use of elevated privileges.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The natural-language instruction presents `hcloud configure set --cli-lang=cn` as the optional language-setting step, which favors a specific locale without mentioning alternatives or user preference. Under the policy, forcing or steering to a specific language without opt-in is a locale policy concern unless justified.

Static analysis

No suspicious patterns detected.