Security audit
Security checks for vulnerabilities and agentic risk
This monitoring skill needs review because its recommended permissions extend to controlling servers and accessing account-user information.
Use a dedicated monitoring profile with only the minimum read-only permissions, scoped to the intended project. Keep server actions, tag changes, and alarm modifications separately authorized. Verify CLI downloads and container provenance, avoid sharing all saved profiles, and keep inventory caches private. Uninstall instructions erase saved configuration. The scanner's material reference gaps were investigated, but external installer and image payloads remain unreviewed.
The supplied commands manage ECS instance metadata rather than query CES performance metrics. Viewing tags could support instance identification, but creating, updating, and deleting tags are resource-modification capabilities not disclosed by the monitoring-focused description. The chunk provides command examples; it does not demonstrate that they have been executed.
The command targets IAM user records rather than ECS instances or CES metrics. The supplied chunk establishes no monitoring-related need for this identity lookup, so it represents an undeclared resource-access capability rather than a demonstrated supporting implementation detail.
Referenced artifact was not completely inspected
Additional optional permissions (e.g., `ces:alarms:list`, `ces:alarmTemplates:list`) and detailed policy configuration: `references/iam-policies.md`
Referenced artifact was not completely inspected
permission error (e.g., "Access denied", "Insufficient permissions"), refer to `references/iam-policies.md` for the complete handling process, including require
Referenced artifact was not completely inspected
- `iam-policies.md`: Required IAM permissions and policies
Referenced artifact was not completely inspected
For more security best practices (key rotation, IAM conditions, account separation), see `references/iam-policies.md`.
Referenced artifact was not completely inspected
**[MUST]** Before executing any CLI command, read `references/related-commands.md` for command format standards.
Referenced artifact was not completely inspected
refer to 'references/related-commands.md'
Referenced artifact was not completely inspected
- `related-commands.md`: Related command reference
Referenced artifact was not completely inspected
Please refer to `references/best-practices.md` for detailed best practices, including metric selection guidelines, alerting strategy, monitoring frequency recom
Referenced artifact was not completely inspected
- `best-practices.md`: Monitoring best practices and optimization tips
Referenced artifact was not completely inspected
- `troubleshooting-guide.md`: Common issues and solutions
Referenced artifact was not completely inspected
For common errors and detailed solutions, see `references/troubleshooting-guide.md`.
The command immediately executes a script downloaded from a mutable latest URL without authenticating the artifact. HTTPS protects transport but does not prevent a compromised distribution endpoint from supplying code that can access the user's files and cloud credentials.
# Download and run official installation script (interactive)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
# Non-interactive installation (skip confirmation)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
This variant executes the same unverified, mutable remote installer in non-interactive mode. A compromised installer would run with the invoking user's access, while the confirmation bypass reduces opportunities to notice unexpected installation behavior.
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
### Verify Installation
The Docker build executes an unverified remote installer, normally as root inside the build container. A compromised installer can contaminate the resulting image, which is subsequently recommended for use with mounted cloud credentials; container root does not by itself imply host root.
FROM ubuntu:latest
RUN apt-get update -y && apt-get install curl -y
RUN curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
WORKDIR /workspace
ENTRYPOINT ["/usr/local/bin/hcloud"]
Installing into a user directory avoids root privileges but still executes an unauthenticated script from a mutable URL. Malicious replacement code could access the user's cloud credentials, alter shell configuration, or modify other user-owned files.
sudo bash ./hcloud_install.sh
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -d ~/.local/bin
#### Command Not Found
The reinstall procedure repeats the immediate execution of an unverified script from the latest endpoint. Repeated updates create recurring opportunities for a compromised distribution source to execute code with access to local cloud credentials.
hcloud update
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
### Uninstall KooCLI
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
# Windows manual uninstallation:
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
# Windows manual uninstallation:
The command deletes all CLI profiles and locally stored configuration without a data-loss warning or separate purge confirmation. This is the same configuration-loss issue identified by SQP-2, not deletion of the entire home directory.
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
# Windows manual uninstallation:
# 1. Delete hcloud.exe file
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/
# Windows manual uninstallation:
# 1. Delete hcloud.exe file
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Clean KooCLI cache
rm -rf ~/.hcloud/cache/
# Clean downloaded files
rm -f hcloud_install.sh huaweicloud-cli-*.tar.gz huaweicloud-cli-*.zip
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Clean KooCLI cache
rm -rf ~/.hcloud/cache/
# Clean downloaded files
rm -f hcloud_install.sh huaweicloud-cli-*.tar.gz huaweicloud-cli-*.zip