huawei-cloud-swr-enterprise-instance

• Outcome: Review
• Latest audit: Aug 26, 2026 · 10:06 AM UTC
• Version: 1.0.3

Overview

This appears to be a legitimate Huawei Cloud SWR management skill, but its broad cloud authority and uneven safety guidance around secrets, public access, and destructive actions warrant Review before installation.

Install only if you intend to let the agent administer Huawei Cloud SWR enterprise resources. Use least-privilege IAM, prefer temporary credentials where possible, avoid passing real secrets in CLI arguments or chat, and require explicit confirmation for paid creation, deletion, public access, anonymous access, and credential issuance. Review the Python helper's SDK/IAM behavior and avoid the uninstall cleanup command unless you are prepared to remove local hcloud credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs users to export cloud credentials through environment variables and explicitly relies on those secrets for operation, but the metadata declares no permissions/capabilities. This creates a trust and transparency gap: an agent or reviewer may underestimate the skill's ability to access sensitive credentials, increasing the risk of unintended secret exposure, misuse, or execution in contexts that would otherwise require approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior claims broad SWR enterprise management via hcloud CLI, but the analysis indicates the implementation actually uses the Huawei Cloud Python SDK, auto-discovers project IDs through IAM API access, and omits many advertised operations. This mismatch is security-relevant because hidden IAM calls and undeclared capabilities can expand privilege use and break user expectations about what will be executed, making review, approval, and least-privilege enforcement harder.

Description-Behavior Mismatch

Medium

• Confidence: 78% confidence
• Finding: The skill introduces an audit-log capability that is not clearly reflected in the earlier scope declarations. Undeclared security-relevant functionality is dangerous because audit logs may contain sensitive operational metadata, and users or policy engines may not realize the skill can access or enumerate this information.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The documentation exposes a destructive `DeleteInstanceJob` operation even though the skill metadata says job functionality is limited to checking instance statistics and job status. This scope mismatch can cause an agent or user to invoke an undocumented destructive action, undermining least-privilege expectations and potentially deleting audit or operational records that may be needed for troubleshooting or governance.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document explicitly states earlier that `hcloud SWR CreateInstance` is known to be broken due to a duplicate `--project_id` bug and instructs users to use a Python SDK helper instead, but the verification checklist later tells users to run the broken CLI command. In a verification workflow, users often follow the checklist mechanically, so this contradiction can cause failed provisioning, confusion during validation, and unsafe troubleshooting or ad hoc workarounds in a cloud environment where resource creation may incur cost.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The uninstall section instructs users to delete both the CLI binary and the entire ~/.hcloud directory, which likely contains credentials, configuration, and usage state, but it does not explicitly warn that this removes authentication material and local settings. This can cause unintended credential loss, operational disruption, or accidental deletion of data a user expected to preserve.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The credential commands are documented as routine operations without warning that they may generate, return, or enable sensitive long-term or temporary access credentials. In a copy-paste workflow, users may create secrets and expose them in terminal history, logs, screenshots, or agent transcripts, increasing the risk of credential leakage and unauthorized registry access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The registry examples inline access keys, secrets, usernames, and passwords directly in command arguments without any safety warning. Supplying secrets on the command line commonly exposes them through shell history, process listings, CI logs, and agent/tool telemetry, which can lead to compromise of external registries or synchronized container supply chains.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document enumerates powerful write permissions including deletion, credential creation, endpoint exposure, and domain/certificate updates, but it does not prominently warn users about the sensitivity and blast radius of granting the full policy. In this skill context, that increases the chance of over-privileged deployment or unsafe troubleshooting guidance, especially because the documented failure-handling flow tells users to grant permissions and retry.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to supply registry credentials, including an access secret/password, but provides no warning about secure handling, storage, redaction, or avoiding shell history/process-list exposure. In an infrastructure-management skill, this omission increases the chance users will paste long-lived secrets directly into commands or logs, leading to credential leakage and unauthorized registry access.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The parameter reference documents `--insecure` with `true` meaning certificate verification is skipped, but does not warn that this disables TLS authenticity checks. In a registry synchronization context, that can enable man-in-the-middle interception, credential theft, or syncing images from a spoofed registry, making the skill materially more dangerous.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide instructs users to create long-term and temporary credentials without warning that returned secrets may be shown once, need secure storage, and must never be logged or echoed. In an agent setting, omission of these precautions increases the chance of credential exposure in chat transcripts, terminal history, or automation logs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Documenting `anonymous_access=true` without a prominent warning can lead users to expose registry contents or unauthenticated pulls unintentionally. In a cloud registry context, anonymous access weakens access control and may disclose images, metadata, or facilitate wider distribution of sensitive artifacts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide describes enabling public access and fully replacing IP whitelists without emphasizing the risk of exposing the registry to the internet or accidentally removing legitimate admin access. In operational use, this can cause unintended external reachability or self-lockout, especially when an agent performs changes non-interactively.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The public-access enable/disable workflows provide operational steps but do not explicitly warn that enabling public access exposes the registry to external networks and that disabling it can interrupt external image pull/push traffic. In an infrastructure-management skill, this omission can cause users to make security-sensitive changes without understanding the exposure or availability consequences, especially since the same file also includes an example allowing 0.0.0.0/0.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The examples place registry usernames and passwords directly in CLI arguments, which can leak via shell history, terminal logging, audit tooling, CI logs, and process-list inspection by other local users. In an enterprise registry-management skill, these secrets can grant access to image replication targets and private container content, making the documentation pattern meaningfully risky rather than merely theoretical.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The update examples again instruct users to pass fresh credentials and secrets on the command line without any caution, repeating the same exposure channel during credential rotation. This is especially dangerous because rotated secrets are often highly privileged and users may assume an update workflow is routine and safe, increasing the chance of accidental disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cross-instance replication scenario includes credentials in command-line arguments, which can expose secrets during a high-value administrative workflow involving two registry environments. Because this scenario connects enterprise instances and replication targets, leaked credentials could enable unauthorized access to private images, replication configuration abuse, or broader supply-chain impact.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Including a known-broken instance creation command in the checklist without any warning undermines the safety and reliability of the skill's verification path. Because this skill manages live Huawei Cloud SWR enterprise resources, operators may waste time, misdiagnose credential or platform issues, or attempt risky manual substitutions while working with privileged cloud access and billable operations.

Credential Access

High

• Category: Privilege Escalation

Content

- Manage instance namespaces with security scanning and vulnerability blocking
- Configure instance registries for cross-instance image sync
- Query and manage instance repositories and artifacts
- Obtain instance access credentials (long-term and temporary)
- Configure instance network access (internal VPC endpoints, public access with whitelist)
- Manage custom domains for instance access
- Monitor instance statistics and job status

• Confidence: 88% confidence
• Finding: The skill includes creation and handling of long-term and temporary instance credentials, as well as registry authentication material. In this context, credential operations are inherently high risk because they can grant registry access, enable replication into other registries, or expose secrets if mishandled, logged, or returned to untrusted contexts.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.