huawei-cloud-obs-upload

• Outcome: Review
• Latest audit: Aug 24, 2026 · 6:49 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for Huawei OBS uploads, but it deserves review because it can create persistent scheduled uploads from local directories and includes some monitoring capabilities beyond the top-level description.

Review this skill before installing if you plan to use scheduled uploads. Use a dedicated non-sensitive source directory, confirm the exact bucket, prefix, and schedule, verify the cron entry before installing it, and keep credentials least-privileged with no delete permissions. Avoid pasting AK/SK into chat or shell history where possible, and inspect remote installer scripts before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The verification document includes CES traffic and request metric queries that go beyond the skill manifest’s declared scope of bucket listing, uploads, and scheduled uploads. This scope drift is dangerous because it can cause the agent to invoke additional cloud monitoring APIs and surface operational telemetry the user did not explicitly request or expect, violating least-privilege and increasing the blast radius of the skill.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The end-to-end script exercises CES metric collection that is not described in the manifest, creating a mismatch between documented capabilities and actual behavior. Hidden or undeclared cloud API usage is risky because users and reviewers may approve the skill for storage operations while it also accesses monitoring data, undermining transparency and consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide recommends a one-line `curl ... && bash` installer that executes a remotely downloaded script and then installs software system-wide. Even if the host is legitimate, this pattern is dangerous because it bypasses meaningful user review of the script contents and gives a compromised download endpoint or MITM opportunity a direct path to code execution and persistent system modification.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `obsutil config -ak=<AK> -sk=<SK>` example places long-lived credentials directly on the shell command line, which can leak via shell history, process listings, terminal logging, or audit tooling. Because this skill manages cloud object storage, exposed keys could enable unauthorized bucket listing, object access, upload, overwrite, or deletion depending on IAM scope.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The upload workflow instructs transferring local files or directories to cloud storage without an explicit confirmation or warning about data exfiltration, overwrites, or privacy implications. In an agent context, this is dangerous because users may not realize sensitive local data is being recursively uploaded to a remote bucket, especially for directory uploads.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The scheduled upload section creates persistent automated data transfer via crontab but does not clearly warn that it will continue running until removed. In the skill context, persistence materially increases risk because a one-time user action can turn into ongoing background exfiltration of local directory contents to cloud storage.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to set up recurring uploads of a local directory to a remote cloud bucket but does not warn about the risk of unintentionally exfiltrating sensitive files, credentials, personal data, or regulated content. Because the upload is periodic and unattended, any later-added sensitive files under that directory may be continuously exposed without additional user review.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The scheduled upload verification directly installs a cron job that persists beyond the immediate session, but the setup step does not prominently warn that it creates ongoing background execution. Persistent scheduled tasks are dangerous because they can continue transferring local data to cloud storage automatically, creating data exfiltration, cost, and operational risks if the cleanup step is missed or modified.

Session Persistence

Medium

• Category: Rogue Agent

Content

(crontab -l 2>/dev/null; echo "0 * * * * /bin/bash $HOME/obs-scheduled-upload-<BucketName>.sh") | crontab -

# Run daily at 8:00
(crontab -l 2>/dev/null; echo "0 8 * * * /bin/bash $HOME/obs-scheduled-upload-<BucketName>.sh") | crontab -

# Run every 30 minutes
(crontab -l 2>/dev/null; echo "*/30 * * * * /bin/bash $HOME/obs-scheduled-upload-<BucketName>.sh") | crontab -

• Confidence: 85% confidence
• Finding: The documented use of crontab creates persistent execution on the host, which can be risky because it survives beyond the immediate session and continues making network uploads automatically. In a skill that performs remote data transfer, persistence increases the blast radius of mistakes such as misconfigured paths, overly broad directories, or compromised cloud credentials.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.