huawei-cloud-sac-new-api

• Outcome: Pass
• Latest audit: Aug 22, 2026 · 2:28 PM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Huawei Cloud Terraform deployment helper, but users should handle its cloud credentials and destroy steps carefully.

Install only if you intend to let an agent prepare and run a Huawei Cloud Terraform deployment. Use a least-privilege IAM user, review terraform plan before apply or destroy, verify the downloaded template source, restrict SSH and port 3000 exposure, and keep terraform.auto.tfvars.json out of git and remove it when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exercises powerful capabilities including environment access, file read/write, network access, and shell execution, yet declares no permissions or trust boundaries. That creates an authorization and transparency gap: an agent may execute sensitive deployment, credential-handling, and filesystem operations without the user or platform having a clear policy gate for them.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The stated purpose is deployment of a Huawei Cloud solution, but the documented workflow also scrapes web pages, downloads remote Terraform from URLs, rewrites provider and credential configuration, parses templates, and materializes credentials into tfvars files. That broader behavior materially expands the attack surface because remote content can influence infrastructure code and credential-bearing files beyond what a user may reasonably expect from the description alone.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script goes beyond provider-source normalization and writes a credential-bearing terraform.auto.tfvars.json file containing access_key and secret_key. Persisting cloud credentials to disk increases exposure through accidental commit, workspace leakage, backups, and other local file disclosure paths, especially because .auto.tfvars files are automatically consumed by Terraform.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring claims the script only normalizes provider sources, but the implementation also rewrites provider credential blocks and emits credential files. This mismatch is dangerous because reviewers and operators may grant trust or execution approval under a narrower understanding of behavior, causing unintended secret handling and file modification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cleanup section instructs `terraform destroy` without an adjacent explicit stop-and-confirm step, even though destroy is a destructive cloud operation that can delete provisioned infrastructure and disrupt services. In an agent setting, omission of a mandatory confirmation checkpoint increases the chance of accidental or automated resource destruction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document grants multiple destructive delete permissions for compute, network, public IP, and storage resources but does not explicitly warn operators that these permissions enable irreversible cleanup and possible data loss. In an infrastructure-deployment skill, this omission can lead users to overprovision IAM access or run destroy/cleanup flows without understanding the operational impact.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document includes destructive Terraform commands such as `terraform destroy` and `terraform plan -destroy` without any caution about irreversible infrastructure deletion, downtime, or data loss. In a deployment skill, operators may copy commands directly, so missing warnings materially increases the chance of accidental destructive use.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: State manipulation commands like `taint`, `untaint`, `apply -refresh-only`, and especially `import` can alter Terraform's view of infrastructure and trigger unintended changes if used incorrectly. Without warnings about state corruption, drift, or forced recreation, users may destabilize managed resources or lose track of actual infrastructure state.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Providing `ssh root@<EIP>` access instructions without any security warning normalizes direct remote root login to an internet-reachable host. In the context of deploying an LLM gateway, this is more dangerous because the system likely handles API keys and model traffic, so encouraging root access increases the blast radius of credential theft, host compromise, or operator mistakes.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document instructs operators to write cloud access credentials into `terraform.auto.tfvars.json`, but provides no explicit warning about secret exposure risks beyond noting the file should not be tracked in git. In a deployment skill that handles real AK/SK material, this can lead to credential leakage through local disk exposure, shell history, logs, backups, or accidental sharing of the workspace.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The verification step normalizes exposure of ports 22 and 3000 and checks public HTTP access to the service without any warning about Internet exposure, source restrictions, or hardening. In the context of deploying an LLM gateway on a public EIP, this increases the attack surface and could expose admin interfaces or an inadequately secured service to unauthorized access.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The cleanup instructions direct `terraform destroy` and deletion of the tfvars file without an explicit destructive-action warning or confirmation guard. In infrastructure automation, this can cause unintended deletion of live cloud resources and associated downtime or data loss if run in the wrong workspace or against the wrong state.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes terraform.auto.tfvars.json even when credentials are absent, and it does so without explicit user confirmation before creating or overwriting a file intended to hold secrets. This can silently modify infrastructure configuration, create insecure placeholder secret files, and normalize a workflow where sensitive material is expected on disk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.