Security audit

huawei-cloud-terraform-installer

Security checks across malware telemetry and agentic risk

Overview

The skill is a real Terraform installer, but it makes broad persistent system changes, runs Terraform automatically, can delete user configuration, and publishes test-machine root credentials.

Review carefully before installing. Run it only in a controlled environment, prefer non-root/user-local installation, back up any existing terraformrc and .terraform.d provider data, avoid the uninstall option unless you accept deletion of Terraform config/provider files, and treat the published root password as compromised.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (19)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: try: # 运行 terraform init result = subprocess.run( ["terraform", "init"], cwd=test_dir, capture_output=True,
Confidence: 90% confidence
Finding: The script executes `terraform init` as part of a provider test, which goes beyond a local installer and can trigger network access, plugin resolution, and execution of whatever `terraform` binary is first on PATH. In an agent/automation context, invoking external tooling during installation materially increases risk because a trojaned Terraform binary or manipulated PATH could cause arbitrary code execution or unintended cloud-facing actions.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: # 也检查系统 PATH try: if system_info["is_windows"]: result = subprocess.run( ["where", "terraform"], capture_output=True, text=True,
Confidence: 96% confidence
Finding: On Windows, the script uses `subprocess.run(["where", "terraform"], shell=True)`, which unnecessarily invokes the shell. Using `shell=True` for command discovery increases exposure to PATH/COMSPEC manipulation and command-resolution hijacking, especially in agent environments where the execution context may be attacker-influenced.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: if terraform_path.exists(): try: result = subprocess.run( [str(terraform_path), "version", "-json"], capture_output=True, text=True,
Confidence: 87% confidence
Finding: The script executes the discovered Terraform binary to query its version without validating that the binary is authentic or the expected installation target. If an attacker can place a malicious `terraform` earlier on PATH, this results in arbitrary code execution under the current user's privileges.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: print(f" 安装路径: {terraform_path}") return True, version else: result = subprocess.run( [str(terraform_path), "version"], capture_output=True, text=True,
Confidence: 86% confidence
Finding: This fallback again executes an untrusted Terraform binary resolved from PATH when JSON version output fails. Because it runs the binary directly, a malicious replacement can execute arbitrary code and the fallback broadens the execution path instead of failing safely.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises network access and operational installation steps that imply shell execution, filesystem writes, and environment interaction, but it does not explicitly declare corresponding permissions. This weakens policy enforcement and informed consent, because a caller may trigger a skill with broader capabilities than its manifest transparently communicates.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated purpose is Terraform CLI installation, but the documented behavior goes materially further by installing a provider, writing persistent Terraform configuration, populating provider mirror directories, running initialization tests, and supporting uninstall actions. This mismatch is dangerous because users or orchestrators may authorize a limited install action while the skill makes broader, persistent system and configuration changes.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill claims to install Terraform CLI, but it also installs providers, rewrites Terraform CLI configuration, and supports broad cleanup behavior. This scope expansion is dangerous in an agent skill because it modifies persistent user configuration and behavior beyond the narrowly expected install action, increasing the chance of hidden side effects.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The provider test creates a Terraform configuration that references a live HuaweiCloud data source and then runs `terraform init`. In an installer context, introducing cloud-provider configuration and remote provider interactions is unjustified and risky, especially for autonomous agents where this can create unanticipated network activity and prepare for cloud API use.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger text is broad enough to activate on generic Terraform setup or missing-tool scenarios, increasing the chance the skill runs in contexts where the user did not specifically request provider mirror configuration or system modification. Over-broad activation is risky for an installer skill because it can lead to unintended downloads, config changes, and privileged guidance.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill documents uninstall capability and privileged installation steps without a prominent warning that it will modify system PATH, write Terraform configuration, create provider directories, or delete installed components. This creates a consent and safety problem, especially in agentic contexts where documentation often drives autonomous execution decisions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The verification document explicitly demonstrates that running the uninstall flow deletes `/usr/local/bin/terraform`, `/root/.terraformrc`, and `/root/.terraform.d/providers` without any accompanying warning about destructive effects or possible loss of provider/cache/configuration state. In the context of an installer skill, this omission is dangerous because users or downstream agents may treat the documented command as routine and execute it as root, causing unexpected system-wide removal and destruction of Terraform-related configuration data.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The verification results show installation into `/usr/local/bin/terraform`, creation of `/root/.terraformrc`, provider installation under root-owned paths, and successful execution as an administrative user, but provide no warning that these are privileged, system-wide modifications. In an agent skill that automates Terraform setup, documenting root-level changes as a normal success path increases the chance that users or automation will run it with elevated privileges without understanding the persistence, scope, or security implications.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The uninstall flow irreversibly deletes the Terraform binary, `terraformrc`, and provider directories without confirmation or backup. In an agent setting, this can silently destroy user configuration and tooling state beyond the user's likely expectation for a simple uninstall.

Ssd 3

High

Confidence: 99% confidence
Finding: The file discloses a public IP, account name, and plaintext root password for a remotely accessible test machine. Even if intended for testing, publishing direct access credentials in skill documentation creates immediate risk of unauthorized access, credential reuse attacks, and compromise of any connected cloud resources. The skill context increases danger because it is an installation/automation asset likely to be shared broadly and reused by operators.

Unvalidated Output Injection

High

Category: Output Handling
Content: # 也检查系统 PATH try: if system_info["is_windows"]: result = subprocess.run( ["where", "terraform"], capture_output=True, text=True,
Confidence: 95% confidence
Finding: The output of `where terraform` is trusted and then used to select a binary for later execution, creating a classic binary/path hijack risk. Combined with `shell=True`, an attacker who influences PATH or command resolution can cause the script to execute a malicious program under the guise of version checking.

Unvalidated Output Injection

High

Category: Output Handling
Content: shell=True ) else: result = subprocess.run( ["which", "terraform"], capture_output=True, text=True,
Confidence: 86% confidence
Finding: Although the Linux `which` invocation itself is relatively safe, its output is later treated as authoritative and used to execute the resolved binary. That trust boundary is the dangerous part: a manipulated PATH can make the script run an attacker-controlled executable.

Unvalidated Output Injection

High

Category: Output Handling
Content: try: # 运行 terraform init result = subprocess.run( ["terraform", "init"], cwd=test_dir, capture_output=True,
Confidence: 90% confidence
Finding: Running `terraform init` by command name relies on PATH resolution and may execute an attacker-controlled binary if PATH is poisoned. In addition, `terraform init` performs substantial external and local actions, making this much riskier than a passive presence check.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: **Solution:** - Windows: Right-click → Run as administrator - Linux: `sudo python3 install_terraform.py` ### Issue 3: Network Timeout
Confidence: 78% confidence
Finding: The documentation recommends running the installer with sudo/root privileges to overcome permission issues, which can magnify the impact of any bug, supply-chain issue, or unexpected behavior in the installation script. Even if intended for convenience, encouraging elevation without safer alternatives increases risk for system-wide compromise or unintended modification.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # 也检查系统 PATH try: if system_info["is_windows"]: result = subprocess.run( ["where", "terraform"], capture_output=True, text=True,
Confidence: 97% confidence
Finding: Using `shell=True` for a simple `where terraform` lookup is an unsafe parameter choice because it expands the attack surface to shell interpretation and environment manipulation. In a skill executed by an agent, this is especially dangerous because the runtime environment may be partially attacker-controlled or at least less predictable than a local interactive shell.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.