ClawHub
Back to skill

Security audit

huawei-cloud-cdn-certificate-diagnosis

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a read-only Huawei Cloud CDN certificate diagnostic tool, with the main caution that reports may include raw CDN certificate metadata.

Install only for authorized Huawei Cloud CDN domains. Use a least-privilege read-only IAM user, do not paste AK/SK credentials into chat, and redact raw API responses or generated reports before sharing them because they can contain domain and certificate metadata.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description presents a broader certificate-diagnosis skill for CDN domains, including configuration retrieval and live certificate probing. The code chunk provided is much narrower: it is a utility script that computes days remaining from a supplied expiration_time and labels the result. While this supports one small part of the declared workflow (expiry calculation), it does not implement the primary described behaviors such as querying CDN certificate configuration, checking the actual served certificate, or diagnosing configuration mismatch/deployment failure. Therefore the declared description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents a broader CDN-focused diagnostic skill that combines control-plane configuration lookup with data-plane certificate probing and explicit expiration analysis. The supplied code chunk only implements the probe portion: it opens a TLS connection to a domain, enforces certificate verification, extracts certificate fields, and returns them as JSON. There is no evidence of hcloud CLI usage, no ShowCertificatesHttpsInfo/v2 query, no expiration-days calculation, and no CDN-specific logic or domain scoping. While the script is consistent with one supporting component mentioned in the description (a TLS probe), the overall declared purpose materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
>
> If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
>
> 1. **Stop immediately** - Do not execute any commands
> 2. **Politely refuse** and return the following message:
>
> ```

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instructions explicitly tell the agent to expose the raw API response to the user when expiration_time is missing, without any requirement to review or redact potentially sensitive fields first. Even in a read-only diagnostic skill, API responses can contain account identifiers, domain metadata, certificate details, or other internal configuration data that should not be blindly disclosed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Directing the agent to reveal raw API output creates a data exposure path whenever the upstream API omits expiration_time. An attacker or misconfigured backend could cause this branch to trigger and induce disclosure of unnecessary internal data, making the issue more dangerous because the skill is designed to handle real cloud account responses.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The report template requires attaching the raw API response when data is missing, which operationalizes sensitive-data disclosure as part of normal workflow. Because diagnosis reports are often shared or stored, this increases the chance of persistent exposure of cloud configuration details beyond the immediate session.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

md
Ensure the IAM user has the required permissions. See [references/iam-policies.md](references/iam-policies.md) for details.

**Minimum required permissions:**

- `cdn:*:query*` — All CDN query-class actions used by this skill (`ListDomains/v2`, `ShowDomainDetailByName`, `ShowCertificatesHttpsInfo/v2`)
- `cdn:configuration:queryDomains` — List CDN domains (listed explicitly alongside the wildcard)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation instructs use of a live TLS probe against an external domain, which necessarily generates outbound network traffic and reveals the queried domain to the destination and intermediaries. While this is expected for certificate diagnosis, the lack of an explicit warning about network disclosure, authorization expectations, and operational side effects can lead to unintended probing of third-party infrastructure.

Content

No source excerpt is available for this finding.