huawei-cloud-skill-creator

• Outcome: Review
• Latest audit: Aug 27, 2026 · 1:45 PM UTC
• Version: 1.0.2

Overview

This Huawei Cloud skill creator is not clearly malicious, but it needs Review because its test workflow can run live cloud, API, and shell commands with credential-backed authority and weak enforcement.

Install only after careful review. Use an isolated Huawei Cloud test project, least-privilege and preferably short-lived credentials, and never paste AK/SK into chat. Review generated templates/test-vars.json before running tests, avoid production accounts, and treat any scanner-ignore or gitleaks-ignore use as requiring explicit security approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill explicitly instructs the agent to use shell commands and inspect environment-based credential state, but it does not declare corresponding permissions. Undeclared shell/env capabilities weaken reviewability and policy enforcement because operators may trust the manifest while the skill still drives command execution and credential-sensitive flows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: The manifest describes a tightly controlled six-phase skill creator, but the analyzed content does not substantiate actual enforcement or implementation of those claims. Security-relevant description/behavior mismatch is dangerous because users and reviewers may rely on promised guardrails, validation, and cleanup that are not actually guaranteed.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The verification guidance explicitly allows prompting the user for Huawei AK/SK credentials even though this file is for a skill creator/scaffolding workflow, not a credential-management or deployment tool. Encouraging collection of long-lived cloud credentials increases the risk of unnecessary secret exposure, accidental logging, reuse in unsafe contexts, or misuse by later phases/scripts.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The header claims mutation operations only receive a --help syntax check, but the implementation later executes test-case commands from JSON whenever they match a loose allowlist. That mismatch is dangerous because users may trust the documentation and run the script against skills containing create/update/delete operations that execute live against cloud resources.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The trigger set includes very broad phrases like 'create skill', 'new skill', and similar everyday requests, which can cause accidental invocation outside the intended Huawei Cloud context. Because this skill can lead to shell execution, environment inspection, and test orchestration, unintended activation materially increases the attack surface for prompt-trigger abuse and context hijacking.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The resource lifecycle test includes destructive actions ("Destroy") but provides no explicit warning, confirmation gate, or scope limitation. In a cloud context, this can lead to accidental deletion of live resources, service disruption, or unexpected charges if users run the verification procedure against non-test environments.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The API fallback example instructs use of curl against a user-provided endpoint without any warning about data exfiltration, SSRF-like behavior, or accidental transmission of authentication headers and request payloads to untrusted destinations. In this skill context, fallback logic makes such requests seem routine, which increases the chance that operators send sensitive cloud metadata or credentials to hostile endpoints.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script executes commands from templates/test-vars.json via bash -c without an interactive confirmation step or clear warning that test data can trigger local command execution and cloud-side actions. In this skill context, test case content is effectively untrusted input because the skill scaffolds and consumes generated artifacts, making accidental or adversarial command execution plausible.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: In API mode the script runs curl commands directly, causing immediate outbound network requests without an explicit warning that data, tokens, or signed requests may be transmitted. Since this tool is for cloud skill creation and testing, users may run generated test cases against real Huawei Cloud endpoints and unintentionally perform live operations.

Hidden Instructions

High

• Category: Prompt Injection

Content

| BSS service SDK initialization fails (GlobalCredentials) | BSS is global and must use `GlobalCredentials` with `with_endpoints`, not `BasicCredentials` with `with_region` |
| list_sub_customer_coupons query returns 400 | BSS limit parameter maximum is 100, not the default 200 |
| Phase 6 security audit FAIL | Fix issues from the audit report, then have the Agent rerun the audit until it passes |
| skill-scanner false positive | Use `<!-- skill-scanner:ignore -->` comment annotation, or exclude in .secrets.baseline |
| gitleaks false positive | Add to `.gitleaksignore` file |

## Verification Method

• Confidence: 91% confidence
• Finding: The skill recommends using scanner-ignore annotations and ignore files to suppress findings, which can be used to conceal real security issues from automated review. In a security-audited skill that handles shell commands and credential-adjacent workflows, embedded guidance for bypassing scanners is especially risky because it normalizes weakening detection controls.

Hidden Instructions

High

• Category: Prompt Injection

Content

| 类别 | 修复 |
|------|------|
| command_injection | 将危险命令移至 scripts/ 独立脚本，SKILL.md 中引用脚本路径 |
| reverse_shell | 移除或使用 `<!-- skill-scanner:ignore -->` 注释 |
| credential_leak | 替换硬编码密钥为 `${VAR}` 或 `os.environ.get("VAR")` |
| dangerous_function | 用 ast.literal_eval() 替代 eval()/exec()，添加输入验证 |
| prompt_injection | 审查并清理用户可控输入，使用结构化输入模板 |

• Confidence: 91% confidence
• Finding: The document explicitly recommends suppressing reverse-shell findings with a `<!-- skill-scanner:ignore -->` comment, which creates a mechanism to hide dangerous content from automated scanning rather than removing it. In a skill-creation and audit context, this is more dangerous because it normalizes bypassing a security control in the very phase meant to enforce security review.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: huawei-cloud-skill-creator
version: 2.1.3
description: |
  1. Six-phase pipeline for creating Huawei Cloud skills — Socratic requirements gathering, CLI→SDK→API research, MD generation, test preparation, detailed testing, and final cleanup & compliance check
  2. Phase-chained dependency: each phase builds on the previous phase's output, no phase may be skipped
  3. Supports CLI, SDK, and REST API execution modes with automatic fallback detection

• Confidence: 72% confidence
• Finding: The manifest contains multiple metadata-poisoning indicators flagged by the rule set, including descriptive content that shapes agent behavior and an embedded scanner-ignore pattern elsewhere in the file. In context, this increases risk that the skill manifest is being used not just as metadata but as a vehicle to steer tooling and reduce scrutiny, which is dangerous in agent ecosystems.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.