huawei-cloud-alarm-bind-inspection

• Outcome: Review
• Latest audit: Oct 23, 2026 · 9:08 AM UTC
• Version: 1.0.0

Overview

The skill performs its advertised cloud alarm audit, with disclosed credential use and ordinary CLI installation and cleanup precautions.

Use a dedicated read-only cloud identity and confirm the SDK and CLI target the same account. Keep credentials and reports private, verify CLI downloads before execution, and avoid printing credentials during checks. Back up ~/.hcloud before following the optional uninstall instructions, which remove all stored profiles.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (45)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied commands uninstall hcloud and erase its user-local directory rather than read or analyze alarm configuration. Although CLI installation guidance could support the declared workflow, these commands perform destructive removal, including user configuration, without any installation or inspection operation in the supplied chunk. That capability is not disclosed by the read-and-inspect description.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- Third-party dependencies: see `requirements.txt` (includes `huaweicloudsdkces`, `huaweicloudsdkcore`)

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 431)May include surrounding context.

md

- `verification-method.md`: Skill verification and testing methods

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable artifact remains available under the skill install path but its content is outside analyzer coverage.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable artifact remains available under the skill install path but its content is outside analyzer coverage.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/华为云租户面监控告警基线-V26.01-beta.xlsx!/xl/theme/theme1.xml (reported line 2)May include surrounding context.

text

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:theme xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" name="Office 主题​​"><a:themeElements><a:clrScheme name="Office"><a:dk1><a:sysClr val="windowText" lastClr="000000"/></a:dk1><a:lt1><a:sysClr val="window" lastClr="FFFFFF"/></a:lt1><a:dk2><a:srgbClr val="1F497D"/></a:dk2><a:lt2><a:srgbClr val="EEECE1"/></a:lt2><a:accent1><a:srgbClr val="4F81BD"/></a:accent1><a:accent2><a:srgbClr val="C0504D"/></a:accent2><a:accent3><a:srgbClr val="9BBB59"/></a:accent3><a:accent4><a:srgbClr val="8064A2"/></a:accent4><a:accent5><a:srgbClr val="4BACC6"/></a:accent5><a:accent6><a:srgbClr val="F79646"/></a:accent6><a:hlink><a:srgbClr val="0000FF"/></a:hlink><a:folHlink><a:srgbClr val="800080"/></a:folHlink></a:clrScheme><a:fontScheme name="Office"><a:majorFont><a:latin typeface="Cambria" panose="020F0302020204030204"/><a:ea typeface=""/><a:cs typeface=""/><a:font script="Jpan" typeface="ＭＳ Ｐゴシック"/><a:font script="Hang" typeface="맑은

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The command immediately executes a downloaded script from a mutable 'latest' URL without a pinned digest or signature check. HTTPS protects transport but does not prevent a compromised distribution endpoint from supplying code that can access local files and cloud credentials.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 22)May include surrounding context.

One-click Installation

bash

# Download and run official installation script (interactive)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh

# Non-interactive installation (skip confirmation)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This non-interactive variant executes the same mutable remote installer without integrity verification. The '-y' option removes an interaction point, but the underlying vulnerability is execution of unverified downloaded code in an environment that may hold cloud credentials.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 25)May include surrounding context.

curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh

Non-interactive installation (skip confirmation)

curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y

text

### Verify Installation

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The Docker build downloads and executes an unverified mutable installer, by default as root inside the build container. A compromised installer could alter the resulting image or access available build-time secrets; containerization does not make the produced artifact trustworthy.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 107)May include surrounding context.

dockerfile

FROM ubuntu:latest
RUN apt-get update -y && apt-get install curl -y
RUN curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
WORKDIR /workspace
ENTRYPOINT ["/usr/local/bin/hcloud"]

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 179)May include surrounding context.

Uninstall KooCLI

bash

# Linux/macOS:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 180)May include surrounding context.

bash

# Linux/macOS:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 180)May include surrounding context.

bash

# Linux/macOS:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Although not malicious parameter abuse, this command unconditionally deletes the user's entire shared KooCLI configuration without warning or backup. It duplicates the SQP-2 data-loss issue and may remove profiles for environments unrelated to alarm inspection.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 181)May include surrounding context.

Linux/macOS:

sudo rm -f /usr/local/bin/hcloud sudo rm -rf /usr/local/hcloud/ rm -rf ~/.hcloud/

text

### Clean Cache

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 181)May include surrounding context.

Linux/macOS:

sudo rm -f /usr/local/bin/hcloud sudo rm -rf /usr/local/hcloud/ rm -rf ~/.hcloud/

text

### Clean Cache

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 186)May include surrounding context.

Clean Cache

bash

rm -rf ~/.hcloud/cache/

Best Practices

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 186)May include surrounding context.

Clean Cache

bash

rm -rf ~/.hcloud/cache/

Best Practices

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/iam-policies.md (reported line 96)May include surrounding context.

export HW_PROJECT_ID=your_project_id

text

### Method 2: .env File

Create a `.env` file in the skill root directory:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 21)May include surrounding context.

python

logger = logging.getLogger(__name__)

# Load .env from skill root
scriptPath = os.path.dirname(__file__)
skillPath = os.path.dirname(scriptPath)
load_dotenv(os.path.join(skillPath, ".env"))

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 83)May include surrounding context.

python

if not ak or not sk:
        raise ValueError(
            "HW_ACCESS_KEY and HW_SECRET_KEY must be set in environment or .env file. "
            "Please configure them in the skill's .env file."
        )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 84)May include surrounding context.

python

if not ak or not sk:
        raise ValueError(
            "HW_ACCESS_KEY and HW_SECRET_KEY must be set in environment or .env file. "
            "Please configure them in the skill's .env file."
        )

    return ak, sk, region, project_id, security_token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 24)May include surrounding context.

python

# Load .env from skill root
scriptPath = os.path.dirname(__file__)
skillPath = os.path.dirname(scriptPath)
load_dotenv(os.path.join(skillPath, ".env"))

# Workspace paths
projectPath = "."

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/diagnose_event.py (reported line 22)May include surrounding context.

python

data = json.load(f)
except FileNotFoundError:
print(f"File not found: {ALARM_RULES_PATH}. Run main_alarm.py first.")
return
rules = data.get("rules", [])
print(f"Total alarm rules: {len(rules)}")
event_rules = [r for r in rules if r.get("type", "") in EVENT_TYPES and r.get("enabled", False)]

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_excel_report.py (reported line 236)May include surrounding context.

python

has_system = True
        match_results.append(compare_with_baseline(tpl_info["name"], tpl_info["metrics"], baseline_metric_ids, metric_id_to_name))

    return rule_names, template_names, template_types, match_results, has_system


def _format_rule_values(rule_names, template_names, template_types, match_results, has_system):

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_excel_report.py (reported line 248)May include surrounding context.

python

tpl_type_val = "\n".join(template_types)
    match_val = "\n".join(match_results)
    suggestion_val = "优化系统模板" if has_system else "人工复核"
    return rule_name_val, tpl_name_val, tpl_type_val, match_val, suggestion_val


def _apply_cell_styles(ws, row_idx, bind_rate_value, match_results, has_system, suggestion_val):

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/cli-installation-guide.md:180