huawei-cloud-sac-yolo

• Outcome: Review
• Latest audit: Aug 22, 2026 · 2:33 PM UTC
• Version: 1.0.1

Overview

This skill is coherent for Huawei Cloud YOLO deployment, but it needs Review because it asks for broad cloud admin authority and persists cloud access keys in a local Terraform variables file.

Review this before installing if the Huawei Cloud account is valuable or shared. Use a least-privilege IAM user or custom policy instead of Tenant Administrator where possible, avoid long-lived AK/SK, keep terraform.auto.tfvars.json out of version control, restrict its file permissions, delete or rotate credentials after deployment, verify Terraform downloads, and require a reviewed terraform plan before apply or destroy.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs use of environment variables, local file reads/writes, network downloads, and shell execution, yet no permissions are declared. This creates a transparency and policy-enforcement gap: an agent or reviewer may underestimate the skill's ability to access credentials, modify Terraform files, and invoke deployment commands against cloud resources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill's description frames it as a straightforward YOLO deployment helper, but the workflow also performs scraping, arbitrary remote template download, Terraform normalization, credential injection into tfvars, and local file mutation. That mismatch is dangerous because users may consent to deployment help without realizing the skill can fetch untrusted infrastructure code and materialize cloud credentials into disk files.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The document instructs users to grant the rf_admin_trust agency the Tenant Administrator policy with authorization scope set to All resources, which is far broader than the ECS/VPC/EVS/RFS permissions otherwise described for YOLO deployment. If followed, the deployment path gains effectively account-wide administrative capability through RFS, greatly increasing blast radius in the event of stack misuse, compromise, or operator error.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script writes Huawei Cloud access credentials into terraform.auto.tfvars.json on disk, which creates a persistent plaintext secret file. Even if intended for deployment convenience, this expands secret exposure through accidental commit, backup capture, local compromise, or broader file access than environment-scoped credentials.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code reads secrets from environment variables and immediately serializes them into a local tfvars file, converting ephemeral process-scoped secrets into durable plaintext storage. That behavior is not strictly necessary for normal Terraform execution and increases the blast radius of any credential leakage.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This file adds Playwright browser automation utilities that are unrelated to the declared Huawei Cloud/Terraform YOLO deployment purpose. In a skill meant for infrastructure deployment, unrelated browser-control code is suspicious because it creates hidden capability for web interaction and data access outside the expected trust boundary.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code exposes subprocess-based execution of playwright-cli and a run_pw_code helper that can execute arbitrary JavaScript via Playwright. In the context of a YOLO deployment skill, this is unjustified remote-capability expansion that could be used to automate browsing, access authenticated web sessions, scrape sensitive data, or perform unintended actions on behalf of the user.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide instructs users to unzip Terraform directly into /usr/local/bin, which is a system-wide location that typically requires elevated privileges and modifies the execution path for all users. Without any warning about privilege requirements, trust in the download source, or rollback steps, users may run the command with sudo and make persistent system changes they do not fully understand.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The Windows instructions expand the Terraform archive into %SystemRoot%\system32, a protected directory with broad system impact and high trust. Telling users to place a downloaded executable there without warning about administrator access, path implications, or safer alternatives increases the risk of unintended privileged modification and persistence of a potentially tampered binary.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The markdown directs users to assign a highly privileged administrative policy without any clear security warning, risk acknowledgment, or least-privilege alternative. In the context of a deployment skill, users may treat the instructions as routine setup and unknowingly create persistent excessive privileges that extend far beyond the YOLO training environment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document lists destructive Terraform lifecycle commands such as apply and destroy without any caution about irreversible infrastructure changes, service disruption, or cost impact. In an agent skill context, concise command references may be copied and executed directly, increasing the chance of accidental destructive actions by operators or automation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: State manipulation commands like taint, untaint, refresh-only apply, and import can desynchronize expectations, trigger unexpected resource replacement, or corrupt operational workflows if used incorrectly. Because this skill is for infrastructure deployment, users are likely to treat these as routine commands unless warned that state operations are high-sensitivity maintenance actions.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Documenting direct root SSH access without any security warning normalizes the use of the highest-privilege account and may encourage insecure operational habits. In a GPU training platform exposed via public EIP, this increases risk if users rely on broad root access instead of least-privilege administration and hardened access controls.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The verification guidance explicitly expects cloud access credentials to be written into a local `terraform.auto.tfvars.json` file, but it does not include safeguards such as secure storage requirements, file permission restrictions, cleanup steps, or warnings about credential exposure. In an infrastructure-deployment skill handling AK/SK secrets, normalizing local plaintext credential storage without protective guidance increases the chance of accidental leakage through backups, shared workspaces, shell history, artifact collection, or later misuse.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.