Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md See [Verification Method](references/verification-method.md) for detailed
Security audit
huawei-cloud-functiongraph-function-create
Security checks for vulnerabilities and agentic risk
Overview
The skill performs its advertised cloud deployment tasks, but its verification guidance can expose credentials and make unintended cloud changes.
Review and correct the credential-printing checklist before use; check only whether credentials are configured. Use narrowly scoped credentials in a development project, replace routine diagnostic creation commands with read-only checks, and review the source and environment variables being uploaded. Tests create persistent cloud resources and may incur charges, so plan cleanup. Rotate credentials if their values have already appeared in accessible logs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [Verification Method](references/verification-method.md)
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
Verify policy attachments
hcloud IAM policy list-attachments --policy_id=POLICY_ID
Enable debug mode for detailed error
hcloud --debug FunctionGraph function create --func_name=test
text
Credential verification prints cloud access credentials without warning about exposure.
High
- Category
- Output Handling
- Confidence
- 99% confidence
- Finding
The checklist explicitly recommends printing both the cloud access key and secret key, which can expose credentials in agent tool outputs, terminal recordings, or CI logs. In this cloud-deployment context, anyone obtaining those credentials could perform unauthorized operations within their IAM permissions, although no external exfiltration destination is shown.
- Content
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network.
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 70% confidence
- Finding
Shadow Command Trigger: description clause 'Triggered by keywords like "create function", "deploy function", "upload function", "invoke function", "create cloud function", "创建函数", "部署函数", "上传函数", "调用函数", "创建云函数", "FunctionGraph function", "serverless func' conflicts with built-in command 'create'
- Content
Function-creation test uploads local source code to Huawei Cloud without a data-transfer warning.
Medium
- Category
- Output Handling
- Confidence
- 90% confidence
- Finding
The test instructs execution of a cloud function-creation command using a local file supplied through
--code, transmitting that file's contents to Huawei Cloud. The document does not warn that source code will leave the local system or advise against uploading secrets or sensitive data.- Content
The diagnostic workflow uses a function-creation command without warning that it can modify live cloud resources.
Medium
- Category
- Output Handling
- Confidence
- 94% confidence
- Finding
The troubleshooting workflow presents a function-creation operation as a diagnostic check without warning that it can modify the authenticated cloud environment. Although this incomplete example may fail argument validation, an agent that supplies the missing parameters could create an unintended function, causing resource changes or costs; creating functions is legitimate for this skill, but doing so implicitly during diagnosis is not.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt update sudo apt install python3.9 python3-pip # CentOS/RHEL
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt update sudo apt install python3.9 python3-pip # CentOS/RHEL sudo yum install python39 python39-pip
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo apt install python3.9 python3-pip # CentOS/RHEL sudo yum install python39 python39-pip # Verify python3 --version
The automated 'function existence' check does not verify that the specified function exists.
Low
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
L183–L184 describe this step as verifying the target function's existence, but L198–L203 list functions without checking FUNC_URN against the results. The script prints a positive message even when the list is empty, so this check can appear successful when the specified function does not exist.
- Content