Security audit
Security checks for vulnerabilities and agentic risk
The skill is mainly a read-only Huawei Cloud billing helper, but its setup references include unsafe installer patterns and some off-scope cloud CLI guidance that users should review before installing.
Install only if you are comfortable letting the agent use your current hcloud profile for read-only Huawei Cloud billing evidence. Before using it, verify the active account/profile, grant only BSS read-only permissions where possible, avoid running the one-line remote installer or '-y' examples without independent verification, and treat the off-scope KooCLI/ECS/setup commands as general documentation rather than skill-authorized actions.
Referenced artifact was not completely inspected
`SKILL.md` defines behavior; `semantic/catalog.yml` defines entry points and required context; `semantic/billing-ontology.yml` defines facts, grains, money_basi
The document describes KooCLI as a general tool for managing 100+ cloud services, which materially exceeds the skill's declared Huawei Cloud BSS billing-only scope. In an agent context, broad operational guidance can enable off-scope infrastructure actions and increases the chance the skill is used to perform unintended cloud administration tasks.
This is a classic fetch-and-execute pattern: downloading a remote script and immediately running it. It is dangerous because users or agents execute code they have not independently verified, creating a direct supply-chain compromise path.
# Download and run official installation script (interactive)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
# Non-interactive installation (skip confirmation)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
The non-interactive fetch-and-execute variant is even riskier because it removes confirmation barriers while still executing unverified remote code. In an agent setting, this materially raises the likelihood of silent environment modification or compromise.
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
### Verify Installation
The Dockerfile embeds a remote-script download and execution during image build, making every build dependent on mutable external code. This undermines reproducibility and allows upstream script changes or compromise to silently alter produced images.
FROM ubuntu:latest
RUN apt-get update -y && apt-get install curl -y
RUN curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
WORKDIR /workspace
ENTRYPOINT ["/usr/local/bin/hcloud"]
The example hcloud ECS NovaListServers is a non-billing resource-management operation that directly conflicts with the manifest's billing-only scope. In a tool-using agent, this kind of example can normalize or trigger cloud inventory and operational access outside intended boundaries.
This troubleshooting path again recommends fetching and executing an external installer script. Repeating this pattern normalizes unsafe installation behavior and expands the attack surface for supply-chain or MITM-style compromise if trust assumptions fail.
sudo bash ./hcloud_install.sh
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -d ~/.local/bin
#### Command Not Found
Using the same fetch-and-execute pattern for updates is particularly risky because users may trust update flows more and run them frequently. A compromised upstream script could then gain repeated opportunities to execute arbitrary code.
hcloud update
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
### Uninstall KooCLI
sudo rm -f /usr/local/bin/hcloud is a privileged destructive command that deletes a system binary. In documentation for an agent skill that is supposed to avoid delete actions, including such commands creates policy inconsistency and potential for unintended destructive execution.
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
sudo rm -rf /usr/local/hcloud/ is a privileged recursive deletion command. Recursive deletions are inherently risky in copied or automated contexts, and the skill context makes it more concerning because delete operations are explicitly out of scope.
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
# Windows manual uninstallation:
sudo rm -rf /usr/local/hcloud/ is a privileged recursive deletion command. Recursive deletions are inherently risky in copied or automated contexts, and the skill context makes it more concerning because delete operations are explicitly out of scope.
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
# Windows manual uninstallation:
rm -rf ~/.hcloud/ removes user configuration and likely stored CLI state or credentials. This is destructive, may erase audit-relevant data, and in the context of profile persistence could also wipe configuration unexpectedly.
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
# Windows manual uninstallation:
# 1. Delete hcloud.exe file
rm -rf ~/.hcloud/ removes user configuration and likely stored CLI state or credentials. This is destructive, may erase audit-relevant data, and in the context of profile persistence could also wipe configuration unexpectedly.
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
# Windows manual uninstallation:
# 1. Delete hcloud.exe file
rm -rf ~/.hcloud/cache/ is a targeted cache-removal command, so the impact is narrower than other rm -rf examples. It is still a destructive filesystem operation and should not be normalized in an agent skill without warnings or confirmation guidance.
# Clean KooCLI cache
rm -rf ~/.hcloud/cache/
# Clean downloaded files
rm -f hcloud_install.sh huaweicloud-cli-*.tar.gz huaweicloud-cli-*.zip
rm -rf ~/.hcloud/cache/ is a targeted cache-removal command, so the impact is narrower than other rm -rf examples. It is still a destructive filesystem operation and should not be normalized in an agent skill without warnings or confirmation guidance.
# Clean KooCLI cache
rm -rf ~/.hcloud/cache/
# Clean downloaded files
rm -f hcloud_install.sh huaweicloud-cli-*.tar.gz huaweicloud-cli-*.zip
The skill instructs changing the global CLI language with hcloud configure set --cli-lang=cn, which mutates user environment state without explicit opt-in and may affect unrelated future CLI usage. While not directly compromising confidentiality or integrity of billing data, it can create confusing side effects, alter command/output expectations, and violate least-surprise for a read-only investigation workflow.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Verification Path
**Huawei Cloud Gate** — Before matching in `catalog.yml`: if user has not indicated Huawei Cloud / BSS / this skill's billing scope, and cannot be determined from conversation as the Huawei Cloud account for current `hcloud` profile, **first ask one confirmation** "Query current configured Huawei Cloud account and billing period?"; without confirmation, no BSS query execution. Non-Huawei Cloud or other cloud vendor billing → only state out of scope, no evidence gathering.
|Phase|Task|Reference File|Forbidden|
|---|---|---|---|
The command transmits data to an external host and downloads executable content from it. While normal for software installation, it is still security-relevant because it establishes a network trust dependency and immediately feeds the fetched content into execution flow.
# Download and run official installation script (interactive)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
# Non-interactive installation (skip confirmation)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
The guide recommends downloading and executing an external installer script, including a non-interactive mode, without prominent warnings about code execution, trust boundaries, or verification. In an agent or automation context, this pattern can lead to unattended execution of remote code with user or elevated privileges.
The -y non-interactive installation bypasses confirmation prompts and reduces friction for unattended execution of the installer. In agent-driven or scripted environments, this increases the risk of automatic acceptance of privileged or environment-modifying actions without human review.
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
The instruction uses sudo to place a binary into /usr/local/bin, which is a privileged filesystem modification. On its own this is common admin behavior, but combined with downloaded artifacts it elevates the consequence of a compromised or tampered installer/package.
# AMD 64-bit system
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
sudo mv hcloud /usr/local/bin/
# ARM 64-bit system
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
This is another privileged binary placement step using sudo. The risk is not the existence of sudo itself, but encouraging elevation for a downloaded artifact without requiring integrity verification first.
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz" tar -zxvf huaweicloud-cli-linux-arm64.tar.gz sudo mv hcloud /usr/local/bin/
### 2. macOS Systems
The macOS installation guidance uses sudo to install the binary into a shared system path. If the downloaded archive is altered or the user misunderstands the command, privileged execution magnifies the impact on the host system.
# Intel chips (AMD 64-bit)
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
sudo mv hcloud /usr/local/bin/
# Apple Silicon (ARM 64-bit)
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
This repeats the same privileged installation pattern for Apple Silicon systems. In an automation or agent setting, normalizing elevation without guardrails can lead to unsafe execution of unverified artifacts.
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz" tar -zxvf huaweicloud-cli-mac-arm64.tar.gz sudo mv hcloud /usr/local/bin/
### 3. Windows Systems
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Detected: suspicious.destructive_delete_command