huawei-cloud-sac-dify

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 10:50 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for deploying Dify on Huawei Cloud with Terraform, but it handles cloud credentials and destructive infrastructure commands that users must control carefully.

Install only if you intend to let an agent help provision Huawei Cloud resources. Review Terraform plan output yourself before apply or destroy, use least-privilege IAM credentials, keep terraform.auto.tfvars.json out of version control, restrict its file permissions, and delete it when it is no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this skill deploys Dify on Huawei Cloud ECS via Terraform, implying infrastructure provisioning and platform-specific deployment behavior. The supplied code does none of that. It is a standalone analysis/helper script that reads Terraform files, parses variable blocks, extracts defaults, masks sensitive-looking values, and prints results. There is no Terraform execution, no cloud API usage, no Huawei Cloud interaction, no Dify-specific logic, and no deployment workflow. This is a clear description-behavior mismatch with a materially different primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description promises a skill for deploying Dify on Huawei Cloud using Terraform/SAC templates. The supplied code does not perform deployment orchestration for Dify, ECS creation, or application installation. Instead, it is a preprocessing/helper script for Terraform templates: it rewrites provider source references, patches HuaweiCloud provider credential configuration, ensures variables exist, and creates a local terraform.auto.tfvars.json from environment credentials or placeholders. While this behavior is related to Terraform/Huawei Cloud support, its primary purpose is configuration normalization and credential file preparation, not Dify deployment itself. That is a material mismatch in primary purpose and capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is about infrastructure deployment of Dify on Huawei Cloud via Terraform. The supplied code does not implement Terraform, Huawei Cloud provisioning, ECS deployment, or Dify-specific setup. Instead, it is a generic Playwright CLI utility module for executing browser automation code and parsing its output. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says this skill deploys Dify on Huawei Cloud with Terraform/SAC. However, the supplied code does not provision cloud resources, invoke Terraform, create ECS instances, or deploy Dify. Instead, it automates a browser page to close dialogs, scroll, inspect DOM content, extract price/cost text, identify deployment/template links, and optionally open a cost documentation page to scrape additional pricing details. That is a materially different primary purpose: information extraction from webpages, not infrastructure deployment. This is therefore a clear description-behavior mismatch.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs use of shell commands, local file creation, reading environment variables, and writing sensitive Terraform variable files, but it does not declare any tool scope or allowed-tools boundary. That makes the effective execution surface much broader than the manifest suggests and weakens policy enforcement around high-risk capabilities.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases include very broad terms like 'Dify development', 'Agentic workflow', and 'build AI App', which can cause the skill to activate in contexts far beyond Huawei Cloud Terraform deployment. Overbroad invocation increases the chance that high-risk shell/file/credential-handling behavior is used when the user's request did not clearly call for infrastructure automation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells the user to place Huawei Cloud AK/SK into a local terraform.auto.tfvars.json file, but the warning focuses on not exposing secrets in chat rather than the risk of persisting cloud credentials on disk. Storing long-lived cloud keys in plaintext tfvars can lead to credential theft via local compromise, accidental backup/sync, or later leakage into logs, VCS, or artifacts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Security

- 🚫 Never expose AK/SK in conversation or output
- 🚫 Never ask user to type AK/SK in chat
- ✅ Prefer IAM users over primary account
- ✅ Modification ops (`apply`, `destroy`) require explicit user confirmation

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Repeating instructions to manually populate AK/SK in a tfvars file normalizes insecure secret handling without adequately surfacing the local credential-storage threat. In a skill that also uses shell and file operations, this creates a meaningful exposure path for cloud account compromise if the file is accessed by other processes or retained after use.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Install — Linux / macOS

```bash
curl -fsSL -o /tmp/terraform.zip "<URL_from_table_above>"
unzip -o /tmp/terraform.zip -d /usr/local/bin/
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document includes `terraform destroy` and destroy-preview commands as routine operational steps without an explicit warning that they can permanently remove cloud infrastructure and data. In a deployment skill intended for direct execution, this increases the chance of accidental destructive use by operators or downstream agents, especially when commands are copied verbatim.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide documents direct `ssh root@<EIP>` access and root-executed operational checks without warning about the risks of root login, exposed management interfaces, and production-impacting actions on an internet-reachable host. In the context of deploying an LLM platform on a cloud ECS instance, normalizing root SSH can encourage insecure administration practices and increase the blast radius of credential compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs operators to write Huawei Cloud access credentials into a local `terraform.auto.tfvars.json` file but does not include an explicit security warning about the sensitivity of those secrets or safe handling requirements. In a deployment skill that directly provisions cloud infrastructure, this increases the chance of credential leakage through backups, shell history, file sharing, permissive filesystem access, or accidental publication despite the note about not committing the file to git.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The verification method includes `terraform destroy` as a workflow step but does not prominently warn that this operation is destructive and can permanently remove provisioned infrastructure and dependent data. In an agentic deployment context, omission of that warning raises the risk of accidental teardown, especially if users assume the step is a harmless cleanup action.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

allow_failure: bool = False,
) -> subprocess.CompletedProcess:
    full_cmd = [*base_cmd, f"-s={session}", *args]
    proc = subprocess.run(
        full_cmd,
        capture_output=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script automatically follows a discovered cost/documentation link and loads another page, then extracts page text-derived pricing data without any explicit allowlist, origin restriction, or user disclosure. In a browser automation context, this can expand data collection beyond the initially visited page and may unexpectedly interact with third-party or untrusted documentation URLs if the source page is compromised or manipulated.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script automatically clicks buttons matching only Chinese labels like '知道了', '关闭', and '同意', which bakes in a specific language/locale expectation. The file does not offer a language choice or document a justified region-specific constraint.

Static analysis

No suspicious patterns detected.