ClawHub
Back to skill

Security audit

huawei-cloud-functiongraph-function-create

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Huawei FunctionGraph deployment purpose, but its guidance includes overbroad cloud permissions and optional steps that can expose or mutate cloud resources without enough caution.

Install only if you intend to let the agent help create and test Huawei FunctionGraph resources. Use a dedicated IAM user, avoid the full-access policy examples, scope permissions to the target project/functions, review any trigger creation before running it, and remove test triggers or debug settings after verification.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)

Instruction Override

High
Category
Prompt Injection
Content
# Verify policy attachments
hcloud IAM policy list-attachments --policy_id=POLICY_ID

# Enable debug mode for detailed error
hcloud --debug FunctionGraph function create --func_name=test
```
Confidence
70% confidence
Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill references environment-variable credentials and local file/script execution behavior, but it does not declare any explicit tool scope such as allowed-tools or permissions. In an agent environment, this can cause the skill to be invoked with broader-than-expected access to environment secrets or filesystem contents, increasing the risk of credential exposure or unintended data access.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger description includes very generic phrases such as 'create function', 'deploy function', and 'upload function', which can match many unrelated requests beyond Huawei Cloud FunctionGraph. This can cause the wrong skill to activate and handle sensitive deployment workflows in the wrong context, potentially leading to unintended cloud actions or confusing cross-provider operations.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This markdown file includes a curl command that sends an authentication token and request body to an API endpoint, which is a network operation affecting privacy and system interaction. The surrounding skill text does not provide any caution or disclosure about using real tokens/endpoints or about the fact that data will be transmitted over the network.

External Transmission

Medium
Category
Data Exfiltration
Content
hcloud FunctionGraph trigger list --func_urn=FUNCTION_URN

# Test via HTTP
curl -X POST https://API_ENDPOINT/invoke \
  -H "Content-Type: application/json" \
  -H "X-Auth-Token: TOKEN" \
  -d '{"test": "http"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document provides a full-access IAM policy using wildcard actions and resources, and elsewhere also shows domain-wide broad permissions, without a prominent warning that these examples violate least-privilege principles and materially increase blast radius if attached to users or groups. In a skill specifically used to create and manage cloud functions, operators may copy these examples directly, leading to over-privileged identities that can create, modify, invoke, or delete functions across projects.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Ubuntu/Debian
sudo apt update
sudo apt install python3.9 python3-pip

# CentOS/RHEL
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Ubuntu/Debian
sudo apt update
sudo apt install python3.9 python3-pip

# CentOS/RHEL
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo apt install python3.9 python3-pip

# CentOS/RHEL
sudo yum install python39 python39-pip

# Verify
python3 --version
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The verification guide goes beyond read-only post-creation checks and includes state-changing operations such as trigger creation, function updates, and log access. In a skill whose stated purpose is creating functions, these extra capabilities expand operational scope and can cause unintended exposure, configuration drift, or access to sensitive operational data if followed blindly.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The instructions create an API Gateway trigger and then send HTTP traffic, but do not warn that this may publish a new externally reachable endpoint. That can unintentionally expose a function to the internet, bypass expected internal-only access patterns, and create an attack surface that persists after testing.

External Transmission

Medium
Category
Data Exfiltration
Content
}'

# Test via HTTP request
curl -X POST https://API_ENDPOINT/path \
  -H "Content-Type: application/json" \
  -d '{"test": "http"}'
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The document instructs updating environment variables to enable debug logging, which is a write action unrelated to the minimal function-creation objective. Changing runtime configuration can alter application behavior, expose secrets or request contents in logs, and create persistent side effects in production environments.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Recommending debug environment variables without caution encourages runtime changes that may increase verbosity and leak sensitive information into logs. In cloud functions, debug settings can capture request bodies, tokens, internal errors, or dependency details that materially increase disclosure risk.

Static analysis

No suspicious patterns detected.