huawei-cloud-skill-creator

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:56 PM UTC
• Version: 1.0.0

Overview

This Huawei Cloud skill creator fits its stated purpose, but it should be reviewed carefully because it handles cloud secrets and can run broad local and live cloud commands.

Install only if you are comfortable giving the agent access to Huawei Cloud tooling and test execution. Do not paste AK/SK secrets into chat; configure credentials locally with least-privilege, preferably temporary credentials. Review and restrict templates/test-vars.json before running tests, avoid running generated bash commands from untrusted skill directories, and remove unnecessary IAM permissions and scanner-suppression guidance before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares capabilities that involve shell execution and environment access, but does not explicitly declare or constrain permissions. In this context, the skill also instructs scanning environment variables for Huawei AK/SK credentials and running shell commands, which increases the risk of overbroad secret access and command execution without adequate transparency or least-privilege controls.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documented 'required' IAM policy includes billing coupon permissions that are unrelated to the stated functions of querying service availability and running test commands. In a skill-creation tool, overbroad or irrelevant permissions normalize unnecessary access and can lead operators to grant access to billing data that the tool does not need, violating least-privilege and expanding blast radius.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The permissions listed do not align with the described operations of the Skill Creator, which claims to query service availability and execute tests but documents IAM actions for credentials listing and billing coupon access. This mismatch is dangerous because users may grant sensitive permissions based on misleading documentation, creating unnecessary access to credential metadata or billing-related resources.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The header comment promises mutation operations only receive a harmless help/syntax check, but the implementation does not enforce that policy. Test cases from templates/test-vars.json can still drive real command execution paths, including non-hcloud commands via bash -c, creating a mismatch that can lead operators to run destructive tests under false assumptions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The allowlist explicitly permits commands beginning with bash, and later code executes test-case command strings with bash -c. Because test cases are data-driven from a skill directory, an attacker who can influence templates/test-vars.json can execute arbitrary shell code on the analyst's machine, far beyond the stated needs of a test helper.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script locates and executes a Python program from several filesystem locations, including a user-writable home-directory path, without verifying its integrity or trustworthiness. An attacker who can place or replace skill_audit.py in one of those searched locations could achieve arbitrary code execution whenever the validator is run.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list contains very broad phrases like 'create skill', 'new skill', and similar generic wording that can match ordinary conversation and cause accidental activation. Because this skill then moves into credential discovery, shell usage, file generation, and test execution workflows, unintended invocation meaningfully raises the risk of unsafe actions being proposed or initiated in the wrong context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs automatic scanning of environment variables for Huawei credential patterns without a clear user-facing warning or consent boundary. In a skill that already has env and shell capabilities, this creates a real secret-handling risk because sensitive credentials may be accessed or processed implicitly, contrary to least surprise and privacy expectations.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The workflow tells the agent to ask the user for AK/SK credentials if none are found, but provides no safe handling guidance. Soliciting cloud credentials in chat normalizes direct secret disclosure, increases phishing-style risk, and can lead to storage of long-lived secrets in logs, transcripts, or model context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs users to fall back to raw curl requests against a user-provided endpoint and to source AK/SK credentials from environment variables or interactive input, but it does not include safeguards such as endpoint validation, HTTPS requirements, redaction guidance, or warnings about sending sensitive credentials over untrusted destinations. In a skill-creation context, this can normalize insecure verification practices and increase the chance that operators expose cloud credentials or transmit requests to malicious or incorrect endpoints.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The template hard-codes the default region to "cn-north-4", which can steer generated tests and API calls toward a China region without explicit user choice or consent. In a skill creator context, this increases the chance of unintentional data handling in a different legal/jurisdictional environment and can cause operators to run validation against the wrong cloud region.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This instruction explicitly requires collecting AK/SK from the user when environment variables are absent. That is dangerous because it encourages transmission of raw cloud secrets through the conversational channel, where they may be retained in logs or mishandled, and it teaches an unsafe operational pattern for privileged credentials.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The repeated guidance reinforces a behavior of asking users to provide AK/SK directly, making unsafe secret-sharing a normative part of the workflow. Repetition increases the chance operators will comply and disclose high-value cloud credentials that could enable account compromise if exposed.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The notes section again directs the agent to obtain missing credentials from the user rather than refusing secret collection. In this skill's context, those credentials would likely be used for live cloud operations, so disclosure could permit unauthorized access, billing abuse, or destructive actions in the user's Huawei Cloud environment.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Embedding conversational secret collection as a design principle institutionalizes insecure handling of privileged credentials. This is especially dangerous in a skill centered on cloud administration, because AK/SK can grant broad API access and may be reused across multiple operations once exposed.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

svc_module = __import__('huaweicloudsdk' + svc_lower + '.v1', fromlist=[svc + 'Client'])
    Client = getattr(svc_module, svc + 'Client')
    ak, sk = '', ''
    for k, v in os.environ.items():
        u = k.upper()
        if not (u.startswith('HUAWEI') or u.startswith('HW') or u.startswith('HWC')): continue
        if 'ACCESS_KEY' in u or u.endswith('_AK') or u == 'AK': ak = v or ak

• Confidence: 84% confidence
• Finding: for k, v in os.environ.items()

Hidden Instructions

High

• Category: Prompt Injection

Content

| BSS service SDK initialization fails (GlobalCredentials) | See `references/bss-sdk-notes.md`: BSS must use GlobalCredentials + with_endpoints, not BasicCredentials + with_region |
| list_sub_customer_coupons query returns 400 | BSS limit parameter maximum is 100, not the default 200 |
| Phase 6 security audit FAIL | Fix issues item by item per skill-gate-report Section 4, rerun skill_audit.py after fixing |
| skill-scanner false positive | Use `<!-- skill-scanner:ignore -->` comment annotation, or exclude in .secrets.baseline |
| gitleaks false positive | Add to `.gitleaksignore` file |

---

• Confidence: 93% confidence
• Finding: <!-- skill-scanner:ignore -->

Hidden Instructions

High

• Category: Prompt Injection

Content

| 类别 | 修复 |
|------|------|
| command_injection | 将危险命令移至 scripts/ 独立脚本，SKILL.md 中引用脚本路径 |
| reverse_shell | 移除或使用 `<!-- skill-scanner:ignore -->` 注释 |
| credential_leak | 替换硬编码密钥为 `${VAR}` 或 `os.environ.get("VAR")` |
| dangerous_function | 用 ast.literal_eval() 替代 eval()/exec()，添加输入验证 |
| prompt_injection | 审查并清理用户可控输入，使用结构化输入模板 |

• Confidence: 92% confidence
• Finding: <!-- skill-scanner:ignore -->

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: huawei-cloud-skill-creator
version: 2.1.3
description: |
  1. Six-phase pipeline for creating Huawei Cloud skills — Socratic requirements gathering, CLI→SDK→API research, MD generation, test preparation, detailed testing, and final cleanup & compliance check
  2. Phase-chained dependency: each phase builds on the previous phase's output, no phase may be skipped
  3. Supports CLI, SDK, and REST API execution modes with automatic fallback detection

• Confidence: 76% confidence
• Finding: description:; <!-- skill-scanner:ignore -->

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.