huawei-cloud-cdn-abnormal-status-code-analysis

• Outcome: Pass
• Latest audit: Sep 29, 2026 · 10:48 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent read-only Huawei CDN troubleshooting workflow; it uses cloud credentials and access logs as expected, with privacy cautions but no evidence of hidden writes, persistence, exfiltration, or deception.

Install only if you are comfortable letting the agent run read-only hcloud CDN queries and download CDN access logs for chosen domains and time windows. Use least-privilege IAM, never paste AK/SK into chat, keep log windows narrow, and redact or limit client IPs, URLs, user agents, referers, and raw rows before sharing outputs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill clearly instructs use of shell and network-capable actions (hcloud CLI, Python downloader, package installation, log fetches) but does not declare an explicit tool scope such as allowed-tools or permissions. In an agent platform, that mismatch can let the runtime grant broader capabilities than intended, increasing the risk of unintended command execution, package installation, or external network access beyond the documented read-only workflow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

> **Pre-check: Python `requests >= 2.25`** — `python -c "import requests; print('ok')"`. The log helper downloads via `requests`.
> Install if missing: `pip install requests>=2.25`

> **Pre-check: hcloud credentials** — `hcloud configure list`. If invalid, stop and guide secure configuration. Never read/echo/print AK/SK; never ask the user to paste AK/SK in chat.

> **⚠️ hcloud parameter format**: all params must use `--key=value`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guide instructs users to run hcloud configure and enter AK/SK credentials, but it does not warn that these are sensitive long-lived cloud secrets or provide handling precautions. In a CLI installation guide for incident troubleshooting, this omission can lead users to expose credentials in shared terminals, shell history, screenshots, or insecure local environments, increasing the risk of cloud account compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs operators to download and parse CDN access logs, and the documented schema includes client IPs, URLs, user agents, timestamps, and edge node IPs. Even though the commands are read-only, omission of any warning or handling guidance for this sensitive telemetry increases the risk of unnecessary collection, over-retention, or exposure of personal and operational data during incident response.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The verification procedure retrieves CDN access log metadata and then downloads/processes a log URL, which can expose sensitive request data such as client IPs, URLs, query strings, headers, or identifiers during routine validation. Because the instructions do not require minimization, redaction, least-privilege handling, or operator warning, a user may unnecessarily access or disclose production traffic data while merely verifying the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits per-request access-log rows including client IP addresses, user agents, URLs, timestamps, and edge node IPs, which are not strictly necessary for status-code counting or edge-vs-origin diagnosis. This creates unnecessary exposure of potentially sensitive operational and user data, especially because the tool prints the data directly to stdout where it may be captured in agent transcripts, logs, or downstream systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown instructs use of "CST 0:00 points" as a default time basis, which imposes a specific locale/time convention on output and operation. The document does not offer a user choice or clearly frame this as an optional presentation preference, so it can conflict with language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The note says all hcloud commands use --cli-region=cn-north-1, which imposes a fixed region/locale behavior. Under the policy, forcing a specific language or locale-related setting without opt-in or explicit justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The template fixes the target region to "cn-north-1" and requests the anomaly window in "CST time," which imposes a specific regional and locale assumption in natural-language content. The file does not indicate that this skill is explicitly region-specific or that users can opt into a different locale, so this can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The troubleshooting guidance says time points must be aligned to CST-specific boundaries, and later instructs users to align to whole-hour CST points. This is a natural-language locale constraint presented as a requirement, but the document does not offer user opt-in or explain why this locale is mandatory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The instruction to align to whole-hour CST points imposes a specific locale/timezone behavior in natural language. Because the file does not explain that this is a service-specific regional requirement, it can be interpreted as an unnecessary forced locale policy.

Content

No source excerpt is available for this finding.