Security audit

huawei-cloud-activity-submit

Security checks for vulnerabilities and agentic risk

Overview

The skill submits challenge results as described, but its cleanup workflow permits cloud-resource deletion without requiring confirmation of the exact resources.

Use short-lived, minimally privileged credentials and understand that the submission service receives the secret key over HTTPS. Skip cleanup unless you can approve the exact resources to delete. Review and pin the optional gallery installer and skill before use, keep cloud credentials out of that installation environment, and check which code will be published. Replace the key-printing check with a presence-only check.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
- **纯 Node.js 脚本**：`submit.mjs`（Node ≥ 18，无外部依赖），不使用 KooCLI。

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
4. **执行提交**：运行 `submit.mjs`（见下）。参数与步骤字段对应（**两步均需 `--project-id` 与 `--region`**；本 skill 固定使用生产环境接口）。

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
脚本位于本 skill 目录：`submit.mjs`（纯 Node，Node ≥ 18，无需额外依赖）。

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
md
- **Node.js ≥ 18**：本 skill 的提交脚本 `submit.mjs` 使用原生 `fetch()`，需 Node 18 或以上版本。

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Manifest references MCP server without version pin: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The manifest references the same unpinned installer used by the optional publication workflow, so this duplicates the supply-chain issue rather than identifying a separate vulnerability. The MCP classification is inaccurate, but executing a mutable npm package and trusting a mutable remote skill can compromise the agent's local execution context.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The description references an installation workflow that later invokes an unpinned npm executable and retrieves a skill from an unpinned Git repository. This is not an MCP-server configuration as the detector claims, but the underlying supply-chain risk is real: compromised upstream content could execute code or introduce adversarial instructions in an environment holding cloud credentials.
Content: No source excerpt is available for this finding.

The workflow expands an activity-submission skill into cloud-resource deletion.

Medium

Category: Excessive Agency
Confidence: 97% confidence
Finding: The manifest describes submitting activity results and optionally publishing work to the gallery, but L102 instructs the agent to execute cleanup of billable cloud resources, including deleting ECS instances, after user selection. This introduces destructive cloud-resource management beyond the declared submission scope; requiring user consent reduces risk but does not resolve the scope mismatch.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The executable command uses npx skills add without an exact installer version and fetches a Git repository without an immutable revision. User approval to publish reduces unintended execution but does not protect against an upstream compromise that could expose local source code or credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: This reference points to the same unpinned installation workflow rather than a separate MCP server or additional execution path. Its security relevance comes from the actionable command elsewhere in the document, which permits mutable upstream code and skill instructions to enter a credential-bearing workflow.
Content: No source excerpt is available for this finding.

The environment check prints a live access key without warning about credential exposure.

Medium

Category: Output Handling
Confidence: 93% confidence
Finding: The recommended echo $HW_ACCESS_KEY check unnecessarily exposes the access-key identifier to terminal output, which may be retained in agent transcripts, CI logs, or shared debugging records. Because this skill uses production credentials, disclosure should be avoided; however, the AK alone normally cannot authenticate requests without the corresponding SK, so this is a limited information-disclosure issue rather than a complete credential compromise.
Content: No source excerpt is available for this finding.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 70% confidence
Finding: Overly Broad Trigger: description clause 'publish-work-to-gallery）。Use when the user asks to 提交作品、提交闯关成果、自动提交活动成果、提交沙箱链接/公网地址, or when a generated sandbox URL needs to be submitted for the 华为云开放能力闯关挑战。本 skill' activates on 'to', which is too short and may match unintended inputs
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: submit.mjs:87