ClawHub
Back to skill

Security audit

huawei-cloud-ecs-query

Security checks for vulnerabilities and agentic risk

Overview

This read-only cloud query skill requires a downloaded command wrapper whose data handling and persistent installation are insufficiently explained.

Review the required quality wrapper before installing or supplying credentials. Its implementation is not bundled, so its logging, reporting and credential exposure cannot be determined from this package. Prefer a version that removes the requirement or makes an authenticated, pinned wrapper optional with clear data controls. Use dedicated read-only cloud credentials, protect the configuration file, and have an administrator handle any IAM grants separately. No malicious behavior was established in the bundled query code.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
Findings (14)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

ListPoliciesV5 查询的是 IAM 策略，AttachUserPolicyV5 则会更改用户的策略绑定，可能授予权限。这与声明的 ECS 只读查询用途不符，也不是完成 ECS 查询所需的只读实现细节。命令中的用户和策略 ID 虽为占位符，但其体现的写操作能力仍构成明确不匹配。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Installing the mandatory quality wrapper adds persistent executable software that is unnecessary for the declared ECS-query function. Local dependency installation is not inherently inconsistent with read-only cloud operations, but this unrelated, unverified dependency materially expands the trust boundary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documentation mandates an unrelated quality CLI around credential-bearing cloud commands and permits bootstrapping it outside that wrapper. The supplied installer downloads unverified executable artifacts into a persistent executable directory, introducing a supply-chain dependency beyond ECS querying; compromise could expose local files and cloud credentials.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/ensure_cli.sh (reported line 16)May include surrounding context.

sh
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"

V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
    echo "警告: 无法获取 skill-quality-cli 最新版本，跳过安装" >&2
    exit 0

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/install_cli.sh (reported line 12)May include surrounding context.

sh
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"

V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
    echo "无法获取 skill-quality-cli 最新版本" >&2
    exit 1

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, network, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The recommended installation executes a downloaded shell script without warning about running external code or modifying the local environment.

Medium
Category
Output Handling
Confidence
95% confidence
Finding

The recommended commands download a mutable remote shell script and execute it without release pinning or integrity verification. HTTPS and an apparent official hosting domain reduce interception risk but do not prevent a compromised distribution endpoint from supplying code that can access local cloud credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/auth.py (reported line 175)May include surrounding context.

python
}
        }

        resp = requests.post(
            url,
            json=body,
            headers={"Content-Type": "application/json"},

Installs an unrelated quality CLI into the user's persistent executable directory.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

This bootstrapper downloads a remotely selected release without checking a signature or trusted digest, extracts it, and installs executable components into ~/.local/bin. Compromise of the release service or artifact store could therefore introduce persistent code that later runs with the user's access, including access to cloud credentials.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/ensure_cli.sh (reported line 35)May include surrounding context.

sh
tar xzf "${TMPDIR}/sqc.tar.gz" -C "${TMPDIR}"

mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${TMPDIR}/skill-quality-cli" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.bin" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.d/cli_entry.py" ~/.local/bin/skill-quality-cli.d/ 2>/dev/null

Installs an unrelated skill-quality CLI outside the ECS-query skill's stated purpose.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

Although manually triggered, this installer trusts a mutable remote version response and installs downloaded executable artifacts without signature or digest verification. A compromised distribution source could install persistent code with the user's privileges; manual invocation does not authenticate the software being installed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_cli.sh (reported line 25)May include surrounding context.

sh
curl -fsSL -o "${TMPDIR}/sqc.tar.gz" "${OBS_BASE}/v${V}/skill-quality-cli-v${V}-linux-${ARCH}.tar.gz"
tar xzf "${TMPDIR}/sqc.tar.gz" -C "${TMPDIR}"

mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${TMPDIR}/skill-quality-cli" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.bin" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.d/cli_entry.py" ~/.local/bin/skill-quality-cli.d/ 2>/dev/null

Acceptance criteria require Chinese status explanations without a user language choice.

Low
Category
Output Handling
Confidence
97% confidence
Finding

The criterion explicitly requires server-status to return the status with a Chinese explanation (「中文说明」). This prescribes an output language without user opt-in or a documented justification for the restriction.

Content

No source excerpt is available for this finding.

L69 requires Chinese-language status descriptions without offering a language choice or documenting a justification.

Low
Category
Output Handling
Confidence
92% confidence
Finding

The expected-result specification explicitly requires the status column to include Chinese explanations. This imposes a specific output language without user opt-in or a documented locale-specific reason.

Content

No source excerpt is available for this finding.