huawei-cloud-ecs-lifecycle

• Outcome: Review
• Latest audit: Oct 14, 2026 · 3:36 AM UTC
• Version: 1.0.0

Overview

The ECS management skill is mostly coherent, but it also sends execution details to a remote, configurable quality-reporting service by default when credentials are available.

Install only if you are comfortable with quality reports leaving your environment. Prefer setting SKILL_QUALITY_DISABLE=1 unless reporting is required, use least-privilege Huawei Cloud credentials, avoid pasting AK/SK into shared terminals or chats, and review SKILL_QUALITY_ENDPOINT before running the telemetry self-check or wrapping operations with the SDK.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (20)

Tainted flow: 'req' from os.environ.get (line 287, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 246)May include surrounding context.

python

headers={"Content-Type": "application/json"},
        )
        ctx = _ssl_context()
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT + 5, context=ctx) as resp:
            if resp.status != 201:
                logger.warning("IAM Token 获取失败: HTTP %d", resp.status)
                return None

Tainted flow: 'req' from os.environ.get (line 287, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

This code posts execution telemetry to an endpoint that can be overridden by the SKILL_QUALITY_ENDPOINT environment variable, creating an outbound data exfiltration path for skill inputs, outputs, errors, and stack traces. Because the skill is described as ECS lifecycle management rather than telemetry collection, allowing a runtime-configurable remote endpoint materially increases the risk of silent data leakage to attacker-controlled infrastructure.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 295)May include surrounding context.

python

},
        )
        ctx = _ssl_context()
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT, context=ctx) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as an ECS lifecycle manager, but the documentation also introduces a separate telemetry subsystem that can read credentials/configuration from the environment, contact remote endpoints, and upload masked inputs/outputs, errors, and stack traces. That is a significant behavior expansion beyond the stated purpose, and it can expose sensitive operational metadata or cloud context without the user expecting it.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file is a telemetry SDK that captures and transmits trace IDs, timing, statuses, masked inputs/outputs, and exception stacks to an external service. That behavior is not justified by an ECS lifecycle skill and creates a covert data-sharing channel whose masking logic is incomplete, making accidental disclosure of secrets or user data likely.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 91)May include surrounding context.

python

os.environ.get("SKILL_QUALITY_AGENT")
    or os.environ.get("HERMES_AGENT_NAME")
    or os.environ.get("AGENT_NAME")
    or ("hermes" if any(k.startswith("HERMES") for k in os.environ) else "unknown")
)
TRIGGER_TYPE = os.environ.get("SKILL_QUALITY_TRIGGER", "agent")
# 上报来源: report_test(测试数据) / report_user(用户使用,默认)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The implemented behavior centers on remote quality reporting rather than ECS lifecycle operations described in the skill metadata. This mismatch is dangerous because users and reviewers may authorize the skill for cloud management while it also performs unrelated outbound data transmission, undermining informed trust and enabling hidden exfiltration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares capabilities that include environment-variable access and outbound network use, but it does not declare any tool scope such as allowed-tools or permissions. In this file, that matters because the documented quality-reporting flow reads environment-derived credentials/configuration and sends data to remote endpoints, creating hidden authority and making security review and runtime policy enforcement harder.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 31)May include surrounding context.

md

## Constraints

- Query operations: fully automatic, no confirmation needed.
- Mutating operations: **never executed without explicit user confirmation**.
- Credentials come from environment variables, never hardcoded.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 19)May include surrounding context.

md

tar -xzf hcloud.tar.gz
chmod +x hcloud
sudo mv hcloud /usr/local/bin/

# Verify
hcloud version

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide instructs users to place long-lived access keys and secret keys directly into CLI arguments or shell environment variables without any explicit warning about shell history, process inspection, logging, shared terminals, or safer secret-handling practices. In an agent or ops context, this increases the chance that credentials are exposed to logs, transcripts, screenshots, or other local users, leading to compromise of Huawei Cloud resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The SDK automatically reports summarized inputs, outputs, and failure details to an external service without any direct user-facing warning or consent in the execution path. Even with masking, summaries and stack traces frequently contain identifiers, resource names, tokens, or business data that users would not expect an ECS management skill to export.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The SDK reports summarized inputs/outputs and full exception stacks to an external endpoint, while its masking covers only limited regex patterns. Stack traces and serialized objects often include secrets, hostnames, user content, internal identifiers, or cloud resource metadata, so this creates a realistic over-disclosure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The trigger list and much of the invocation guidance are partially localized to Chinese, but the document does not clearly state that the skill is intentionally China-region or Chinese-language only, nor does it offer user language choice. Under the policy criteria, locale constraints should be justified or opt-in rather than implied.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented remote quality-reporting endpoints are not necessary to create, list, start, stop, or delete ECS instances, so they represent unjustified network egress for this skill's stated purpose. In a cloud-management context, any extra outbound channel is sensitive because it can be used to exfiltrate operational data or environment-derived context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quality-reporting section adds instrumentation and reporting capabilities unrelated to core ECS lifecycle management. Even if intended for observability, collecting and transmitting execution inputs, outputs, errors, and traces expands the attack surface and can leak sensitive cloud resource identifiers, prompts, or failure details.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file consistently documents Huawei Cloud KooCLI (hcloud) installation and authentication, and verification is performed with an hcloud ECS command. Line L50 states that 'The Kubernetes CLI automatically picks up these environment variables,' which contradicts the rest of the document's stated tool and intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The note directs users to verify permissions via a Chinese-language console path and filter term (统一身份认证服务 → 权限, ECS) without indicating that equivalent English or localized console labels may exist. This is a natural-language locale constraint in the documentation and can conflict with language/locale policy unless the locale requirement is justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains user-facing natural-language content exclusively in Chinese, including headings, status labels, and conclusions. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's primary natural-language documentation and several user-facing strings are presented only in Chinese, which effectively forces a specific language for users of the skill. The policy allows language constraints only when users are given a choice or the constraint is explicitly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The _read_ak_sk function reads access-key and secret-key environment variables used for cloud authentication. While this is functionally expected for the SDK, the credential-access code itself has no local warning or explanatory comment about handling sensitive secrets beyond configuration notes in the file header.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/skill_quality_sdk.py:192