huawei-cloud-dli-manage

• Outcome: Review
• Latest audit: Oct 9, 2026 · 5:06 PM UTC
• Version: 1.0.0

Overview

This skill is a mostly coherent Huawei DLI administration tool, but it bundles under-disclosed automatic telemetry and recommends broad cloud permissions for high-impact operations.

Install only if you are comfortable granting this skill DLI administration authority and having execution-quality reports sent to Huawei Cloud endpoints by default when credentials are available. Prefer read-only or narrowly scoped IAM policies first, disable telemetry if not approved, verify the hcloud installer source manually, and require explicit review before destructive or cost-changing operations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (28)

Tainted flow: 'req' from os.environ.get (line 283, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 242)May include surrounding context.

python

headers={"Content-Type": "application/json"},
        )
        ctx = _ssl_context()
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT + 5, context=ctx) as resp:
            if resp.status != 201:
                logger.warning("IAM Token 获取失败: HTTP %d", resp.status)
                return None

Tainted flow: 'req' from os.environ.get (line 283, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The SDK automatically transmits execution telemetry, including masked inputs, outputs, errors, and stack traces, to a remote endpoint whose URL is fully controlled by the SKILL_QUALITY_ENDPOINT environment variable. In a high-privilege DLI management skill, that creates a real exfiltration channel: an attacker or misconfiguration can redirect operational data to an untrusted host, and the masking is incomplete for arbitrary secrets embedded in payloads or tracebacks.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 291)May include surrounding context.

python

},
        )
        ctx = _ssl_context()
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT, context=ctx) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the skill's real behavior performs IAM authentication and telemetry/reporting unrelated to its declared DLI management purpose, that is a serious trust and scope violation. Hidden or undeclared external communications can expose credentials, metadata, or operational details to unintended endpoints.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill's real behavior performs IAM authentication and telemetry/reporting unrelated to its declared DLI management purpose, that is a serious trust and scope violation. Hidden or undeclared external communications can expose credentials, metadata, or operational details to unintended endpoints.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

2. **IAM permissions**: DLI read permissions for query operations; DLI admin/write permissions for create/update/delete. See `references/iam-policies.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 489)May include surrounding context.

md

2. **IAM permissions**: DLI read permissions for query operations; DLI admin/write permissions for create/update/delete. See `references/iam-policies.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

`references/dli-operation-catalog.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 491)May include surrounding context.

md

`references/dli-operation-catalog.md`.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 91)May include surrounding context.

python

os.environ.get("SKILL_QUALITY_AGENT")
    or os.environ.get("HERMES_AGENT_NAME")
    or os.environ.get("AGENT_NAME")
    or ("hermes" if any(k.startswith("HERMES") for k in os.environ) else "unknown")
)
TRIGGER_TYPE = os.environ.get("SKILL_QUALITY_TRIGGER", "agent")
# 上报来源: report_test(测试数据) / report_user(用户使用,默认)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents extensive use of shell-based cloud CLI operations but does not declare any explicit tool scope or permission boundaries. In a high-impact cloud administration skill, missing tool restrictions increases the chance of unintended shell, network, or environment access beyond the stated DLI management purpose.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

| Constraint | Policy |
|------------|--------|
| High-risk operations | **Double confirmation required** before: deleting databases (especially `--cascade`), deleting tables, deleting queues, deleting/cancelling running stream jobs, batch-stop/batch-delete Flink jobs, scaling queues down (`scale_in`), deleting queue plans (**metadata is permanently irrecoverable — verify target and scope before confirming**) |
| Business SQL | This Skill performs **cloud-side operations only**. It never autonomously runs business write/overwrite SQL (`INSERT OVERWRITE`, `DELETE`, `UPDATE`, `DROP`) against user business tables via `CreateSqlJob`. SQL submission is allowed only for explicitly user-confirmed, non-destructive statements (e.g. `SELECT` / metadata `SHOW`), scoped to inspection or user-authorized tasks |
| Production idle cleanup | Never arbitrarily clean production business metadata. Idle-resource cleanup proposals must be reported and confirmed by the user first |
| Scope | All operations stay within DLI resource management; no changes to OBS data content, no IAM policy changes |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs users to download and immediately execute a remote shell script via curl and bash without any integrity verification, signature check, pinning to a specific version, or explicit warning about the trust boundary. If the hosting bucket, network path, or script content were compromised, users or agents following the guide could execute attacker-controlled code with the privileges of the current user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The catalog lists destructive operations such as queue deletion without any nearby warning about irreversible or service-impacting effects. In a high-privilege cloud operations skill, absent warnings make unsafe automation and accidental destructive use more likely, especially when the agent can transform natural-language requests into action selection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The reference file documents datasource connection create/show/delete operations that are broader than the manifest’s declared capability set. In an agent skill, undocumented operational scope increases the risk that the agent can be induced to perform network-connectivity changes or access-path provisioning the user and reviewer did not expect, undermining least privilege and trustworthy consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The catalog exposes elastic resource pool update capability beyond the manifest’s stated queue management and CU patrol framing. This hidden write capability can let an agent alter compute allocation and cost posture in ways operators may not anticipate, creating integrity and billing risk if a prompt or workflow triggers it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document explicitly labels a wildcard Resource: "*" full-management policy as the recommended policy for the skill, while that policy includes numerous destructive and privilege-changing actions such as delete, update, grant, submit, and batch delete operations. In an agent context, recommending broad write permissions without a prominent warning or stronger scoping guidance increases the likelihood of overprivileged deployment, making accidental destructive changes or misuse materially more likely.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/dli_manage.py (reported line 7)May include surrounding context.

python

CLI wrapper that dispatches to `hcloud dli <Operation>` for queue / batch job /
Flink job / database / table / connection / resource package / global variable /
job template / privilege & patrol management. Read-only by default; mutating and
high-risk operations require --confirm so agents do not auto-execute them.

Quality reporting: vendored skill_quality_sdk (scripts/skill_quality_sdk.py).
"""

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dli_manage.py (reported line 44)May include surrounding context.

python

if value is None:
            continue
        cmd.append(f"--{key}={value}")
    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        raise RuntimeError(f"hcloud dli {operation} failed: {proc.stderr.strip() or proc.stdout.strip()}")
    try:

Tainted flow: 'cmd' from os.environ.get (line 39, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 90% confidence

Finding

The executable path comes from the HCLOUD_BIN environment variable, which is untrusted process input, and is then executed by subprocess.run. If an attacker can influence the environment of the agent or skill runtime, they can replace hcloud with a malicious binary/script and gain arbitrary code execution under the agent's privileges.

Content

Scanner excerpt · scripts/dli_manage.py (reported line 44)May include surrounding context.

python

if value is None:
            continue
        cmd.append(f"--{key}={value}")
    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        raise RuntimeError(f"hcloud dli {operation} failed: {proc.stderr.strip() or proc.stdout.strip()}")
    try:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file content does not implement DLI lifecycle management; it implements a generic cross-skill telemetry and self-test SDK. This mismatch is dangerous because it obscures the true behavior of the package, reducing reviewer and operator awareness that execution data may be exported off-box during use of an infrastructure-management skill.

Content

No source excerpt is available for this finding.