huawei-cloud-modelarts-training-management

• Outcome: Review
• Latest audit: Sep 3, 2026 · 12:11 PM UTC
• Version: 1.0.1

Overview

This skill is a mostly coherent Huawei Cloud ModelArts management helper, but it needs review because it mixes powerful cloud actions with unsafe credential examples, broad permissions, and risky installer guidance.

Install only if you intend to let an agent operate Huawei Cloud ModelArts resources with real cloud credentials. Use a least-privilege IAM user, prefer read-only permissions until needed, avoid the combined wildcard policy, do not paste AK/SK values into chat or generated SDK code, verify any CLI installer before running it, and review every create/delete/stop/agency/storage-write action before approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims broad management capabilities and also introduces pricing-query behavior and cross-service interactions that are not cleanly represented in the declared purpose. This mismatch can cause unsafe invocation and user-consent gaps, because operators may not realize the skill will access billing-related APIs or require additional permissions beyond basic ModelArts operations. In security-sensitive automation, inaccurate capability declarations undermine review and policy enforcement.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The SDK fallback tells the agent to construct credentials from raw AK/SK values inside code, directly contradicting earlier rules that credentials must never be requested, echoed, or handled in-session. That contradiction creates a clear path for secret disclosure into the chat, code snippets, logs, or process memory. In a cloud-administration skill, exposing AK/SK can lead to full account compromise within granted IAM scope.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The SDK example uses explicit `{AK}` and `{SK}` placeholders, normalizing a workflow where users or agents may paste long-lived secrets into the session or generated code. Even if intended as illustrative, this encourages exactly the behavior the skill forbids elsewhere and increases the chance of credential leakage into transcripts, artifacts, or logs. For cloud-control credentials, that can enable unauthorized resource access, modification, and cost incurrence.

External Script Fetching

High

• Category: Supply Chain

Content

### Method 1: One-line Install (Recommended)

```bash
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
```

Default install path: `/usr/local/hcloud/`, symlinked to `/usr/local/bin/hcloud`.

• Confidence: 98% confidence
• Finding: This is a direct instance of remote script execution: content fetched from an external URL is piped into local execution via `bash` after download, without checksum or signature verification. In a skill that manages cloud training infrastructure, this is especially risky because compromised local execution can capture cloud credentials and issue destructive or costly cloud operations.

External Script Fetching

High

• Category: Supply Chain

Content

### Method 1: One-line Install (Recommended)

```bash
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
```

Default install path: `/usr/local/hcloud/`, symlinked to `/usr/local/bin/hcloud`.

• Confidence: 98% confidence
• Finding: This is a direct instance of remote script execution: content fetched from an external URL is piped into local execution via `bash` after download, without checksum or signature verification. In a skill that manages cloud training infrastructure, this is especially risky because compromised local execution can capture cloud credentials and issue destructive or costly cloud operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill describes operational use of CLI commands, helper scripts, SDK code, and credential-status checks, but it does not declare any explicit tool scope such as allowed-tools or permissions. That weakens containment because an agent may infer broader execution capability than intended, especially around environment access and shell usage. In a cloud-management skill that can affect billable and destructive resources, missing tool scoping increases the blast radius of prompt or routing mistakes.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: "huawei-cloud-modelarts-training-management"
description: "Manage Huawei Cloud ModelArts training jobs and related resources through full lifecycle operations via hcloud CLI. Covers 52 API interfaces across 8 functional domains: training job management, algorithm management, training job tags, training experiments, training job events, model import, auto search (hyperparameter tuning), and training image save. All write operations require user confirmation before execution. Triggers include: \"ModelArts training\", \"训练作业\", \"模型训练\", \"创建训练作业\", \"查询训练作业\", \"停止训练作业\", \"删除训练作业\", \"算法管理\", \"超参配置\", \"training job\", \"training management\", \"create training\", \"ModelArts 训练\", \"训练实验\", \"自动搜索\", \"超参调优\"."
---

# Huawei Cloud ModelArts Training Management

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium

• Confidence: 79% confidence
• Finding: The skill promises confirmation before all write operations, but the SDK fallback section does not restate or enforce that guardrail for writes performed through code. That inconsistency can let a fallback path bypass the user's expectation of explicit approval before destructive or billable actions. Given the ability to create, stop, or delete cloud resources, confirmation bypass materially increases operational risk.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes generic phrases such as "training job", "training management", and "create training" without contextual constraints. In a manifest/markdown description, these broad phrases can match common user requests beyond this specific Huawei Cloud ModelArts skill, increasing the risk of unintended invocation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is scoped as ModelArts training management, but the examples also expose `CreateModelArtsAgency`, which creates an IAM agency and therefore crosses into identity/permission management. This expands the skill's authority beyond its stated domain and could let a user or downstream agent provision new cross-service access paths, increasing blast radius if the skill is misused or the confirmation flow is bypassed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide recommends downloading and immediately executing a remote shell script with `curl ... && bash`, which gives the fetched content full execution on the user's system without any integrity verification or review step. If the hosting location, transport path, or referenced script is compromised, users could run arbitrary code leading to system takeover or credential theft.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The non-interactive example places access key and secret key directly on the command line, which can leak through shell history, process listings, audit logs, or terminal recordings. Because these are cloud credentials, exposure could enable unauthorized access to ModelArts and potentially broader Huawei Cloud resources.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The combined policy recommends wildcard-style broad write and destructive permissions such as create, update, delete, stop, and `*` action families on `Resource: "*"` without cautionary language. In a skill that manages training jobs end-to-end, this is especially risky because users may copy the example directly and overprovision accounts, enabling large-scale modification or deletion of ModelArts resources.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The additional dependency policy grants OBS object write capability via `obs:object:PutObject`, which extends the skill beyond pure ModelArts control-plane management into data-plane modification of training data or outputs. In this context, write access may be operationally useful, but documenting it as a recommended permission without stronger scoping guidance increases the risk of unintended data tampering or overwriting.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document tells users in one section to use `flavor_code` for BSS pricing `resource_spec`, but later says to pass `spec.resource.flavor_id` directly as `resource_spec`. If an agent follows the wrong field, it can query the wrong SKU price or fail to price the job before creation, undermining the cost-confirmation safety control for billable training operations.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: All user-facing comments, help text, status messages, and output labels are written in Chinese, with no indication that another language is available. This creates a locale policy concern because the skill effectively forces a specific language without user opt-in or a documented region-specific justification in the file.

Natural-Language Policy Violations

Low

• Confidence: 73% confidence
• Finding: The description explicitly enumerates activation phrases in Chinese and English, but does not clarify whether language handling is optional, user-selected, or merely illustrative. This can be interpreted as a built-in locale policy decision without documented opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The expected output example is shown solely in Chinese, which may impose a locale expectation without user opt-in or explanation. The document does not clarify whether output language depends on system locale or whether alternative localized output is possible.

Context-Inappropriate Capability

Low

• Confidence: 76% confidence
• Finding: `modelarts:algorithm:publishToGallery` enables distribution of algorithms beyond ordinary training-management operations and is not clearly justified by the stated skill purpose. While not inherently malicious, this broadens authority and could allow unintended publication of internal or unreviewed assets if the policy is reused as-is.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The OBS dependency example includes object write access but does not warn that this can alter or overwrite stored training data, model artifacts, or outputs. Given this skill’s training-management context, users may treat the example as mandatory and grant modification rights to sensitive storage unnecessarily.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file includes a workaround that instructs readers to load AK/SK credentials from environment variables, which is a privacy- and security-relevant behavior. The section explains how to do it but does not include any warning about treating these variables as sensitive secrets or avoiding accidental exposure in logs, shell history, or shared environments.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The document is primarily written in Chinese and presents pricing/output conventions in CNY, but it does not state that the skill is region-specific or that users may choose another language/locale. Under the policy rule for language or locale constraints, this can be a natural-language locale assumption that lacks explicit opt-in or justification.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The script states that hcloud CLI must be configured with AK/SK, and later invokes remote IAM/BSS APIs. While the script prints progress messages, it does not explicitly warn the user that their configured cloud credentials will be used to query external services and transmit requested region/flavor information.

Static analysis

No suspicious patterns detected.