huawei-cloud-cdn-universal-query

• Outcome: Pass
• Latest audit: Sep 29, 2026 · 10:37 AM UTC
• Version: 1.0.0

Overview

This is a read-only Huawei Cloud CDN query guide that uses local CLI credentials and can retrieve logs, but its sensitive access is disclosed and mostly bounded to CDN queries.

Install only if you are comfortable letting the agent run read-only hcloud CDN queries with your configured cloud identity. Use least-privilege IAM permissions, never paste AK/SK into chat, review commands before execution, and treat downloaded CDN logs or Excel reports as sensitive because they may contain client IPs, URLs, referers, and user-agent data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents this as a broad CDN query reference skill covering 44 read-only CDN APIs via hcloud CLI. The supplied code does none of that. It only computes date ranges and converts them to millisecond timestamps, likely as a helper for time-based queries. While this could be a supporting utility for CDN analytics workflows, it is not itself a CDN query reference skill and lacks the described API coverage, CLI usage, and CDN-specific inspection capabilities. Therefore the description materially overstates and misrepresents the code's actual behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata explicitly says the skill is read-only and must refuse write/modify/delete CDN operations, but the dataflow diagram includes BatchCopyDomain, which is a configuration-copy operation rather than a pure query. This mismatch can cause an agent to invoke a state-changing API under the guise of a safe fallback skill, violating least privilege and potentially altering production CDN configuration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The trigger phrases are broad enough to capture requests that belong to more specialized troubleshooting or analysis skills, causing skill misrouting. In an agentic environment, incorrect routing can lead to incomplete safety checks, poorer guidance, or execution of less appropriate command templates for the user's intent.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md

>
> If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
>
> 1. **Stop immediately** - Do not execute any commands
> 2. **Politely refuse** and return the following message:
>    ```
>    For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction "All commands should use --cli-region=cn-north-1" imposes a locale/region constraint across the entire skill. Under the policy, forced language or locale settings should either be optional for the user or clearly justified as region-specific; this file does not provide that justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction "All commands should use --cli-region=cn-north-1" imposes a fixed regional setting across the skill. Under the policy, locale or region constraints should either be user-selectable or clearly justified as region-specific; this file presents the requirement as unconditional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction 'All commands should use --cli-region=cn-north-1' imposes a fixed region for all usage in the document. This is a locale/region constraint presented as mandatory, but the file does not offer user opt-in, alternatives, or a clear justification that the skill is region-specific only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction 'All commands should use --cli-region=cn-north-1' imposes a fixed region across the document. This is a natural-language locale/region policy constraint without user opt-in or a documented justification that the skill is only for a China-region environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs users to run hcloud configure and enter AK/SK credentials but does not warn that these are sensitive secrets that must not be pasted into chats, logs, screenshots, shell history, or shared terminals. In a support-oriented skill, this omission can lead users to expose long-lived cloud credentials, enabling unauthorized access to CDN and potentially broader cloud resources depending on IAM scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The commands repeatedly force --cli-region=cn-north-1, which is a locale/region constraint expressed in natural language examples and command literals. The document does not state that this workflow is only for a China-region environment or offer an alternative region selection, so it may violate language/locale policy expectations requiring opt-in or clear justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow explicitly instructs users to retrieve CDN access logs and describes log contents including client IP, URLs, referer, and user-agent, which are sensitive operational and potentially personal data. While log retrieval is a legitimate read-only admin function, the document lacks any warning about data sensitivity, access control, minimization, secure storage, or compliance obligations, increasing the risk of unnecessary exposure or mishandling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow directly implements traffic anomaly investigation even though the skill metadata explicitly says anomaly-analysis scenarios should be handled by dedicated CDN skills, not this fallback reference. This creates unsafe routing and scope confusion: an agent may invoke the wrong skill, bypassing specialized guidance or guardrails and producing incomplete or misleading security analysis during an incident.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document instructs users to align timestamps to UTC+8 midnight, which imposes a specific locale/timezone behavior. Under the policy, forced locale constraints should be flagged unless the file offers opt-in choice or clearly justifies the regional restriction; this workflow does not provide either.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file presents bilingual triggers and examples, but the mandated refusal message is given only in English and is phrased as the exact response the agent must return. That creates a language-policy issue because users interacting in Chinese may receive English output without being offered a language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The section labels a specific English message as the response to return when users provide credentials. Because the skill otherwise supports both Chinese and English usage, mandating a single-language response can violate language/locale policy when the user's preferred language is different.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/api-statistics.md (reported line 248)May include surrounding context.

md

- `--country` (optional): Valid values: `all` for all countries, or specific country code (e.g. `cn`); 访问区域情况数据时只能填 `cn`

**Pitfalls:**
- #4: `--group_by` supports `domain`/`country`/`province`/`isp` (not limited to `country`; `province` only effective when country=cn) — corrected per CLI help
- #14: `--stat_type` is required

**Note:** This API may return empty results for some domains.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill covers all 44 GET read-only CDN APIs, but this file states the pitfalls were validated through testing of all 45 GET CDN APIs. This is a direct contradiction in the skill's own documentation about the scope of API coverage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L060 includes the natural-language note 访问区域情况数据时只能填 cn embedded in otherwise English documentation. This imposes a language/locale-specific instruction without offering the user a language choice or providing an English equivalent, which is a natural-language policy concern under the locale/language rule.

Content

No source excerpt is available for this finding.