huawei-cloud-smn-dms-message

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:10 AM UTC
• Version: 1.0.0

Overview

This skill performs legitimate Huawei Cloud messaging administration, but its install and helper script leave users exposed to unsafe execution and unguarded cloud changes.

Review carefully before installing. Use a dedicated least-privilege Huawei Cloud identity, verify KooCLI through an official signed or checksummed channel instead of running the one-line installer, avoid passing passwords or confirmation tokens on command lines, and do not run R2/R1 helper-script actions unless you have manually reviewed and confirmed the exact operation and target resource.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/smn_dms_skill.py:235
• Finding: State-Changing and Destructive Operations Bypass Documented Confirmation Gates<![CDATA[ ## Vulnerability Details **File Location**: `scripts/smn_dms_skill.py:31-35`, `scripts/smn_dms_skill.py:153-240`, and `scripts/smn_dms_skill.py:294-297` **Vulnerability Type**: Confirmation-control bypass **Risk Level**: High ### Vulnerable Code ```python def run_hcloud(args_list, region, preview=False): cmd = ["hcloud"] + args_list if region: cmd.append("--cli-region=%s" % region) if preview: print("[PREVIEW] " + " ".join(cmd)) return "" ``` Destructive handlers pass the optional flag directly to the execution function: ```python def delete_smn_topic(a): require(a.topic_urn, "topic_urn", sys.argv) print_json(run_hcloud(["SMN", "DeleteTopic", "--topic_urn=%s" % a.topic_urn], a.region, preview=a.preview)) def confirm_smn_subscription(a): require(a.token, "token", sys.argv) args = ["SMN", "ConfirmSubscription", "--token=%s" % a.token] if a.topic_urn: args.append("--topic_urn=%s" % a.topic_urn) if a.endpoint: args.append("--endpoint=%s" % a.endpoint) print_json(run_hcloud(args, a.region, preview=a.preview)) def delete_dms_instance(a): engine = (a.engine or "").lower() require(engine, "engine (kafka|rabbitmq|rocketmq)", sys.argv) validate_engine(engine, sys.argv) service = ENGINE_SERVICE[engine] require(a.instance_id, "instance_id", sys.argv) print_json(run_hcloud([service, "DeleteInstance", "--instance_id=%s" % a.instance_id], a.region, preview=a.preview)) ``` The preview flag is disabled by default: ```python p.add_argument("--preview", action="store_true", help="print the hcloud command without executing it (R2/R1 confirmation)") ``` ### Technical Analysis The documentation states that R2 management operations require command preview and user confirmation, while R1 destructive operations require explicit end-to-end confirmation. The implementation does not enforce either c ...[truncated 1937 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make preview mode the default for every R1 and R2 operation. - Require an explicit execution option such as `--execute` in addition to a one-time approval value. - Bind approval to a cryptographic digest of the exact command, action, region, engine, and target resource so approval cannot be reused for altered parameters. - For R1 operations, display the resource identifier and irreversible impact, then require a second-stage confirmation. - Reject noninteractive destructive execution unless an independently issued approval token is supplied. - Separate read-only and write-capable entry points or execution roles. - Add automated tests verifying that every R1/R2 action fails closed when confirmation is absent. - Use a lower-privilege cloud identity for query actions and grant create or delete permissions only for workflows that require them. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/smn_dms_skill.py:31
• Finding: RabbitMQ Passwords and SMN Confirmation Tokens Are Exposed Through Process Arguments and Preview Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/smn_dms_skill.py:31-35`, `scripts/smn_dms_skill.py:210-212`, `scripts/smn_dms_skill.py:227-233`, and `scripts/smn_dms_skill.py:324-325` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code The preview function prints the complete command without redaction: ```python def run_hcloud(args_list, region, preview=False): cmd = ["hcloud"] + args_list if region: cmd.append("--cli-region=%s" % region) if preview: print("[PREVIEW] " + " ".join(cmd)) return "" ``` RabbitMQ credentials are inserted directly into the command arguments: ```python if engine == "rabbitmq": args.append("--access_user=%s" % a.access_user) args.append("--password=%s" % a.password) ``` SMN confirmation tokens are handled in the same way: ```python def confirm_smn_subscription(a): require(a.token, "token", sys.argv) args = ["SMN", "ConfirmSubscription", "--token=%s" % a.token] if a.topic_urn: args.append("--topic_urn=%s" % a.topic_urn) if a.endpoint: args.append("--endpoint=%s" % a.endpoint) print_json(run_hcloud(args, a.region, preview=a.preview)) ``` The password is accepted as a command-line option: ```python p.add_argument("--access_user", help="RabbitMQ access user") p.add_argument("--password", help="RabbitMQ password") ``` ### Technical Analysis Sensitive values are accepted in the Python process command line and then copied into the `hcloud` child-process argument list. In preview mode, the entire command is printed verbatim. This creates several disclosure channels: - The parent Python invocation can be retained in shell history. - Parent and child process arguments may be visible to local process-inspection tools, depending on operating-system controls. - Preview output exposes the full password or token in terminal transcripts, CI logs, tool output, or conversation records. - Logging wrappe ...[truncated 1501 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never accept passwords or confirmation tokens as ordinary command-line arguments. - Read sensitive values from a protected secret manager, an inherited file descriptor, or an interactive no-echo prompt. - If `hcloud` supports protected environment-based or stdin-based secret input, use that mechanism instead of command arguments. - Redact sensitive options in preview and diagnostic output, for example: - `--password=<redacted>` - `--token=<redacted>` - Maintain an explicit list of sensitive parameter names and apply redaction before all logging and exception handling. - Ensure CI systems mask the relevant secret variables and do not retain plaintext terminal transcripts. - Avoid including sensitive values in approval hashes or messages unless they are transformed with a one-way keyed construction. - Add tests that fail if preview output contains a supplied password or token. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:52
• Finding: Installation Instructions Download and Execute an Unpinned Remote Script Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-55` and `references/cli-installation-guide.md:8-11` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -O https://cn-north-4-hcli.obs.cn-north-4.myhuaweicloud.com/hcli_install.sh && bash hcli_install.sh # verify: hcloud --help should print the KooCLI version banner ``` The installation guide repeats the same pattern: ```bash # Chinese mainland default mirror curl -O https://cn-north-4-hcli.obs.cn-north-4.myhuaweicloud.com/hcli_install.sh && bash hcli_install.sh ``` ### Technical Analysis The instructions retrieve a shell script from an external object-storage URL and execute it immediately after a successful download. HTTPS provides transport protection, but the instructions do not: - Pin an installer version. - Verify a vendor-published cryptographic checksum. - Verify a digital signature. - Inspect or constrain the downloaded script. - Ensure that the remote object remains identical to the artifact reviewed during the Skill audit. The effective installation payload can therefore change after this Skill has been reviewed. If the hosting account, object, distribution path, certificate trust chain, or upstream publication process is compromised, users following the instructions execute attacker-controlled shell code. The endpoint appears to be presented as an official Huawei Cloud source, and the audit found no evidence that its current content is malicious. The vulnerability is the absence of artifact integrity and version controls, not a claim that the named endpoint is currently compromised. ### Attack Path 1. An attacker compromises or replaces the remote installer object, or otherwise causes the URL to serve modified content. 2. A user follows the documented prerequisite instructions. 3. `curl` downloads the modified object as `hcli_install.sh`. 4. Because the command only checks whether the download opera ...[truncated 801 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin installation instructions to a specific KooCLI release and immutable artifact URL. - Publish and verify a SHA-256 or stronger checksum obtained through an independently authenticated vendor channel. - Prefer a digitally signed package and verify its signature against a pinned vendor signing key. - Separate download, verification, and execution into distinct commands. - Abort installation if checksum or signature validation fails. - Avoid executing the installer with elevated privileges unless explicitly required and reviewed. - Document the expected artifact filename, version, checksum, signer identity, and verification commands. - Where possible, use a trusted operating-system package repository with signed metadata instead of a mutable shell installer. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

External Script Fetching

High

• Category: Supply Chain

Content

Install and configure the Huawei Cloud KooCLI:

```bash
curl -O https://cn-north-4-hcli.obs.cn-north-4.myhuaweicloud.com/hcli_install.sh && bash hcli_install.sh
# verify: hcloud --help should print the KooCLI version banner
```

• Confidence: 98% confidence
• Finding: The skill instructs users to download a remote installer script with curl and execute it directly with bash, without integrity verification, signature checking, or pinning to a trusted package source. If the hosting location, transport path, or script content is compromised, this becomes a straightforward remote code execution path on the machine preparing the cloud-management environment.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Chinese mainland default mirror
curl -O https://cn-north-4-hcli.obs.cn-north-4.myhuaweicloud.com/hcli_install.sh && bash hcli_install.sh

# Verify
hcloud -v

• Confidence: 96% confidence
• Finding: The guide instructs users to download a shell script from the network and execute it immediately with `bash` without any integrity verification, signature check, or pinned checksum. If the hosting location, CDN path, TLS trust chain, or distribution artifact is compromised, users could execute arbitrary code on their workstation with the privileges of the invoking user.

Instruction Override

High

• Category: Prompt Injection

Content

```

`scripts/smn_dms_skill.py` runs `subprocess.run` with an **argument list** (no `shell=True`) — safe.
Prompt-injection markers (`ignore previous instructions`, `SYSTEM:`, etc.) must be absent.

## Gate 3 — Dependency security

• Confidence: 80% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill explicitly instructs use of shell commands and environment-based authentication, but it does not declare any tool scope such as allowed-tools or permissions. That mismatch weakens sandboxing and review controls, because a runtime may grant broader shell/env access than the skill minimally needs, increasing the blast radius if the skill is misused or prompt-injected.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad generic terms like "topic," "subscribe," "notification," and "instance," which can cause the skill to activate in unrelated contexts. Unintended activation is risky here because the skill has shell-backed cloud-management capabilities, including resource creation, deletion, and message publishing, so even benign user conversations could be routed into sensitive workflows.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Family | Actions | Execution | Risk |
|--------|---------|-----------|------|
| **R3 — Query / Diagnose** (7) | `huawei_list_smn_topics`, `huawei_list_smn_subscriptions`, `huawei_list_smn_message_templates`, `huawei_list_dms_instances`, `huawei_list_dms_topics`, `huawei_analyze_smn_subscription_confirmation`, `huawei_analyze_dms_instance_status` | **Auto-execute** (read-only) | No |
| **R2 — Manage** (5) | `huawei_create_smn_topic`, `huawei_add_smn_subscription`, `huawei_create_smn_message_template`, `huawei_publish_smn_message`, `huawei_create_dms_instance` | **Preview command + ask user to confirm** before running | Yes (creates resources / spends money) |
| **R1 — Destructive** (3) | `huawei_delete_smn_topic`, `huawei_confirm_smn_subscription`, `huawei_delete_dms_instance` | **End-to-end confirmation**: present full command + describe irreversible impact, require explicit user approval | High (deletes/changes state, SMS/email side effects) |

• Confidence: 91% confidence
• Finding: The risk model explicitly permits auto-execution of an entire family of cloud query and diagnostic actions. In a cloud-management skill, even read-only autonomy is security-relevant because it can reveal inventory, endpoint details, confirmation state, and service health without a deliberate user authorization step.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- R3 query/diagnose → run immediately, summarize results.
   - R2 manage → build the exact `hcloud` command, show it to the user, and wait for confirmation before executing.
   - R1 destructive → show the exact command with its impact (what will be deleted / which endpoint will receive a confirmation), require explicit end-to-end confirmation, then execute.
4. **Interpret output** — SMN commands return JSON; subscription `status` field: `0`=unconfirmed, `1`=confirmed, `2`=no confirmation required, `3`=cancelled, `4`=deleted. DMS `status` values include `RUNNING` (healthy) and `CREATING`/`ERROR`/`DELETING`/`FROZEN`/`EXTENDING` etc.
5. **Report** — summarize created/updated/removed resources, and confirm no output contains credentials.

## Core Commands

• Confidence: 84% confidence
• Finding: The workflow authorizes the agent to run query and diagnostic commands immediately without user confirmation. Although labeled read-only, these commands still access potentially sensitive cloud metadata such as subscriptions, endpoints, instance states, and topology details, so autonomous execution can disclose information or perform unintended reconnaissance in the wrong context.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

> **Always run `hcloud <Service> <Operation> --help` first** to re-confirm parameter names before constructing a command, especially for create operations.

### R3 — Query (auto-execute)

#### huawei_list_smn_topics — List SMN topics

• Confidence: 85% confidence
• Finding: This section reinforces the auto-execute behavior for R3 queries, normalizing unsupervised command execution against live cloud services. The surrounding skill context makes this more dangerous because the commands interact with authenticated Huawei Cloud resources and may expose sensitive operational metadata even when they do not modify state.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `--instance_id` | Yes | Kafka instance ID (from `huawei_list_dms_instances`) |
| `--cli-region` | Yes (auto) | Region |

### R3 — Diagnose (auto-execute)

#### huawei_analyze_smn_subscription_confirmation — Subscription confirmation status analysis

• Confidence: 85% confidence
• Finding: The diagnose section also permits autonomous execution, which can be used to enumerate subscription confirmation status and instance health. In practice, these diagnostics can disclose internal service posture and endpoints, enabling reconnaissance or privacy leakage if triggered unintentionally or by adversarial prompting.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Sub[Subscription confirmation analysis] --> LSub[engine SMN ListSubscriptions]
    LSub --> s0{status == 0?}
    s0 -->|yes| need[Needs confirmation: ping-back / email click]
    s0 -->|no| doneok[Confirmed / no confirmation required]
```

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

|--------|---------|---------------|
| 0 | Not confirmed | HTTP/HTTPS endpoint ping-back or email click-link |
| 1 | Confirmed | None |
| 2 | No confirmation required | None |
| 3 | Cancelled | Re-add if still needed |
| 4 | Deleted | Re-add if still needed |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("[PREVIEW] " + " ".join(cmd))
        return ""
    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
    except subprocess.TimeoutExpired:
        raise RuntimeError("hcloud 命令超时")
    if proc.returncode != 0:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The RabbitMQ password is passed as a command-line argument, which can expose the secret through process listings, audit logs, shell history wrappers, or orchestration telemetry. In a cloud-management skill, credentials are highly sensitive and this pattern increases the chance of accidental secret disclosure to local users or monitoring systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Delete operations for SMN topics and DMS instances execute immediately unless the caller independently chooses preview mode; there is no built-in confirmation gate or explicit destructive warning. In this skill's context, these actions can remove messaging infrastructure and cause outages, message loss, and service disruption if triggered by mistake or through unsafe agent behavior.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _has_hcloud_profile():
    try:
        out = subprocess.run(["hcloud", "configure", "list", "--cli-output=json"],
                             capture_output=True, text=True, timeout=60).stdout
    except Exception:
        out = ""

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ValueError:
            pass
    try:
        out = subprocess.run(["hcloud", "configure", "list"],
                             capture_output=True, text=True, timeout=60).stdout
        return "default" in out
    except Exception:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: This file contains user-facing output such as `hcloud 命令超时` and `未知 engine` in Chinese while other help and messages are in English. Because the skill does not offer a language choice or document a justified locale constraint, it effectively imposes a mixed language experience that may violate language/locale policy expectations.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

def list_smn_subscriptions(a):
    args = ["SMN", "ListSubscriptions"]
    for opt in ("protocol", "status", "endpoint", "limit", "offset"):
        v = getattr(a, opt)
        if v:
            args.append("--%s=%s" % (opt, v))
    print_json(run_hcloud(args, a.region))

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

def list_smn_subscriptions(a):
    args = ["SMN", "ListSubscriptions"]
    for opt in ("protocol", "status", "endpoint", "limit", "offset"):
        v = getattr(a, opt)
        if v:
            args.append("--%s=%s" % (opt, v))
    print_json(run_hcloud(args, a.region))

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

def list_smn_subscriptions(a):
    args = ["SMN", "ListSubscriptions"]
    for opt in ("protocol", "status", "endpoint", "limit", "offset"):
        v = getattr(a, opt)
        if v:
            args.append("--%s=%s" % (opt, v))
    print_json(run_hcloud(args, a.region))

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

def list_smn_subscriptions(a):
    args = ["SMN", "ListSubscriptions"]
    for opt in ("protocol", "status", "endpoint", "limit", "offset"):
        v = getattr(a, opt)
        if v:
            args.append("--%s=%s" % (opt, v))
    print_json(run_hcloud(args, a.region))

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

def list_smn_subscriptions(a):
    args = ["SMN", "ListSubscriptions"]
    for opt in ("protocol", "status", "endpoint", "limit", "offset"):
        v = getattr(a, opt)
        if v:
            args.append("--%s=%s" % (opt, v))
    print_json(run_hcloud(args, a.region))

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/security-audit-guide.md:30