huawei-cloud-account-onboarding

• Outcome: Pass
• Latest audit: Oct 9, 2026 · 9:05 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed, read-only Huawei Cloud helper for checking real-name authentication status and fetching a user-requested QR code.

Install this only for Huawei Cloud real-name authentication help. Use the narrowest BSS read-only credentials available, treat AK/SK values and QR-code URLs as sensitive, avoid putting secrets in permanent shell files, and review the optional KooCLI installer step before running it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 16)May include surrounding context.

md

# Install (Linux x86_64/ARM64)
# Download the official installer and verify its SHA256 checksum before executing
# (pinned checksum below; do not pipe remote scripts directly into bash).
curl -fsSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o /tmp/hcloud_install.sh
echo "cd2c99bf92861ee5760c72e07bfa51f46d990d3e0e8411f12d69e32f1981cdf2  /tmp/hcloud_install.sh" | sha256sum -c - || { echo "installer checksum mismatch — aborting"; exit 1; }
bash /tmp/hcloud_install.sh

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/show_real_name_auth_status.py (reported line 55)May include surrounding context.

python

verifies the documented contract: exit code 2, a clear "AK/SK not found"
    message, and no traceback. Exits 0 when the behavior matches, 1 otherwise.
    """
    clean_env = {k: v for k, v in os.environ.items() if k not in CRED_ENV_KEYS}
    r = subprocess.run(
        [sys.executable, os.path.abspath(__file__)],
        capture_output=True,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly instructs use of shell commands and environment-based credentials, but it declares no tool restrictions such as allowed tools or permission scope. That creates an implicit capability gap: an agent/runtime may permit broader shell or environment access than intended, increasing the chance of unintended command execution or exposure of sensitive AK/SK values during operation or troubleshooting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide instructs users to export long-lived AK/SK credentials as environment variables without warning about exposure through shell history, process inspection, logging, crash reports, or inherited environments. In a credential-handling context, this increases the risk of accidental secret disclosure, especially on shared systems or when users copy commands into persistent shell startup files.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/show_real_name_auth_status.py (reported line 56)May include surrounding context.

python

message, and no traceback. Exits 0 when the behavior matches, 1 otherwise.
    """
    clean_env = {k: v for k, v in os.environ.items() if k not in CRED_ENV_KEYS}
    r = subprocess.run(
        [sys.executable, os.path.abspath(__file__)],
        capture_output=True,
        text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This manifest-like JSON fixes the skill to region "cn-north-1" and the Huawei Cloud endpoint at a China-hosted service URL. For a natural-language policy review, this can represent a locale/region constraint imposed by configuration without documentation of user selection or justification in the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Lines L03-L08 state that the skill executes via the Python SDK rather than hcloud CLI, framing the guide as only for confirmation and SDK installation. However, lines L32-L40 provide operational hcloud credential configuration steps, which creates a documentation-level contradiction about whether CLI setup is part of the intended workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This natural-language instruction imposes a specific language setting, which can violate locale-choice policy when presented as a requirement without opt-in. The text does not explain why Chinese is necessary in a way that limits the requirement to a documented, justified context for this skill.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency is specified with a lower bound only, which allows installation of any newer version, including unexpected major or compromised releases. While this file itself is not executable and the skill is read-only in purpose, supply-chain risk still exists because builds may pull different packages over time, reducing reproducibility and potentially introducing vulnerable or malicious code.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

huaweicloudsdkbss>=3.1.0

Static analysis

No suspicious patterns detected.