Security audit

huawei-cloud-dataarts-datasync-planner

Security checks for vulnerabilities and agentic risk

Overview

This planning skill needs review because its migration advice suggests disabling authentication without explaining the security impact.

Use this as a planning assistant, and have its proposed migration settings reviewed before implementation. Preserve existing authentication where possible; obtain your security owner's approval before disabling Kerberos or changing encryption settings. The bundled script generates reports and does not deploy migrations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code implements the declared Excel-reporting component, but not the automated planning and validation capabilities central to the description. Product choices, integration modes, configurations, constraints, and alternatives are input fields or hard-coded example text rather than computed results. Scheme-type normalization and conditional sheet generation are presentation logic, not pipeline analysis. No network access, cloud-resource discovery, or unrelated behavior is evident. This assessment is limited to the supplied code chunk.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
> Complete MD document template: see [references/md-report-template.md](references/md-report-template.md) > Python script implementation: see [scripts/generate_datasync_report.py](scripts/generate_datasync_report.py) ## Output Rules - **MD document 3 major sections**: existing data pipeline topology diagram + existing pipeline description (data source location/real-time or offline/frequency/data volume) + replacement solution topology diagram and description (directly use CDM/migration/DRS product names, do not repeat DataArts Studio) - **Solution type annotation**: each solution must be annotated: direct match / Huawei Cloud feasible solution (indirect) / third-party software solution

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/md-report-template.md (reported line 24)May include surrounding context.
md
## I. Existing Data Pipeline Topology Diagram ```text <ASCII topology diagram: showing all pipeline source → target topology> ```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/md-report-template.md (reported line 26)May include surrounding context.
md
```text <ASCII topology diagram: showing all pipeline source → target topology> ``` ---

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/md-report-template.md (reported line 54)May include surrounding context.
md
### Replacement Solution Topology Diagram ```text <ASCII topology diagram: showing Huawei Cloud-side replacement solution topology, directly annotate product names CDM/migration/DRS> ```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/md-report-template.md (reported line 56)May include surrounding context.
md
```text <ASCII topology diagram: showing Huawei Cloud-side replacement solution topology, directly annotate product names CDM/migration/DRS> ``` ### Solution Description

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Recommends downgrading Kerberos encryption without warning about security implications.

Medium

Category: Output Handling
Confidence: 92% confidence
Finding: The compatibility guidance recommends downgrading Kerberos encryption without specifying acceptable replacement algorithms or requiring security review. In a migration-planning context, this could lead users to weaken authentication protections or violate security policy, although not every alternative encryption type is necessarily insecure and the skill does not perform the change itself.
Content: No source excerpt is available for this finding.

Requires Chinese worksheet labels without offering a language choice.

Low

Category: Output Handling
Confidence: 87% confidence
Finding: The verification instruction requires report worksheets with specific Chinese labels, reinforcing the sheet names described in Phase 6. This imposes a language on part of the generated output without user opt-in or a documented locale requirement.
Content: No source excerpt is available for this finding.