huawei-cloud-ucs-policy-governor

• Outcome: Review
• Latest audit: Aug 4, 2026 · 7:27 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a disclosed Huawei Cloud policy-governance guide, but some audit workflows cross into cluster credential retrieval and live resource changes without enough scoping or safeguards.

Install only if you intend the agent to help administer Huawei Cloud UCS policy governance, not just read reports. Use least-privilege or temporary credentials, avoid production for verification examples, require explicit confirmation before create/update/delete/enable/disable actions, and do not let the audit workflow generate kubeconfig files or run kubectl unless you have separately approved live cluster remediation and can clean up sensitive files afterward.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file is presented as a compliance-audit task, but it expands into remediation actions that retrieve cluster credentials, modify live Kubernetes resources, and toggle policy enforcement. This scope drift is dangerous because an agent invoked for read-only audit behavior may be induced to perform privileged state-changing operations the user did not clearly request.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: These steps instruct the agent to obtain cluster access credentials and use kubectl to apply changes, which goes beyond policy-governance auditing into direct cluster administration. In the context of an audit skill, this creates a high-risk path for unintended credential exposure and unauthorized modification of workloads or security controls.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Adding cluster registration to a compliance-audit task introduces a provisioning capability unrelated to the declared review scope. This broadens the agent's authority surface and could cause unauthorized onboarding of infrastructure when the user only intended assessment or reporting.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs users to export long-lived access keys and to store credentials directly in ~/.hcloud/config.json, but it does not warn that shell exports may be captured in shell history, process environments, CI logs, or copied into insecure scripts, and that the config file contains plaintext secrets. In a cloud-administration skill, exposed AK/SK credentials can enable unauthorized access to UCS and potentially broader Huawei Cloud resources, making this a real secret-handling weakness even though it is documentation rather than executable code.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The command writes a kubeconfig containing cluster access credentials directly to disk without warning about sensitivity, file permissions, storage location, or cleanup. This can leave reusable administrative credentials exposed to other users, processes, logs, backups, or later compromise on the host.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Disabling and re-enabling cluster policy changes the enforcement state of security controls, yet the procedure provides no warning about operational or security impact. An agent following these instructions could temporarily reduce policy coverage or disrupt workloads during troubleshooting without the user understanding the consequences.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide documents `EnableClusterPolicy` and `EnableClusterGroupPolicy` as routine operations but does not clearly warn that enabling enforcement can immediately change admission behavior and block workloads across a cluster or fleet group. In a policy-governance skill, that omission increases the chance of unsafe operational use, especially if users apply `deny` policies or retry failed enforcement without understanding blast radius.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The verification guide includes state-changing governance operations such as creating policy instances, switching enforcement from warn to deny, enabling/disabling policy enforcement, and deleting instances as routine verification steps. In a policy-governance context, these actions can immediately alter admission behavior, suspend protections, or cause outages/compliance regressions if run against real clusters or fleet groups, and the document does not require a sandbox/test environment, explicit approval, rollback planning, or strong destructive-action warnings.

Credential Access

High

• Category: Privilege Escalation

Content

hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

# 2. Access the cluster with kubeconfig
hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml

# 3. Fix violations using kubectl

• Confidence: 99% confidence
• Finding: The task directs retrieval of a cluster kubeconfig, which is a credential-access action. In an audit-focused skill, embedding credential acquisition is especially dangerous because it silently escalates from observation to privileged access, increasing the chance of credential leakage or misuse.

Credential Access

High

• Category: Privilege Escalation

Content

hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

# 2. Access the cluster with kubeconfig
hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml

# 3. Fix violations using kubectl
kubectl --kubeconfig=cluster-kubeconfig.yaml apply -f <fix-manifest>

• Confidence: 99% confidence
• Finding: The presence of kubeconfig handling at this step indicates direct credential exposure in a context that should be limited to policy-job inspection. This mismatch heightens risk because users invoking an audit skill may not expect or approve secret material being generated and stored.

Credential Access

High

• Category: Privilege Escalation

Content

hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

# 2. Access the cluster with kubeconfig
hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml

# 3. Fix violations using kubectl
kubectl --kubeconfig=cluster-kubeconfig.yaml apply -f <fix-manifest>

• Confidence: 99% confidence
• Finding: The presence of kubeconfig handling at this step indicates direct credential exposure in a context that should be limited to policy-job inspection. This mismatch heightens risk because users invoking an audit skill may not expect or approve secret material being generated and stored.

Credential Access

High

• Category: Privilege Escalation

Content

hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml

# 3. Fix violations using kubectl
kubectl --kubeconfig=cluster-kubeconfig.yaml apply -f <fix-manifest>

# 4. Re-trigger enforcement
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

• Confidence: 97% confidence
• Finding: The workflow couples credential acquisition with immediate resource modification, creating an end-to-end path from audit trigger to privileged action. In practice, this increases the blast radius of any misuse because the same instructions both expose access material and apply changes to the cluster.

Credential Access

High

• Category: Privilege Escalation

Content

hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml

# 3. Fix violations using kubectl
kubectl --kubeconfig=cluster-kubeconfig.yaml apply -f <fix-manifest>

# 4. Re-trigger enforcement
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

• Confidence: 97% confidence
• Finding: The workflow couples credential acquisition with immediate resource modification, creating an end-to-end path from audit trigger to privileged action. In practice, this increases the blast radius of any misuse because the same instructions both expose access material and apply changes to the cluster.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.