huawei-cloud-modelarts-training-diagnosis

• Outcome: Review
• Latest audit: Aug 22, 2026 · 5:02 PM UTC
• Version: 1.0.1

Overview

This is a coherent read-only ModelArts diagnostic skill, but it can use cloud credentials for account-wide job and log discovery and includes risky install/uninstall shell guidance.

Install only if you are comfortable granting the agent read access to ModelArts training job metadata and diagnostic logs. Prefer a least-privilege or test Huawei Cloud profile, specify an exact job ID, region, and time window, avoid broad account scans unless intentional, and do not share raw hcloud outputs, OBS log URLs, or full logs without redaction. Inspect and verify the hcloud installer before running it, avoid the non-interactive installer unless you trust the source, and back up hcloud configuration before using any uninstall cleanup commands.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (9)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrase set includes generic failure-diagnosis terms that can match ordinary support requests, increasing the chance this skill is invoked when the user did not intend a ModelArts account investigation. Because the skill can enumerate failed jobs and inspect logs/events, accidental invocation may expose broader operational metadata than necessary.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The documented use case 'Scan all failed training jobs in my account' authorizes broad enumeration of account resources without emphasizing scope confirmation or least-privilege interaction. In a diagnostic skill that accesses logs and events, this broad scan can reveal metadata across multiple workloads that may be unrelated to the user's immediate request.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow explicitly allows scanning all abnormal jobs when the user provides nothing, but does not require a warning that this may access account-wide job metadata and associated diagnostics. That creates a privacy and over-collection risk because the skill may retrieve information far beyond the minimum needed for a single support interaction.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The acceptance criteria explicitly instruct users to inspect configured AK/SK credentials and invoke multiple cloud APIs against real Huawei Cloud resources, but they do not warn that these actions may reveal sensitive account configuration, job metadata, event contents, traceback details, or log data. In a diagnostic skill, this omission can lead testers to expose credentials or sensitive training artifacts in terminal output, screenshots, shared transcripts, or downstream LLM context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide recommends piping a remotely downloaded installation script directly into bash, including a non-interactive mode that suppresses user confirmation. This is dangerous because it executes code fetched at runtime with no integrity verification, pinning, or explicit warning about trust boundaries and system modifications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The uninstall and cleanup section includes permanent deletion commands for binaries, installation directories, configuration, and cache without a prominent warning about irreversible data loss. In an agent skill context, destructive shell snippets are riskier because they may be copied or automated without the user appreciating their scope.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file hardcodes Chinese-only output templates and phrasing without any indication that language should follow user preference or locale. This can cause the agent to ignore user language context, degrade usability, and in some settings lead to unsafe misunderstandings if users cannot accurately interpret diagnostic guidance or remediation steps.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file

• Confidence: 94% confidence
• Finding: The command `rm -rf ~/.hcloud/` recursively deletes the user's local CLI configuration and related data. In a documentation-only setting this may be acceptable for full uninstall, but in an agent skill it is dangerous because it can be reproduced or automated and can erase credentials, settings, and local state unexpectedly.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match

Content

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file

• Confidence: 90% confidence
• Finding: This rule is triggered by destructive filesystem operations and non-interactive behavior, both of which are present in the guide. Although the apparent intent is ordinary uninstall documentation rather than malicious destruction, the agent-skill context makes such commands more dangerous because they can normalize or enable autonomous deletion of user data.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/cli-installation-guide.md:212