huawei-cloud-mrs-redis-meta-check

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a Redis metadata checker, but it also includes overbroad cloud permission guidance and production repair steps that users should review carefully before use.

Install only if you expect this skill to be used for Redis nodes-*.conf analysis and treat all remediation steps as a human-reviewed runbook. Do not grant the included wildcard MRS IAM policy or run stop, copy, edit, or delete commands unless an operator has confirmed the target cluster, file paths, backup and rollback plan, and least-privilege access scope.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/iam-policies.md:5
• Finding: Unnecessary Account-Wide MRS IAM Permissions<![CDATA[ ## Vulnerability Details **File Location**: `references/iam-policies.md`, lines 5–33 **Vulnerability Type**: Excessive cloud permissions and violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```markdown | API Action | Permission | Purpose | |--------------------|------------------------|---------------------------------------| | mrs:clusters:get | View cluster details | Get cluster basic information | | mrs:clusters:list | List clusters | Confirm cluster exists | | mrs:host:list | List hosts | Get host list | ## Minimum Permission Policy JSON ```json { "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "mrs:clusters:get", "mrs:clusters:list", "mrs:host:list" ], "Resource": ["*"] } ] } ``` ## Permission Failure Handling 1. When any command fails due to permission errors, read this document 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console and grant authorization 4. Pause execution and wait for user confirmation that permissions have been granted ``` ### Technical Analysis The documented IAM policy grants the identity permission to enumerate hosts and clusters and retrieve cluster details across the wildcard resource scope. These permissions are not required by the skill's stated static-analysis workflow. `SKILL.md` explicitly says that the skill cannot connect to MRS cluster hosts, cannot execute collection commands, processes user-supplied files locally, and requires no authentication for the checking process. The IAM policy therefore contradicts the declared operating model and expands the identity's access beyond the task's legitimate requirements. The policy is read-only and does not directly permit cluster modification. Nevertheless, ...[truncated 1527 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the IAM policy and permission-granting workflow from this static file-analysis skill because its documented core functionality does not require cloud API access. 2. Clearly state that users should provide the Redis metadata file directly and that no cloud authorization is necessary for analysis. 3. If cloud-based cluster or host discovery is intentionally implemented later, isolate it as an optional workflow that requires explicit user consent. 4. Request only API actions that are demonstrably used by the implemented workflow. 5. Restrict permissions to specific projects, clusters, or other supported resource conditions instead of using `"Resource": ["*"]`. 6. Document whether each Huawei Cloud MRS action supports resource-level restrictions. Where resource scoping is unavailable, use project-level isolation, IAM conditions, a dedicated read-only identity, and short-lived credentials. 7. Do not recommend granting permissions merely because an unspecified command reports an authorization failure. First identify the failed operation and verify that it is necessary for the requested task. 8. Add a permission preflight that displays the exact optional operation, requested scope, and reason before directing the user to change IAM authorization. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill states it is limited to static analysis and cannot execute host commands, but elsewhere instructs command execution for file discovery and repair on the host. This contradiction can mislead an agent into crossing from passive analysis into operational actions on production infrastructure, increasing the chance of unauthorized or destructive command use.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

7. **Confirm recovery**: Instance status returns to Good and the Redis logical cluster status returns to normal
8. **Clean up the backup file** (on the host):
   ```bash
   rm -f /srv/BigData/redis_meta/Redis_1/nodes-22400.conf_bak
   ```

## 7. Parameters

• Confidence: 95% confidence
• Finding: The skill includes a destructive shell command (`rm -f`) targeting host files. In an agentic setting, even cleanup commands are dangerous because they normalize file deletion and may be executed automatically, with risk of data loss, mistaken path substitution, or removal of needed rollback artifacts.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation guidance includes broad troubleshooting scenarios like Redis startup failures or connection anomalies, which are common requests not always tied to metadata-file analysis. This can cause the skill to trigger in contexts where its assumptions do not apply, leading the agent to request sensitive files unnecessarily or provide irrelevant and potentially risky repair advice.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list contains an ambiguous troubleshooting phrase that could activate the skill for general Redis startup diagnostics rather than metadata checks specifically. Overbroad triggering increases the chance of misapplication and exposing operational guidance in the wrong context.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Although presented as a checker, the skill includes detailed repair guidance such as stopping instances, copying metadata, editing files, and restarting services. That materially expands the skill from diagnosis into change management, which can cause service disruption or unsafe recovery steps if an agent applies the guidance without proper safeguards.

Static analysis

No suspicious patterns detected.