Security audit

huawei-cloud-swr-image-management

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for managing Huawei Cloud SWR, but it instructs the agent to handle and relay live registry login secrets in chat.

Install only if you are comfortable with a skill that can manage and delete SWR resources and retrieve registry login credentials. Prefer temporary tokens, avoid pasting or displaying decoded credentials in chat, use least-privilege IAM permissions, verify destructive targets carefully, and inspect any remote installer before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill says the agent must not decode Docker auth tokens, but it also instructs the agent to extract the `auth` value and hand the user a workflow that decodes it into `username:password`. That creates a clear secret-disclosure path for a reusable registry credential and normalizes handling raw credentials in chat, which increases the chance of accidental leakage through logs, transcripts, or prompt injection.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: This section repeats the same unsafe pattern in the unsupported-operations workflow: it says the agent must not decode the token, but then instructs the agent to provide the `auth` field to the user and shows how to decode it. Even if the agent does not decode it itself, relaying a live secret still exposes sensitive credentials through the conversational channel.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The guidance states that deleting a tag 'permanently removes the image version' and is irreversible, but the same document also notes that other tags referencing the same digest are unaffected. In container registries, deleting a tag typically removes a reference, not necessarily the underlying image content if other tags still point to it; this misinformation can cause operators to misunderstand retention, cleanup, rollback, and incident response behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide instructs users to download and immediately execute a remote shell script, including a non-interactive '-y' mode that suppresses review and confirmation. This creates a supply-chain and remote-code-execution risk if the hosted script is tampered with, the distribution endpoint is compromised, or users run it without inspection; in an installation guide for a cloud-management CLI, that risk is amplified because the same environment may later hold cloud credentials.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The documentation explicitly instructs consumers to decode a base64-encoded `auth` value into usable Docker login credentials, but provides no safety framing, consent check, or warning about handling secrets. In a skill focused on container registry management, this can normalize unnecessary credential exposure in logs, outputs, or downstream processing, increasing the risk of secret leakage.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide instructs users to decode the SWR auth token and pass the resulting username and password directly to `docker login -p` on the command line. This can expose credentials through shell history, process listings, audit logs, terminal recording, or CI job logs, which is especially sensitive because the same section also documents long-lived authentication material for registry access.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document recommends deleting namespaces and tags as part of quota cleanup, but it does not provide a clear warning/confirmation procedure at the point of use beyond a brief inline caution. In an operational skill that may be followed directly by an agent or user, this increases the chance of accidental destructive actions causing repository or image loss.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document instructs operators to retrieve a long-term SWR login secret using `hcloud SWR CreateSecret` but does not warn that the output is a persistent credential that must be treated as highly sensitive. In a verification guide, this omission can lead to secrets being displayed in terminals, logs, transcripts, screenshots, or automation output, increasing the risk of credential leakage and unauthorized registry access.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill explicitly tells the agent to extract and present a reusable Docker auth credential from the API response, then provides a command to decode it into a username and password. This is a direct secret-handling anti-pattern: registry credentials can be replayed to access private images, and exposing them in agent output risks compromise via chat history, logs, or unauthorized observers.

Ssd 3

Medium

Confidence: 95% confidence
Finding: This repeated workflow creates another explicit channel for secret disclosure by telling the agent to provide the auth token to the user. Repetition increases the likelihood that downstream implementations will treat credential exfiltration as intended behavior, undermining the otherwise stated rule against decoding and making leakage more likely in practice.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/task-auth-management.md:83