ClawHub
Back to skill

Security audit

huawei-cloud-mrs-host-fault-diagnose

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a legitimate MRS troubleshooting skill, but it includes broader operational API access than its read-only diagnosis framing clearly bounds.

Install only if you are comfortable giving this skill a LakeWatch account with access to MRS logs, resource data, and Manager proxy reads. Before use, restrict the LakeWatch account to the minimum cluster and read-only permissions, consider removing or disabling unused manager-access POST/generic endpoints, set TLS verification appropriately for your environment, and treat any repair or cleanup recommendation as manual operator action requiring backup and explicit approval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (47)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill is presented as a narrowly scoped fault-diagnosis workflow, but the documented interface exposes a much broader capability surface through a generic LakeWatch API client, proxy access to manager APIs, and references to credential/token handling and auxiliary CLI functions. That mismatch is dangerous because downstream agents or reviewers may trust the stated read-only diagnostic scope while the actual toolchain can access additional endpoints and sensitive operational data, increasing the chance of overbroad API use or privilege abuse if the client/config is manipulated.

Ae1

High
Category
analysis-evasion
Content
**Architecture**: Caller (Agent) -> `lakewatch_api_client.py` (Python, scripts/) -> LakeWatch API -> MRS cluster (node resource data, logs, MRS Manager proxy);
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
**Architecture**: Caller (Agent) -> `lakewatch_api_client.py` (Python, scripts/) -> LakeWatch API -> MRS cluster (node resource data, logs, MRS Manager proxy);
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
**Architecture**: Caller (Agent) -> `lakewatch_api_client.py` (Python, scripts/) -> LakeWatch API -> MRS cluster (node resource data, logs, MRS Manager proxy);
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
ch_api_client.py`. For the LakeWatch client setup, see [CLI Installation Guide](references/cli-installation-guide.md).
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
ch_api_client.py`. For the LakeWatch client setup, see [CLI Installation Guide](references/cli-installation-guide.md).
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- The password MUST be encrypted with `--encrypt-password` and stored in `scripts/lakewatch_api_config.yaml` (`auth.encrypted_password`). Never store the plaint
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- The password MUST be encrypted with `--encrypt-password` and stored in `scripts/lakewatch_api_config.yaml` (`auth.encrypted_password`). Never store the plaint
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- The password MUST be encrypted with `--encrypt-password` and stored in `scripts/lakewatch_api_config.yaml` (`auth.encrypted_password`). Never store the plaint
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- The password MUST be encrypted with `--encrypt-password` and stored in `scripts/lakewatch_api_config.yaml` (`auth.encrypted_password`). Never store the plaint
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
For the full API catalog, parameters, and the token/encryption mechanism, see [LakeWatch API Client](references/lakewatch-api-client.md).
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
For the full API catalog, parameters, and the token/encryption mechanism, see [LakeWatch API Client](references/lakewatch-api-client.md).
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
For the full API catalog, parameters, and the token/encryption mechanism, see [LakeWatch API Client](references/lakewatch-api-client.md).
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| [Related Commands](references/related-commands.md) | Common LakeWatch API commands quick reference |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Credential Access

High
Category
Privilege Escalation
Content
|-------------|----------------|-------------------|
| SSH connection refused | SSH key not restored or sshd not started | Restore omm user SSH keys, start sshd service |
| Host key verification failed | known_hosts mismatch | Clean old host fingerprints from known_hosts |
| Permission denied | SSH key permissions incorrect | Fix permissions: chmod 700 ~/.ssh, chmod 600 ~/.ssh/id_rsa |

### 1.3 Disk Space Check
Confidence
90% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- The password MUST be encrypted with `--encrypt-password` and stored in `scripts/lakewatch_api_config.yaml` (`auth.encrypted_password`). Never store the plaintext password.
- **Security Rules**:
  - Never expose the LakeWatch password in conversation or command output
  - Never ask the user to input the plaintext password in conversation; use the interactive `--encrypt-password` flow
  - The token is cached locally with owner-only file permissions (Win: `%TEMP%\lakewatch_token\`, Linux: `/tmp/lakewatch_token/`)

### 3. Access Permissions
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The uninstall guidance includes decisions about retaining business data and cleanup verification steps, but it does not explicitly warn that removal or cleanup may permanently delete databases or state needed by dependent services. In an operational troubleshooting skill, users may treat checklist items as safe defaults, so the lack of an explicit backup/confirmation gate creates a real risk of accidental destructive action.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The scale-in procedure tells the operator to clean up the scaled-in node's data directory without warning that this is irreversible and may remove the only recoverable local copy if replication or failover state is misunderstood. Because this skill is for fault diagnosis and root-cause localization, operators may be acting under incident pressure, which increases the chance of unsafe execution of destructive storage actions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Propagation path present | Contains root cause -> propagation -> symptom | Missing propagation path |
| Root cause section present | Contains root cause layer + root cause type | Root cause missing |
| Repair suggestion table present | Contains priority, operation, description, needs-user-confirmation | Missing table |
| All repair actions flagged "Yes" | Every repair row has needs-user-confirmation = Yes | Any repair marked as auto-execute |
| No fabricated data | All conclusions cite actual command output | Invented metrics or log content |

## 5. Error Handling Validation
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# CentOS / EulerOS / RHEL
sudo yum install -y python3 python3-pip

# Ubuntu / Debian
sudo apt-get update
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# CentOS / EulerOS / RHEL
sudo yum install -y python3 python3-pip

# Ubuntu / Debian
sudo apt-get update
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# CentOS / EulerOS / RHEL
sudo yum install -y python3 python3-pip

# Ubuntu / Debian
sudo apt-get update
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/lakewatch_api_client.py:148