huawei-cloud-cdn-domain-ownership-verification

• Outcome: Pass
• Latest audit: Sep 29, 2026 · 10:34 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent read-only diagnostic helper for Huawei Cloud CDN ownership verification, with disclosed use of hcloud credentials and bounded DNS/HTTP probes.

Install only if you are comfortable letting the agent use your configured hcloud account for read-only CDN queries and make DNS/HTTP diagnostic requests for the target domain. Use least-privilege Huawei Cloud credentials, do not paste AK/SK into chat, and prefer an approved DNS resolver when the domain name is sensitive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is narrower than the declared description. It only implements a DNS TXT probe helper: validate a DNS name/resolver/timeout, query TXT records via dnspython, and emit structured JSON. While this could be a supporting component for diagnosing TXT-based ownership verification, it does not perform several core functions promised by the description: it does not inspect CDN-side verification settings, does not choose between DNS TXT and file verification, does not fetch verification files, does not compare actual values to expected verify_content, and does not invoke hcloud CLI. The code is read-only and related to one part of the domain verification workflow, but the declared primary purpose overstates the implemented behavior enough to be a material mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a broader diagnostic workflow for CDN domain ownership verification: determine whether verification is DNS TXT or file-based, retrieve the configured expected verification content, probe the corresponding live record/file, and compare expected vs actual to identify failure causes. The supplied code implements only one narrow subtask: fetching a given HTTP/HTTPS URL and returning response metadata and a content preview. While this could support file-verification troubleshooting, it lacks several core declared behaviors, especially querying CDN-side configuration, handling DNS TXT verification, and performing expected-vs-actual verification analysis. The code is still read-only and does not introduce suspicious write capabilities, but its actual functionality is materially narrower and different from the declared end-to-end purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill performs network-capable diagnostic actions but does not declare a restrictive tool scope such as explicit allowed tools or permissions. In an agent environment, missing tool scoping can let the skill invoke broader-than-intended capabilities, increasing the chance of unintended command execution or external access beyond the read-only diagnosis described.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md

>
> If the user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
>
> - **Stop immediately** - do not execute any commands
> - **Politely refuse** and return the following message:
>
> ```

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown instructs users to run hcloud configure and enter AK/SK credentials, but it does not warn that these are sensitive access keys or advise users to protect them. Because this documentation directly guides credential entry and later notes that the CLI will automatically read a local configuration file, a user-facing warning about secret handling and local storage is expected.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/task-file-probe.md (reported line 107)May include surrounding context.

md

| Exception Scenario | Handling |
|--------------------|----------|
| `requests` library missing (`error.reason == "missing_library"`, exit code 2) | Abort the skill and prompt the user to run `pip install requests>=2.25 dnspython>=2.1` (see [cli-installation-guide.md](cli-installation-guide.md)) |
| TLS certificate error (`error.reason == "tls_handshake_failed"`) | Do not bypass verification; report the failure and recommend manual verification of the origin certificate |
| Redirect | Redirects are NOT followed (`allow_redirects=False`); a 3xx `data.http_status` is reported as-is so the operator can decide |
| Timeout (`error.reason == "connect_timeout"`) | Return partial results, mark "File probe timed out, recommend manual verification" |
| Unexpected probe error (`error.reason == "unexpected_probe_error"`) | The full traceback is written to stderr (not stdout); the report displays a generic failure |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/task-verify-info-query.md (reported line 52)May include surrounding context.

md

| Exception Scenario | Handling |
|--------------------|----------|
| API returns non-200 | Degrade to probe-only results, mark "API query failed, only probe results provided" |
| Return fields are empty | Report "No verification info obtained. Please confirm the domain access status." |
| Network timeout | Retry once; if still failing, degrade handling |

## Example

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md

Ensure the IAM user has the required permissions. See [references/iam-policies.md](references/iam-policies.md) for details.

**Minimum required permissions:**

- `cdn:*:query*` — All CDN query-class actions used by this skill (`ListDomains/v2`, `ShowVerifyDomainOwnerInfo`)
- `cdn:configuration:queryDomains` — List CDN domains (listed explicitly alongside the wildcard)

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file states that when dnspython is missing, the user should run pip install requests>=2.25 dnspython>=2.1, but elsewhere the documented prerequisite is specifically dnspython >= 2.1 importable. Including requests in the remediation contradicts the stated dependency and implies an extra capability/library not needed for the described DNS TXT probe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill recommends retrying DNS TXT lookups against a public resolver such as 8.8.8.8 without warning that this discloses the queried verification hostname to a third party outside the user's normal DNS path. In a troubleshooting context this is not catastrophic, but it can leak internal, pre-production, or otherwise sensitive domain names and create avoidable privacy/compliance issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples print verify_content directly in user-facing output, which can normalize unsafe handling of verification tokens and lead downstream implementations or operators to expose values that may be sensitive in some environments. Although domain verification tokens are usually lower sensitivity than credentials, the file itself already defines a redaction rule for credential-like content, so the unredacted examples create inconsistent guidance and increase the chance of accidental disclosure.

Content

No source excerpt is available for this finding.