huawei-cloud-obs-bucket-create

• Outcome: Pass
• Latest audit: Jun 25, 2026 · 9:04 AM UTC
• Version: 0.0.1

Overview

This skill coherently helps users create Huawei Cloud OBS buckets, but users should handle credentials and installer commands carefully.

Install only if you intend to manage Huawei Cloud OBS resources. Before running commands, verify the KooCLI installer source, avoid putting real AK/SK values in chat or shell history, confirm the exact bucket names, regions, ACLs, and storage classes, and back up existing hcloud configuration before re-running initialization.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill gives contradictory instructions for checking credential status: it suggests using `hcloud obs ls -s` and referencing `~/.obsutilconfig`, while the security rules later say to only use `hcloud configure list` and not extract credentials from configuration files. In a credential-sensitive cloud workflow, this inconsistency can push an agent or user toward reading or exposing secret-bearing configuration details, increasing the chance of credential leakage or unsafe handling.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are overly broad, including generic terms like `OBS bucket`, `Huawei Cloud bucket`, and `storage creation`, which can cause the skill to activate in contexts that only loosely match bucket creation. Overbroad invocation increases the chance that the agent performs cloud-administrative guidance or actions when the user intended something else, which is risky in an infrastructure-management skill.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs users to fetch and immediately execute a remote shell script with `curl ... | bash`-equivalent behavior, which grants the downloaded code full execution on the user's system and may modify privileged directories such as `/usr/local/bin`. If the remote host, distribution path, or script is tampered with, users could unknowingly execute malicious code; the skill context increases risk because this is presented as a trusted setup step for cloud tooling and may lead users to run it with elevated privileges.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document states only afterward that re-running initialization deletes the existing configuration file, but does not warn users before they execute the command. This can lead to accidental destruction of prior configuration, including cloud access settings, causing loss of availability or operational disruption; in a cloud-management skill, that risk is more significant because users may overwrite working credentials and region/profile settings during setup or troubleshooting.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: huawei-cloud-obs-bucket-create
description: |
  Skill specialized for creating buckets on Huawei Cloud OBS. Use this skill when users need to create OBS buckets, set bucket properties, configure access permissions, or need guidance on the bucket creation process. Trigger conditions: "创建OBS桶", "华为云存储桶", "存储空间创建", "create OBS bucket", "Huawei Cloud storage bucket", "OBS bucket", "Huawei Cloud bucket", "storage creation" or when setting up Huawei Cloud object storage.
tags: [huawei-cloud, obs, storage, bucket]
---

• Confidence: 75% confidence
• Finding: create OBS buckets, set bucket properties, configure access permissions, or need guidance on the bucket creation process. Trigger conditions: "创建OBS桶", "华为云存储桶", "存储空间创建", "create OBS bucket", "Huawei

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

### Step 2: Select Region

Get the region for the OBS bucket to be created from the context. If no region is specified, use the "endpoint" parameter in the ~/.obsutilconfig file as the region by default.
Return prompt text:
>Once a bucket is created successfully, the region cannot be changed, please choose carefully. The region you want to create the bucket in is ${region}

### Step 3: Create Bucket

• Confidence: 85% confidence
• Finding: Return prompt

VirusTotal

62/62 vendors flagged this skill as clean.