huawei-cloud-cdn-dns-resolution-diagnosis

• Outcome: Pass
• Latest audit: Sep 29, 2026 · 11:50 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed, read-only Huawei Cloud CDN DNS diagnostic helper that checks domain resolution and IP attribution without changing account settings.

Install this only for Huawei Cloud CDN DNS diagnosis. Use a dedicated read-only IAM credential, do not paste AK/SK into chat or logs, and expect the skill to run DNS lookups plus hcloud CDN query commands; configuration changes must be done separately outside this skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a multi-step Huawei Cloud CDN diagnosis flow: get CDN domain details, extract expected CNAME, probe actual DNS resolution, and verify resolved IP ownership against Huawei Cloud CDN. The actual code chunk only implements one supporting subtask: DNS A-record lookup for a domain. This is not malicious or unrelated, but it is materially narrower than the declared primary purpose and omits key advertised capabilities and resource accesses. Therefore the description does not accurately represent what this specific supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "DNS配置" is broad enough to activate this skill for requests that involve DNS changes rather than read-only diagnosis. In an agent setting, ambiguous routing can cause the wrong skill to engage, creating unsafe or misleading handling of change-oriented requests despite the read-only intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Broad phrases like "DNS异常" can match many unrelated DNS problems outside CDN-resolution diagnosis, increasing the chance of incorrect invocation. Misrouting is dangerous here because the skill includes command execution guidance and could lead operators or agents to perform irrelevant probing or disclose account/domain context unnecessarily.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

>
> If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
>
> - **Stop immediately** - Do not execute any commands
>
> - **Politely refuse** and return the following message:
>

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file tells users to run hcloud configure and then enter AK/SK and region, but it does not warn that AK/SK are sensitive credentials that should be protected and not shared or committed. Under the markdown variant of SQP-2, credential-related behavior that affects privacy or security should include a user warning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown repeatedly defines success specifically as resolving to Huawei Cloud CDN and labels other outcomes as failures or warnings. That is a natural-language policy concern because it enforces a provider-specific constraint without stating that the skill is intentionally scoped to Huawei Cloud or giving the user an opt-in choice.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

Ensure the IAM user has the required permissions. See [references/iam-policies.md](references/iam-policies.md) for details.

**Minimum required permissions:**

- `cdn:*:query*` — All CDN query-class actions used by this skill (`ListDomains/v2`, `ShowDomainDetailByName`, `ShowIpInfo/v2`)
- `cdn:configuration:queryDomains` — List CDN domains (listed explicitly alongside the wildcard)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The prescribed refusal message tells users to use the Huawei Cloud CDN console, DNS service console, or hcloud CLI manually, which hard-codes a specific platform/tooling path in natural language. This is a mild policy concern because it imposes a fixed operational route rather than offering a neutral choice or documenting why that vendor-specific constraint is required for all users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file repeatedly states that cn-north-1 is the recommended region, which is a locale/region preference expressed in natural language. The document does not offer a user choice or explain why this China-region default is required for all users, so it may conflict with a language/locale policy requiring opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This line again recommends cn-north-1 as the region for the command, imposing a locale/region preference in the documentation. Because the file does not clearly justify that this API must be used only in that region or provide an opt-in choice, it may violate locale policy expectations.

Content

No source excerpt is available for this finding.