huawei-cloud-obs-website-host

• Outcome: Review
• Latest audit: Sep 3, 2026 · 11:53 AM UTC
• Version: 1.0.1

Overview

The skill is coherent for Huawei OBS website setup, but it deserves review because it can use local Huawei credentials and make live bucket or DNS changes with some under-scoped credential handling.

Install only if you are comfortable letting the agent use Huawei Cloud credentials to inspect and modify the specified OBS bucket and, when requested, DNS records. Use least-privileged or temporary credentials, avoid putting AK/SK or PEM private keys directly in command lines or chat, and review the target bucket, custom domain, DNS zone, and IAM policy before running changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: This finding indicates the skill advertises configuration and repair behavior while the observable content appears to focus on verification/reporting and credential/config inspection instead of performing the promised operations. Such divergence is dangerous because users may authorize the skill under false assumptions, and agents may access local credential sources or produce incomplete changes while claiming support for broader cloud administration tasks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding indicates the skill advertises configuration and repair behavior while the observable content appears to focus on verification/reporting and credential/config inspection instead of performing the promised operations. Such divergence is dangerous because users may authorize the skill under false assumptions, and agents may access local credential sources or produce incomplete changes while claiming support for broader cloud administration tasks.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill describes actions requiring environment access, local file reads, and network operations, but it declares no explicit tool scope or permissions boundary. That creates an authorization ambiguity where an agent may use broader capabilities than reviewers or users expect, increasing the risk of unintended credential access or network-side effects.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest description says 'Use when the user needs to enable or repair OBS website hosting' and then says 'Triggers include' followed by a mixture of concepts and phrases, including broad Chinese terms like '网站托管' ('website hosting'). This does narrow to the OBS/Huawei domain overall, but it still does not clearly define exact invocation phrases, exclusions, or negative examples, which can cause unintended activation for general website-hosting requests.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Use it instead of writing a one-off SDK call in the response.
8. Register the required custom domain on the bucket via the OBS SDK path used by the script:
   - `client.setBucketCustomDomain(bucket_name, custom_domain)` — required even if DNS CNAME already exists.
   - If DNS record changes are requested in this run, create a DNS CNAME record to the OBS website hostname and wait for propagation. (read `references/hcloud-dns-obs-website.md`)
   - If DNS is managed outside Huawei Cloud or outside this run, provide the required CNAME target and explicitly instruct the user to create or update the CNAME record with their external DNS provider after OBS custom-domain registration is complete.
   - For externally managed DNS, include the practical handoff details the user needs: record type `CNAME`, host/name, target/value, and a verification command such as `dig`.
9. Verify the published site by running `scripts/verify_obs_website.py --bucket-name <bucket_name> --region <region> [--domain <custom_domain>] [--index-document <name>]`.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide instructs users to pass access key and secret key directly on the command line. Secrets supplied as CLI arguments can be exposed through shell history, process listings, audit logs, or terminal recording, which increases the chance of credential disclosure and subsequent cloud account compromise.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

wget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz
tar -xzvf obsutil_linux_amd64.tar.gz
cd obsutil_linux_amd64_*
chmod 755 obsutil
./obsutil version
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

wget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz
tar -xzvf obsutil_linux_amd64.tar.gz
cd obsutil_linux_amd64_*
chmod 755 obsutil
./obsutil version
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

wget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz
tar -xzvf obsutil_linux_amd64.tar.gz
cd obsutil_linux_amd64_*
chmod 755 obsutil
./obsutil version
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

wget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz
tar -xzvf obsutil_linux_amd64.tar.gz
cd obsutil_linux_amd64_*
chmod 755 obsutil
./obsutil version
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

wget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz
tar -xzvf obsutil_linux_amd64.tar.gz
cd obsutil_linux_amd64_*
chmod 755 obsutil
./obsutil version
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes an example that embeds a PEM private key for certificate upload without explicitly warning that the private key is a sensitive secret that must never be exposed, logged, or committed to source control. In an agent skill context, users or downstream automation may copy this pattern directly, increasing the chance of accidental secret disclosure in prompts, repos, terminal history, or telemetry.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The verifier silently sources Huawei credentials from environment variables and ~/.obsutilconfig, then performs authenticated OBS SDK operations. For a script framed as website verification, this expands privilege use beyond unauthenticated endpoint checks and can surprise users by consuming local secrets and probing cloud resources with their identity.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest emphasizes enabling or repairing hosting, setting website documents, exposing the bucket, and connecting the custom domain through Huawei DNS. This script does not configure any OBS or DNS settings; instead it validates DNS resolution, fetches website URLs, and performs read-only SDK checks, which is a materially different operational behavior from configuration.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script accesses sensitive credential sources with little explicit runtime disclosure, so users may not realize that local Huawei credentials are being consumed during verification. In an agent skill context, that reduces informed consent and increases the risk of unexpected secret use against cloud APIs.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.