huawei-cloud-rds-smart-service

• Outcome: Review
• Latest audit: Aug 17, 2026 · 11:37 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Huawei Cloud RDS admin helper, but it grants broad database-changing authority with incomplete safety boundaries and risky setup guidance.

Install only in a controlled admin environment. Use a least-privilege Huawei Cloud IAM role scoped to specific test or intended RDS instances, avoid full wildcard policies, do not paste real secrets into chat or command lines, inspect installer scripts before running them, and require manual review before any restart, resize, failover, restore, delete, session-kill, or security-policy change.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill explicitly depends on environment-based credentials (AK/SK) and describes CLI/SDK/API execution, but no declared permissions or capability boundaries are provided. This creates hidden access expectations and makes it harder for a host platform or reviewer to constrain secret access and execution scope.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 76% confidence
• Finding: The description says the skill covers six domains, but the body also includes security administration actions and other mutating operations not cleanly reflected in the declared scope. Description/behavior drift is dangerous because users and reviewers may authorize the skill under a narrower trust model than what its documented actions actually enable.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest advertises six capability domains, yet the skill separately documents security group, SSL, and audit policy administration. In a cloud database context, security administration can materially affect exposure and compliance, so omitting it from the declared scope increases the chance of unsafe invocation or under-review.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The documentation is internally inconsistent: it says stop/delete is unsupported, but the mutating-operations list includes Stop as a supported action. For infrastructure operations, contradictory documentation can cause accidental service disruption if an agent or operator believes a risky action is available or approved under the skill's safety model.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger list contains very broad terms such as general database, DBA, troubleshooting, and performance phrases that can match ordinary conversations. Over-broad triggers increase the chance that the skill activates in contexts where the user did not intend cloud RDS operations, which is more dangerous here because the skill includes mutating infrastructure and security actions.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The guide tells users to execute a remote installer script directly with `curl | bash`, which grants immediate code execution from a network source without inspection, integrity verification, or user warning. In an infrastructure/database operations skill, this is especially risky because users are likely to run the command on privileged admin hosts that also hold cloud credentials.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The Windows instructions download and execute a remote installer script without integrity validation or any warning that it will run code and modify the system. This creates the same remote-code-execution risk as pipe-to-bash, and it is amplified in an RDS admin context where the host may have broad cloud access and sensitive operational tooling.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide recommends placing long-lived access keys and secret keys in environment variables and CLI arguments without warning about exposure through shell history, process listings, logs, shared sessions, or persisted configuration. In a database operations skill, credential compromise could enable unauthorized access to cloud RDS resources and related account actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file documents and recommends a very broad 'Full Management Policy' that includes destructive and service-impacting actions such as delete, restore, failover, stop, restart, reduce, and kill on all resources via Resource:["*"], but it does not prominently warn about the operational and data-loss risks of granting these permissions. In the context of an agent skill that can perform RDS O&M and recovery tasks, this can normalize over-privileged deployments and materially increase blast radius if the agent, a user, or compromised credentials misuse the policy.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The troubleshooting guide instructs operators to retrieve error, slow, and session-related diagnostic data without any warning that these logs can contain sensitive information such as SQL text, schema details, usernames, client IPs, or application data fragments. In an agent skill context, this increases the chance that sensitive log contents will be fetched, displayed, stored, or echoed back into conversations without minimization or redaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide includes a credentialed connection validation example that normalizes passing a database username and password on the command line, but does not warn that command-line credentials may be exposed through shell history, process listings, audit logs, or agent transcripts. In a skill designed for automated assistance, this is especially dangerous because users may paste real secrets directly into prompts or commands that can be retained or surfaced elsewhere.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.