huawei-cloud-modelarts-training-management

• Outcome: Review
• Latest audit: Jul 28, 2026 · 1:34 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for Huawei ModelArts management, but it asks for broad cloud mutation authority and includes an unsafe CLI install command.

Install only after reviewing the CLI installation path, avoid the curl-to-bash command, use least-privilege Huawei Cloud credentials, narrow IAM and OBS permissions to the exact project and bucket prefixes, and approve agency creation or delete operations only when you understand their cloud impact.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The reference file documents capabilities beyond the stated training-management scope, including model import and agency creation. Scope expansion in an agent skill is dangerous because it can normalize or enable higher-privilege actions than users expect, increasing the chance of unauthorized resource creation or IAM-related changes if these operations are exposed through the skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: `CreateModelArtsAgency` stands out as a privilege-affecting capability that is not obviously required for routine training-job management. Agency creation can establish or expand delegated permissions between services, so including it in a training-focused skill materially raises the risk of privilege escalation, unexpected trust relationships, or broader cloud access than the user intended.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This section expands the skill from training-job management into broader ModelArts model-management and IAM-adjacent operations, including creating a ModelArts agency and importing/deleting models. That scope increase matters because it introduces privilege-affecting and destructive capabilities beyond the user’s likely expectation from a 'training management' skill, increasing the chance of overbroad or unintended actions if the agent uses these examples to drive command selection.

Description-Behavior Mismatch

Low

• Confidence: 85% confidence
• Finding: The file claims 'all 86 ModelArts training-related CLI APIs' while the skill metadata says 52 APIs across 8 domains. This inconsistency can cause the agent or reviewer to misunderstand the actual authority and scope of the skill, which is a security-relevant problem because understated or unclear capability boundaries make overbroad tool use more likely.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documented additional dependency grants OBS object write access via `obs:object:PutObject` and bucket/object scope that is broader than the file otherwise justifies for a training-management skill. If operators apply this policy as recommended, the skill could modify or overwrite data in the referenced training bucket, expanding impact beyond ModelArts control-plane actions into storage tampering or unintended data exfiltration/staging.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes very broad terms like "training job", "training management", and generic Chinese ML phrases that can match ordinary discussion rather than a clear request to operate on Huawei Cloud resources. In an agent setting, overbroad activation can cause the skill to engage in the wrong context and steer the agent toward cloud-management actions, increasing the risk of unintended destructive or sensitive operations despite later confirmation steps.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The skill instructs use of environment-based AK/SK credentials but does not explicitly warn against exposing, echoing, logging, or requesting those secrets in chat or command output. In a credentialed cloud-management skill, missing secret-handling guidance increases the chance that users or downstream tooling mishandle long-lived cloud credentials, which could enable unauthorized access if disclosed.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The guide instructs users to pipe content fetched over the network directly into a shell, which executes remote code without inspection, integrity verification, or provenance validation. If the remote page is compromised, altered, or returns unexpected content, users could execute arbitrary commands on their systems with their current privileges, potentially exposing Huawei Cloud credentials configured later in the workflow.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.