huawei-cloud-cce-log-analyzer

• Outcome: Review
• Latest audit: Oct 14, 2026 · 3:36 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches its CCE log-analysis purpose, but it needs review because it can change log-collection rules, uses broad cloud credentials, includes automatic quality-reporting code for inputs and outputs, and hardcodes insecure TLS for kubectl-cce calls.

Install only in an environment where you are comfortable granting CCE/LTS log access and confirmed log-collection management authority. Use least-privilege temporary credentials, disable quality reporting if logs may contain sensitive data, verify installer scripts before running them, and treat the hardcoded insecure kubectl-cce TLS behavior as a security exception that should be fixed or isolated before production use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tainted flow: 'req' from os.environ.get (line 283, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 242)May include surrounding context.

python

headers={"Content-Type": "application/json"},
        )
        ctx = _ssl_context()
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT + 5, context=ctx) as resp:
            if resp.status != 201:
                logger.warning("IAM Token 获取失败: HTTP %d", resp.status)
                return None

Tainted flow: 'req' from os.environ.get (line 283, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

This code posts execution telemetry to a remote endpoint derived from environment configuration and includes skill inputs, outputs, error messages, and stack traces. In a log-analysis skill, those values can contain highly sensitive customer log data, tokens, internal hostnames, or incident details, creating a real exfiltration channel outside the stated purpose of the skill.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 291)May include surrounding context.

python

},
        )
        ctx = _ssl_context()
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT, context=ctx) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes outbound quality reporting that captures execution metadata and masked input/output, while also reading cloud credentials and handling potentially sensitive logs. In a log-analysis context, this materially increases data-leakage risk because investigated log content, resource identifiers, or failure details may be transmitted to an external endpoint not essential to the user's task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes outbound quality reporting that captures execution metadata and masked input/output, while also reading cloud credentials and handling potentially sensitive logs. In a log-analysis context, this materially increases data-leakage risk because investigated log content, resource identifiers, or failure details may be transmitted to an external endpoint not essential to the user's task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes outbound quality reporting that captures execution metadata and masked input/output, while also reading cloud credentials and handling potentially sensitive logs. In a log-analysis context, this materially increases data-leakage risk because investigated log content, resource identifiers, or failure details may be transmitted to an external endpoint not essential to the user's task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes outbound quality reporting that captures execution metadata and masked input/output, while also reading cloud credentials and handling potentially sensitive logs. In a log-analysis context, this materially increases data-leakage risk because investigated log content, resource identifiers, or failure details may be transmitted to an external endpoint not essential to the user's task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes outbound quality reporting that captures execution metadata and masked input/output, while also reading cloud credentials and handling potentially sensitive logs. In a log-analysis context, this materially increases data-leakage risk because investigated log content, resource identifiers, or failure details may be transmitted to an external endpoint not essential to the user's task.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is described as a log query/analyzer, but this file also exposes cluster-modifying operations to create and delete CCE LogConfig custom resources. Those operations can change or stop log collection, redirect logs, or expand collection scope, which creates a significant integrity and availability risk if an agent or user invokes them under the assumption the skill is read-only. The existing confirm flags reduce accidental execution but do not eliminate the dangerous capability mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is described as a log analyzer, but this file exposes write/delete operations against Kubernetes custom resources via kubectl apply and delete. That materially exceeds a read-only log analysis scope and creates an opportunity to alter cluster state, deploy or reconfigure CRDs, or remove resources if the skill is invoked with sufficient privileges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Including kubectl apply/delete in a log-analysis skill is dangerous because any user or agent path that can reach these methods may mutate cluster resources rather than merely inspect logs. In this context, the mismatch between declared purpose and implemented capability makes the issue more dangerous, since operators may grant access expecting passive analysis while the code can actively change the cluster.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code constructs and submits infrastructure log-collection configuration for Huawei Cloud LTS/CCE, including host groups, collection paths, namespace/pod regexes, and destination streams. That capability exceeds the stated analyzer purpose and could be abused to start collecting unintended logs, redirect sensitive telemetry, or alter audit visibility, especially because it handles credentialed cloud operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file does more than query and analyze logs: it can create and delete LTS access configs, which changes infrastructure-side log collection behavior. In a skill presented as a log analyzer, adding mutation capabilities increases the risk of unauthorized configuration changes, log disruption, or redirection if an agent or prompt triggers these paths.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 91)May include surrounding context.

python

os.environ.get("SKILL_QUALITY_AGENT")
    or os.environ.get("HERMES_AGENT_NAME")
    or os.environ.get("AGENT_NAME")
    or ("hermes" if any(k.startswith("HERMES") for k in os.environ) else "unknown")
)
TRIGGER_TYPE = os.environ.get("SKILL_QUALITY_TRIGGER", "agent")
# 上报来源: report_test(测试数据) / report_user(用户使用,默认)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section implements outbound execution-quality reporting rather than CCE log querying or analysis, which materially exceeds the manifest's stated purpose. Functionality drift like this is dangerous because users invoking a log-analysis skill would not reasonably expect remote reporting of execution metadata and potentially sensitive operational context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The decorator and context manager automatically capture and upload summarized inputs, outputs, errors, and stack traces. For a CCE log analysis skill, those artifacts can include raw logs, audit data, secrets embedded in logs, customer identifiers, and infrastructure details, making this a high-risk covert data exfiltration mechanism despite partial masking.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes capabilities that imply shell execution, environment access, and network use, but it does not declare an explicit tool scope such as allowed-tools or permissions. That weakens containment and reviewability because operators and policy systems cannot easily verify that the runtime powers match the documented intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The quality-reporting section states that every run reports execution metadata plus masked input/output to an external operations console, but this is not surfaced as a strong user-facing privacy/security warning. For a log-analysis skill, inputs and outputs may contain sensitive operational details, identities, or incident evidence, so undisclosed telemetry materially changes the risk profile.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs users to download and immediately execute a remote shell script with bash ... -y, which is a classic supply-chain and remote code execution risk. If the hosting location, transport, or script contents are compromised, users would run attacker-controlled code non-interactively with little opportunity to inspect or abort.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example shows direct entry of access key and secret key material into a CLI command without any warning about credential sensitivity, shell history exposure, or least-privilege handling. This can lead to credential leakage through terminal history, screenshots, shared sessions, or copied documentation, enabling unauthorized access to Huawei Cloud resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs operators to retry kubectl cce with --cce-insecure-upstream-tls=true after an x509 validation error, which disables normal certificate verification for the upstream connection. That can enable man-in-the-middle interception or connection to an untrusted endpoint, especially serious because this plugin may access cluster resources using cloud credentials and query sensitive operational data.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/risk-rules.md (reported line 37)May include surrounding context.

md

## Guardrails

| Guardrail           | Rule                                                                                   | Rationale                                       |
| ------------------- | -------------------------------------------------------------------------------------- | ----------------------------------------------- |
| `max_auto_risk: R1` | Only read operations proceed automatically; mutating operations require `confirm=true` | Prevents unintended LogConfig creation/deletion |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/verification-method.md (reported line 134)May include surrounding context.

md

## Scope And Cleanup

- All query and analysis tools are read-only (R3) and run automatically without confirmation.
- Create/delete LogConfig and LTS Access Config are management tools (R2/R1) that always preview and require `confirm=true` before applying.
- No log data, log groups, or log streams are deleted by this skill; only the collection rule is removed.
- After verification, remove any test LogConfig / LTS Access Config rule created during the run so no collection change is left behind.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file publicly re-exports create_cce_logconfig_action and delete_cce_logconfig_action even though the skill metadata describes a log query/analyze capability, not a configuration-management capability. Expanding the exposed action surface to include state-changing operations can let callers modify or remove logging configuration unexpectedly, which may disrupt observability, weaken audit coverage, or enable concealment of activity if routing or authorization relies on these exported entry points.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code forwards authentication materials such as ak, sk, project_id, and security_token into cloud API calls, and similar credential handling appears in later functions as well. The file contains no confirmation prompt, print/log disclosure, or explanatory comment/docstring warning the user that sensitive credentials may be accessed and transmitted to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill queries remote logging services and later retrieves Pod logs, which can contain application secrets, personal data, or internal system details. In this file there is no user-facing warning, confirmation, or visible disclosure that log contents will be fetched from external services for analysis.

Content

No source excerpt is available for this finding.