huawei-cloud-optv-evolve-management

• Outcome: Review
• Latest audit: Sep 9, 2026 · 11:13 AM UTC
• Version: 1.0.0

Overview

The skill has a clear Huawei Cloud OptVerse purpose, but it includes overbroad persistent cloud delegation and unsafe credential/state guidance that users should review before installing.

Install only if you are comfortable with a cloud-administration skill that can create, start, stop, and delete OptVerse resources. Use least-privilege temporary credentials, avoid administrator AK/SK when possible, do not store secrets in agent memory or scratchpads, skip OBS upload unless needed, and review any IAM agency policy so it is time-bounded and limited to the specific bucket or prefix.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/iam-agency.md:99
• Finding: Permanent OBS Agency Grants Excessive Account-Wide Storage Privileges<![CDATA[ ## Vulnerability Details **File Location**: `references/iam-agency.md:99-179` **Vulnerability Type**: Overprivileged persistent IAM delegation **Risk Level**: High ### Vulnerable Code ```bash hcloud IAM CreateAgencyCustomPolicy \ --role.display_name="policy_ai4s_llma4ad" \ --role.description="AI4S LLM4AD delegation policy" \ --role.description_cn="LLM4AD cross-service delegation policy" \ --role.type="AX" \ --role.policy.Version="1.1" \ --role.policy.Statement.1.Effect="Allow" \ --role.policy.Statement.1.Action.1="iam:agencies:assume" \ --role.policy.Statement.1.Action.2="obs:bucket:CreateBucket" \ --role.policy.Statement.1.Action.3="obs:bucket:DeleteBucket" \ --role.policy.Statement.1.Action.4="obs:bucket:DeleteBucketPolicy" \ --role.policy.Statement.1.Action.5="obs:bucket:GetBucketAcl" \ --role.policy.Statement.1.Action.6="obs:bucket:GetBucketLocation" \ --role.policy.Statement.1.Action.7="obs:bucket:GetBucketPolicy" \ --role.policy.Statement.1.Action.8="obs:bucket:GetBucketQuota" \ --role.policy.Statement.1.Action.9="obs:bucket:GetBucketStorage" \ --role.policy.Statement.1.Action.10="obs:bucket:GetBucketStoragePolicy" \ --role.policy.Statement.1.Action.11="obs:bucket:GetEncryptionConfiguration" \ --role.policy.Statement.1.Action.12="obs:bucket:HeadBucket" \ --role.policy.Statement.1.Action.13="obs:bucket:ListAllMyBuckets" \ --role.policy.Statement.1.Action.14="obs:bucket:ListBucket" \ --role.policy.Statement.1.Action.15="obs:bucket:ListBucketMultipartUploads" \ --role.policy.Statement.1.Action.16="obs:bucket:PutBucketAcl" \ --role.policy.Statement.1.Action.17="obs:bucket:PutBucketPolicy" \ --role.policy.Statement.1.Action.18="obs:bucket:PutBucketQuota" \ --role.policy.Statement.1.Action.19="obs:bucket:PutEncryptionConfiguration" \ --role.policy.Statement.1.Action.20="obs:bucket:PutLifecycleConfiguration" \ --role.policy.Statement.1.Action.21="obs:object:AbortMultipartUpload" \ --role.policy ...[truncated 3362 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the broad action set with a purpose-built result-upload policy. 2. Scope the policy to the exact user-approved OBS bucket and, where supported, the exact output prefix. 3. Retain only operations necessary to upload results, such as narrowly scoped object writes and multipart-upload completion. 4. Remove the following categories unless the platform demonstrably requires them: - Bucket creation and deletion. - Bucket policy and ACL modification. - Quota, lifecycle, and encryption administration. - Unrelated object reads. - Object and version deletion. - Account-wide bucket enumeration. 5. If an API requires temporary read access, document each required action and constrain it to the selected resource. 6. Use a bounded agency duration rather than `FOREVER`. 7. Require explicit user confirmation that identifies the trusted principal, duration, bucket, prefix, and exact permissions before creation. 8. Document and automate post-task revocation or agency detachment. 9. Have the policy reviewed against Huawei Cloud's current resource-level IAM syntax before deployment. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/precheck.sh:151
• Finding: Mandatory Precheck Enumerates OBS Buckets During Non-Upload Workflows<![CDATA[ ## Vulnerability Details **File Location**: `scripts/precheck.sh:151-165` and `scripts/precheck.ps1:160-175` **Vulnerability Type**: Unnecessary authenticated resource enumeration **Risk Level**: Medium ### Vulnerable Code Bash implementation: ```bash check_optverse_connectivity() { local name="$1" local region=$(get_configured_region) if [[ -z "$region" ]]; then ((CHECKS_SKIPPED+=1)) info "跳过连通性检查（region 未确定）" return 0 fi local conn_output conn_output=$("$HLOUD_CMD" OptVerse ListBuckets --cli-region=$region --cli-output=json 2>&1) || true if echo "$conn_output" | grep -qiE "(error|exception|unauthorized|forbidden|认证失败)"; then fail "${RED}OptVerse 连通性检查失败: $(echo $conn_output | head -c 200)${RESET}" FAILED=1; ((CHECKS_FAILED+=1)); return 1 fi ok "${GREEN}OptVerse API 连通性正常${RESET}" ((CHECKS_PASSED+=1)) return 0 } ``` PowerShell implementation: ```powershell function Test-OptVerseConnectivity { $name = "OptVerse 连通性" if (-not $Region) { Write-Info "跳过连通性检查（region 未确定）" Write-Skip return $true } # 用 --cli-query="payload.list" 拿 JSON 数组（"[...]" 开头即代表连通） $buckets = & $HLoudCmd OptVerse ListBuckets --cli-region=$Region --cli-query="payload.list" 2>&1 if ($buckets -is [array]) { $buckets = $buckets -join "`n" } $bucketsStr = ([string]$buckets).Trim() if ($bucketsStr.StartsWith("[")) { Write-Ok "${GREEN}OptVerse API 连通性正常${RESET}" $script:CHECKS_PASSED++ return $true } else { Write-Fail "${RED}OptVerse 连通性检查失败: $bucketsStr${RESET}" return $false } } ``` The mandatory invocation is established in `SKILL.md:95-125`, which requires a precheck before any OptVerse or IAM operation. ### Technical Analysis The precheck uses the authenticated `OptVerse ListBuckets` operation as a general connectivity probe. This operation retrieves cloud-storage inventory and requires bucket-listing privileges. Bucket enumeration is unrelated to the Skill's default workflow, ...[truncated 1566 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `ListBuckets` with a non-sensitive OptVerse health, version, help, or minimal read-only endpoint that does not enumerate customer resources. 2. Do not require any OBS permission in the default `output_path=""` workflow. 3. Run bucket-related checks only after the user explicitly selects OBS upload. 4. Ask for confirmation before enumerating buckets, or preferably ask the user for the intended bucket and validate only that resource. 5. Never print raw API response bodies in precheck failures. 6. Return only a sanitized error code, operation name, and correlation/request identifier. 7. Apply the same behavior and redaction rules consistently to both Bash and PowerShell implementations. 8. Update `SKILL.md` and prerequisite documentation so default permissions exclude all bucket-listing actions. ]]>

T02 · Agent Memory Poisoning

Error

• Location: references/plan-maintenance.md:47
• Finding: State-Management Guidance Allows Cloud Credentials in Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `references/plan-maintenance.md:47-63` **Vulnerability Type**: Persistent sensitive-data storage guidance **Risk Level**: High ### Vulnerable Code ```markdown ## 3. Division of labor with `scratchpad` / `memory` | Tool | Purpose | Lifetime | |---|---|---| | `plan` | Steps to take next (goal + step status) | active → all completed → clear | | `scratchpad` | In-session transient state, IDs, decisions, next step | current task | | `memory` | Long-term stable preferences / project context / general knowledge | across tasks / across sessions | > Rule of thumb: `plan` watches the road, `scratchpad` watches the pack, `memory` watches the map. ## 4. Anti-patterns | ❌ Anti-pattern | Why it's bad | |---|---| | Using plan as a log (update_steps on every action) | State becomes chaotic; everything disappears on completion | | Advancing all steps at once to mark them completed | User can't see history, and this triggers auto-clear | | Forcing `advance` when the task direction has changed | Use `replace_active` instead — when the goal changes, the plan must be rewritten | | Writing AID / TID / credentials into plan steps | Plan is structured steps, not an identifier carrier; use `scratchpad` or `memory` | | Calling `clear_active` to "reset" the plan | Loses context; `replace_active` is safer | ``` ### Technical Analysis The document defines `memory` as storage that persists across tasks and sessions. It then instructs the agent to use `scratchpad` or `memory` instead of plan steps for credentials. This creates a direct path for AK/SK or other cloud credentials to enter long-term agent memory. It contradicts the stronger security rules elsewhere in the Skill that prohibit exposing AK/SK in conversations, scripts, or output. Persistent agent memory is not an appropriate secret store. Its retention, access controls, tenant isolation, deletion semantics, and future retrieval behavior may differ from a dedicated cre ...[truncated 1413 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the affected instruction with an absolute prohibition: - Never store AK, SK, session tokens, passwords, private keys, or authorization headers in plan, scratchpad, memory, caches, logs, or conversations. 2. Allow only non-secret identifiers such as algorithm IDs and task IDs in session-scoped scratchpad storage. 3. Do not put credentials in persistent memory under any circumstances. 4. Use KooCLI's protected profile mechanism, a platform secret manager, or ephemeral process environment injection. 5. Prefer short-lived STS credentials with the minimum required IAM actions. 6. Ensure agents verify only credential presence and never retrieve or reproduce credential values. 7. Add secret-pattern redaction before any state-storage operation. 8. Document deletion and rotation procedures for any credential that may already have been written to agent state. 9. Align `plan-maintenance.md` with the security rules in `SKILL.md` and the prerequisite documentation. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/cli-installation-guide.md:17
• Finding: Unverified Archive Is Installed as a Privileged System Executable<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md:17-23` **Vulnerability Type**: Unsafe dependency download and privileged installation **Risk Level**: Medium ### Vulnerable Code ```bash # Download the release binary (verify the URL against the official Huawei Cloud docs) curl -L -o /tmp/hcloud.tar.gz "<official-hcloud-release-url>" tar -xzf /tmp/hcloud.tar.gz -C /tmp sudo mv /tmp/hcloud /usr/local/bin/hcloud hcloud version ``` ### Technical Analysis The installation procedure downloads an archive from a placeholder URL, follows redirects, and performs no cryptographic integrity or authenticity verification. It then extracts the archive into the shared `/tmp` directory and moves the resulting file into `/usr/local/bin` using elevated privileges. The instruction to manually verify the URL is not equivalent to pinning a trusted source or checking a vendor signature or checksum. The procedure does not validate: - The final URL after redirects. - A pinned version. - A published SHA-256 checksum. - A vendor signature. - The extracted file type and expected path. - Ownership and permissions before installation. Using predictable paths such as `/tmp/hcloud.tar.gz` and `/tmp/hcloud` also creates opportunities for local interference, races, or symlink-related replacement in a hostile multi-user environment. ### Attack Path 1. A user follows the installation guide because `hcloud` is missing. 2. An incorrect, substituted, compromised, or malicious URL is placed into the placeholder. 3. `curl -L` downloads attacker-controlled content and follows redirects without validating a pinned destination. 4. The archive is extracted into shared `/tmp`. 5. A malicious archive entry or locally replaced `/tmp/hcloud` becomes the installation candidate. 6. `sudo mv` installs that file as `/usr/local/bin/hcloud`. 7. Subsequent Skill operations invoke the malicious executable with access to the user's environment and configured Huawei C ...[truncated 792 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the placeholder with a pinned official HTTPS release URL and explicit version. 2. Publish the expected SHA-256 digest in the guide and verify it before extraction. 3. Prefer vendor signature verification where Huawei Cloud provides signed artifacts. 4. Validate the final redirected host or disable redirects that leave the approved Huawei Cloud domain. 5. Use a private temporary directory: ```bash tmpdir="$(mktemp -d)" chmod 700 "$tmpdir" ``` 6. Extract into that private directory rather than directly into `/tmp`. 7. Inspect the archive member list before extraction and reject absolute paths, traversal entries, unexpected links, and unexpected filenames. 8. Verify that the extracted `hcloud` is a regular executable file and not a symbolic link. 9. Install with explicit owner and mode, for example through a controlled `install` command, only after user approval. 10. Remove the archive and temporary directory after installation. 11. Prefer an authenticated platform package manager or official signed installer where available. 12. Run a checksum/signature verification before any command is executed from the downloaded package. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs the agent to use shell execution, read environment/configuration, and maintain local cache files, yet it declares no permissions. That mismatch undermines permission transparency and can cause a host agent to grant broader access implicitly than users expect, especially because the skill can invoke cloud-management commands and write state under .stats/.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are broad enough to activate on ordinary requests like uploading files or starting tasks, which may cause the agent to enter a cloud-administration workflow unexpectedly. In this skill, activation can lead to credential checks, shell execution, file handling, and potentially IAM or task-management operations, so overbroad triggering increases the chance of unintended sensitive actions.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The documentation promotes a --open option that launches the default browser, but it does not consistently require an explicit user-facing confirmation at that point. Launching a local application is a side effect that can surprise users, leak context to the desktop/session, or behave unsafely in managed environments.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This documentation enumerates powerful destructive operations such as deleting algorithm projects, deleting evolve tasks, and IAM policy/agency management without a clear warning that these actions can permanently remove resources or alter access control. In a skill that drives real cloud APIs, omission of impact warnings increases the chance that users or downstream agents execute destructive commands casually or with insufficient review.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The upload-flow description explains how to create an agency, authorize bucket permissions, and let the service read and write the configured output path, but it does not explicitly warn about confidentiality and integrity implications of granting bucket access. Because this skill handles cloud storage authorization, lack of privacy/integrity guidance can lead to overbroad bucket grants, unintended data exposure, or service modification of sensitive objects.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script pipes a hardcoded 'y' into `hcloud version`, automatically accepting CLI terms on first run without any explicit notice or user consent. This can cause users to unknowingly agree to legal terms and may normalize hidden non-interactive acceptance behavior in automation, which is risky in a security-sensitive cloud-management skill.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The connectivity test makes a real `hcloud OptVerse ListBuckets` API call as part of precheck without a prominent user-facing warning. Even though it is read-oriented, it still performs an authenticated cloud operation that can disclose metadata, create audit log entries, and surprise users expecting a purely local environment check.

Scope Creep

Low

• Category: Excessive Agency

Content

> **Quick start**: before initializing a task, you can run [`scripts/precheck.sh`](../scripts/precheck.sh) (bash) or [`scripts/precheck.ps1`](../scripts/precheck.ps1) (PowerShell) for a one-shot environment check (covers KooCLI install, version, credentials, region, connectivity). See [SKILL.md §1.0](../SKILL.md) for details. **The sections below describe what `precheck` does NOT cover** (Python interpreter, IAM permissions, agency / bucket authorization).

> **⚠️ Execution method (required reading)**: all commands (including but not limited to: business API `hcloud …` calls, local helper tool calls like `scripts/cache.py` / `scripts/zip_helper.py`, pre-task checks, directory / file reads) MUST go through `skill action=exec`, unless the current agent does not support `skill action=exec` — in that case fall back to direct shell execution.

## 0. Pre-configured values (agent retrieves automatically, **does NOT ask user**)

• Confidence: 95% confidence
• Finding: The document requires that all commands, including local helper scripts, pre-task checks, directory reads, and fallback direct shell execution, be performed through a generic execution channel. In an agent setting, this broadens authority and normalizes arbitrary command execution and filesystem access beyond the narrowly necessary API interactions, increasing the blast radius if later instructions or inputs are malicious or mistaken.

Static analysis

No suspicious patterns detected.