Security audit
Security checks for vulnerabilities and agentic risk
This tool performs real database failovers, but its safety checks and success reports can give misleading reassurance.
Use a test instance and narrowly scoped credentials. Before production use, require enforced target confirmation and cross-zone checks, and independently verify backups, data integrity, and application health. Do not treat generated scores as proof of safety. Prefer a verified CLI download over executing the remote installer directly.
scripts/execute.pyReal failover lacks an executable confirmation gate
An invocation without the required confirmation can switch the configured instance's roles and interrupt client connections. This is an unsafe execution path, not evidence of a deliberately malicious failover.
The supplied execution implementation does not substantiate the advertised data consistency validation: it records post-failover measurements and treats some unavailable evidence as successful checks. Execution also makes some architecture checks configuration-dependent and does not explicitly enforce cross-AZ placement, creating unsafe assurance around a real database mutation; however, the default business score is disclosed in this document rather than concealed.
The advertised mandatory cross-AZ gate conflicts with the supplied risk model's warning-only treatment of same-AZ deployments and the absence of an explicit cross-AZ execution gate. This can incorrectly suggest that a drill validates AZ resilience; the more specific allegations about preparation readiness calculations cannot be verified because prepare.py was not supplied.
The curl-to-bash command immediately executes a mutable remote script without independently authenticating its contents. HTTPS protects transport but does not prevent a compromised publisher or storage endpoint from supplying code that steals local cloud credentials or modifies the host.
# Linux / macOS
curl -sSL https://cn-north-4-hwc-cloudsite.obs.cn-north-4.myhuaweicloud.com/hcli/install.sh | bash
# Windows (PowerShell admin)
Invoke-WebRequest -Uri https://cn-north-4-hwc-cloudsite.obs.cn-north-4.myhuaweicloud.com/hcli/install.ps1 -OutFile install.ps1
Piping the network response directly into bash turns fetched content into executable instructions without a verification boundary. This is the same supply-chain exposure identified by the external-script finding, not evidence of a separate malicious chaining campaign.
# Linux / macOS
curl -sSL https://cn-north-4-hwc-cloudsite.obs.cn-north-4.myhuaweicloud.com/hcli/install.sh | bash
# Windows (PowerShell admin)
Invoke-WebRequest -Uri https://cn-north-4-hwc-cloudsite.obs.cn-north-4.myhuaweicloud.com/hcli/install.ps1 -OutFile install.ps1
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
| Level | Meaning | Impact on flow |
|-------|---------|----------------|
| 🟢 info | Normal, no risk signal | No warning, no block |
| ⚪ unknown | Data missing (no permission / timeout / no CES data / API unsupported) | Overall level raised to "medium", prompts manual confirmation; **not auto-passed** |
| 🟠 warning | Risk signal present, recommend handling or confirmation | Overall level raised to "medium", console/report warning; no auto-block |
| 🔴 critical | Very likely to affect failover success or data safety | Overall level raised to "blocked", execute rejects by default (requires `--force`) |
Without declared permissions the skill's intent is opaque and cannot be validated.
The recommended installation path executes remotely downloaded code without an integrity-verification step or explanation of its system changes. A compromised distribution endpoint could execute arbitrary code, with administrator privileges in the Windows example, on a machine used for cloud administration.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# Risk Model (Threshold Business Semantics)
This document describes the threshold business rationale for **risk detection / assessment / warning** in `scripts/risk.py`.
The prepare phase automatically runs detection and assessment.
> 📌 **Single source of truth for thresholds**: all threshold values are authoritatively defined in the `THRESH` constant in `scripts/risk.py`.
> This document only describes the **business semantics and rationale** for each threshold; it does not duplicate threshold values.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if extra_args:
cmd.extend(extra_args)
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
except subprocess.TimeoutExpired:
return {"_error": True, "stderr": f"hcloud 命令超时（{timeout}s），请检查网络或减少查询范围"}
except FileNotFoundError:
The function does not capture or compare pre-failover data and instead labels topology changes and post-failover measurements as data consistency checks. Topology-query failures, missing key counts, and a missing topology master can be marked successful, allowing a clean verdict and inflated data score without evidence that data survived the drill.
Business health always receives 100 points and contributes 30% of the total without any availability, connection, or latency measurement. Although the skill documentation discloses this placeholder, the resulting numeric score can still overstate operational safety when applications are impaired.
The checker treats listed policy definitions as evidence of the current principal's permissions without establishing assignment or evaluating applicable resource scopes and conditions. It can therefore report failover authorization incorrectly, undermining preparation for a production-affecting drill; however, this result is advisory and does not bypass Huawei Cloud's server-side authorization.
The cross-AZ check explicitly sets critical=False, so a same-AZ deployment can fail this check while the preparation reports still declare it ready for failover. This contradicts both the advertised hard gate and the generated require_cross_az=True setting, potentially encouraging a disruptive production drill that cannot validate AZ resilience; whether execution independently blocks it cannot be determined from this file.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
elif phase == "report":
cmd.extend(["--config-dir", config_dir])
result = subprocess.run(cmd, cwd=SCRIPT_DIR)
return result.returncode == 0
The interaction rule prescribes the Chinese confirmation options “强制演练 / 取消演练”; line 171 repeats that these are the only user-facing options. Unlike illustrative dialogue, this mandates specific-language output without offering a language choice or documenting a locale requirement.