huawei-cloud-gaussdb-instance-management

• Outcome: Review
• Latest audit: Sep 21, 2026 · 6:36 AM UTC
• Version: 1.0.1

Overview

This is a disclosed Huawei Cloud GaussDB administration skill, but it deserves review because it can automatically inspect sensitive cloud database inventory and security posture using local cloud credentials.

Install only if you intend the agent to use Huawei Cloud credentials for GaussDB administration. Use the narrowest IAM policy, separate read-only and R1/R2 roles, avoid routine FullAccess, and require explicit user direction before any inventory, security analysis, permission change, creation, scaling, backup, or deletion command.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The skill description advertises read-only actions as "auto-execute," normalizing autonomous cloud queries and security inspection. In the context of a database administration skill, that can lead to unintended disclosure of infrastructure metadata and security posture whenever the skill is matched too broadly.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: huawei-cloud-gaussdb-instance-management
description: |
  Huawei Cloud GaussDB distributed database (GaussDB for MySQL 兼容版 and GaussDB for openGauss 分布式版) management and diagnosis skill. Provides 12 huawei_* actions across three capability tiers: (1) Query (R3, read-only auto-execute) — list/get instances, list flavors, list databases; (2) Analyze (R3, read-only auto-execute) — deployment-form analysis (shards/readonly nodes/engine version) and security configuration analysis (security group port/SSL); (3) Manage (R2/R1, preview + user confirmation) — create instance, create backup, add readonly node, add sharding node, update database permission, delete instance. Preserves 3 Critical Warnings: shard key is permanent once set, distributed GaussDB requires at least 3 nodes, and MySQL-compatible vs openGauss are separate products with pinned engine versions. Declares hcloud GaussDB CLI dependency; supports both AK/SK credentials and a locally configured hcloud profile.
  Triggers include: "GaussDB", "华为云GaussDB", "分布式数据库", "GaussDB(for MySQL)", "GaussDB(for openGauss)", "openGauss", "sharding", "分片", "添加分片节点", "只读节点", "readonly node", "GaussDB实例", "GaussDB备份", "数据库权限", "部署形态分析", "安全配置分析", "GaussDB诊断", "GaussDB运维", "gaussdb", "HTAP", "GaussDB部署检查", "GaussDB安全基线".
tags: [huawei-cloud, gaussdb, database, distributed-database, devops]
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list contains very broad terms such as "GaussDB", "openGauss", "gaussdb", and "HTAP", which can cause the skill to activate for loosely related requests outside the intended management workflow. In this skill context, unintended activation is more dangerous because the skill exposes cloud inventory, security-analysis, and administrative database operations, increasing the chance of data exposure or steering a user into sensitive actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

Marking query actions as "Read-only, auto-execute" allows the agent to enumerate instances, flavors, and databases without an explicit approval step. Read-only does not mean harmless here, because inventory data can be sensitive and can facilitate follow-on administrative or social-engineering abuse.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

| Tier | Level | Actions | Execution |
|------|-------|---------|-----------|
| Query | R3 | `huawei_list_gaussdb_instances`, `huawei_get_gaussdb_instance`, `huawei_list_gaussdb_flavors`, `huawei_list_gaussdb_databases` | Read-only, auto-execute |
| Analyze | R3 | `huawei_analyze_gaussdb_deployment`, `huawei_analyze_gaussdb_security` | Read-only, auto-execute |
| Manage | R2 | `huawei_create_gaussdb_instance`, `huawei_create_gaussdb_backup`, `huawei_add_gaussdb_readonly_node`, `huawei_add_gaussdb_sharding_node` | Preview + confirm |
| Manage | R1 | `huawei_update_gaussdb_database_permission`, `huawei_delete_gaussdb_instance` | Preview + confirm (high risk) |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

Marking security and deployment analysis as "Read-only, auto-execute" is risky because these workflows collect and summarize potentially sensitive environment details such as SSL state, security-group exposure, shard topology, and bound EIPs. In this context, automatic security reconnaissance is more dangerous than generic read-only help text.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

| Tier | Level | Actions | Execution |
|------|-------|---------|-----------|
| Query | R3 | `huawei_list_gaussdb_instances`, `huawei_get_gaussdb_instance`, `huawei_list_gaussdb_flavors`, `huawei_list_gaussdb_databases` | Read-only, auto-execute |
| Analyze | R3 | `huawei_analyze_gaussdb_deployment`, `huawei_analyze_gaussdb_security` | Read-only, auto-execute |
| Manage | R2 | `huawei_create_gaussdb_instance`, `huawei_create_gaussdb_backup`, `huawei_add_gaussdb_readonly_node`, `huawei_add_gaussdb_sharding_node` | Preview + confirm |
| Manage | R1 | `huawei_update_gaussdb_database_permission`, `huawei_delete_gaussdb_instance` | Preview + confirm (high risk) |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The workflow explicitly authorizes autonomous execution of read-only query and analysis actions without confirmation, including product-family detection by probing cloud resources. Even though these are read-only, they can expose instance metadata, topology, database names, security-group posture, SSL state, and public exposure details without an explicit user consent checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

1. **Identify the product family** from the user's request: MySQL-compatible (`GaussDB`
   service) vs openGauss distributed (`gaussdbforopengauss` service). If unsure, run
   `huawei_list_gaussdb_instances` and inspect `datastore.type` / product fields.
2. **Query tier (R3)** — execute read-only actions directly, no confirmation needed.
3. **Analyze tier (R3)** — run the composite read-only commands, summarize findings
   (deployment form: shards / readonly nodes / engine version; security: security group
   port exposure + SSL state).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The core command section operationalizes auto-executing read-only queries, making it more likely an agent will directly run cloud commands once triggered. Because the skill includes commands that enumerate managed database instances and related metadata, unintended execution can leak internal environment details.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

Core Commands

Query (R3 — read-only, auto-execute)

bash

# 1. List instances (MySQL-compatible)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The analyze section explicitly frames composite reconnaissance commands as auto-executable, including topology, engine version, security-group, SSL, and EIP inspection. In a cloud database management skill, this creates a meaningful information-disclosure risk if activation occurs from broad or ambiguous prompts.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

(openGauss flavors). Never pass empty placeholders such as --spec_code= — KooCLI rejects them with a parameter-empty error.

Analyze (R3 — read-only, auto-execute)

bash

# 5. Deployment-form analysis (MySQL-compatible): instance + details + node topology + engine versions

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 9)May include surrounding context.

Data Flow Diagram

Query / Analyze (R3 — read-only, auto-execute)

Rendering diagram...

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/dataflow-diagram.md (reported line 3)May include surrounding context.

Data Flow Diagram

Query / Analyze (R3 — read-only, auto-execute)

Rendering diagram...

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document grants gaussdb:deleteInstance and gaussdb:updateDatabasePermission, which are high-risk actions, but it does not explicitly warn that these permissions enable irreversible destructive operations or privilege changes. In an agent skill context, documenting least-privilege policies is appropriate, but omitting a prominent warning increases the chance that operators over-grant R1 access without understanding the blast radius.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/verification-method.md (reported line 26)May include surrounding context.

md

| Action | Success criteria |
|--------|------------------|
| `huawei_create_gaussdb_instance` | Job/order response with `id`/`job_id`; follow up via `ListGaussMySqlInstances` until `status=ACTIVE` (may take 10-30 min). |
| `huawei_create_gaussdb_backup` | `job_id`/`backup_id` returned; verify via `ShowGaussMySqlBackupList`. |
| `huawei_add_gaussdb_readonly_node` | `job_id` returned; verify via `ListInstanceNode` — node count increased. |
| `huawei_add_gaussdb_sharding_node` | `job_id` returned; verify via `ShowShardDiskMessages` — shard count increased. |
| `huawei_update_gaussdb_database_permission` | Success message; verify via `ListGaussMySqlDatabaseUser` and instance's user list. |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file documents huawei_delete_gaussdb_instance and how to verify that the instance is absent, but it does not include a clear warning that this is a destructive operation affecting user data and service availability. Under the markdown-specific criteria, skills should disclose behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

SQP-3 applies to all file types, including markdown. The document instructs use of --X-Language=en-us and also embeds "X-Language": "en-us" in request examples, which indicates a fixed language/locale choice rather than offering opt-in or explaining why English is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example request body sets "X-Language": "en-us", which is a natural-language locale constraint. Because the document does not offer a user-selectable alternative or justify the fixed locale, this may violate the language/locale policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This example also sets "X-Language": "en-us" with no indication that the user can choose another locale. That is a fixed language choice in natural-language-facing configuration guidance and should be documented as optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The sample data prescribes --X-Language as en-us, which imposes a specific language/locale choice in the documented workflow. The file does not offer a language choice or justify the locale restriction as region-specific, so this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.