huawei-cloud-iac-reverse

• Outcome: Review
• Latest audit: Sep 24, 2026 · 1:23 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for Huawei Cloud Terraform reverse engineering, but its install guidance asks users to execute remote installer code without verification in a credentialed cloud environment.

Review before installing. Use a least-privilege read-only Huawei Cloud key, avoid running the curl-to-bash installer as written, verify installer and Terraform downloads through trusted vendor channels, and treat generated inventory and plan files as sensitive infrastructure metadata. Do not run terraform apply unless you explicitly intend to create or modify resources.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description promises a reverse-engineering tool that discovers Huawei Cloud resources from RMS and produces deployable Terraform code. The supplied code does none of that. It is a comparison utility: it parses a Terraform plan file for resources marked 'will be created', loads an RMS inventory JSON file, counts resource types, excludes a hardcoded set of auto-created resource classes, and reports coverage statistics. This is related to Terraform/RMS workflows, but it is a materially different function from generating IaC. There is no RMS API access, no code synthesis, no topology inference, and no Terraform provider validation in the supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises an end-to-end reverse-engineering workflow that converts existing Huawei Cloud resources into Terraform IaC, including topology/spec analysis and HCL synthesis. The supplied code only performs resource enumeration through the RMS API and prints a basic summary. Querying resources is consistent as a supporting step, but the primary claimed capability—producing deployable Terraform code—is absent from this code chunk. Therefore the description overstates what the provided code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents a reverse-engineering and code-generation capability for existing Huawei Cloud infrastructure, including resource discovery through RMS and synthesis of Terraform HCL. The actual script does none of that. It assumes Terraform code already exists in a local project directory and only formats, initializes, validates, and plans it. While validation could be a supporting step in a larger IaC generation workflow, this code chunk by itself materially differs from the declared primary purpose and lacks the core discovery and generation behavior.

External Script Fetching

High

• Category: Supply Chain

Content

## Install KooCLI

```bash
# Install (curl one-liner)
curl -sSL https://cn-north-4-hwc-cli.obs.cn-north-4.myhuaweicloud.com/cli/install.sh | bash

# Verify

• Confidence: 99% confidence
• Finding: This is a true positive because the documentation explicitly fetches an external script from a remote URL and passes it directly into execution. In the context of a cloud IaC reverse-engineering skill, users are likely to run this on privileged workstations or admin environments holding cloud credentials, which increases the blast radius of any compromise.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install (curl one-liner)
curl -sSL https://cn-north-4-hwc-cli.obs.cn-north-4.myhuaweicloud.com/cli/install.sh | bash

# Verify
hcloud version

• Confidence: 99% confidence
• Finding: Piping directly into `bash` removes the opportunity for users or tooling to review the downloaded content and makes command chaining abuse trivial if the upstream script is altered. Because this skill handles Huawei Cloud inventorying and instructs use of access keys, a compromised installer could steal credentials, implant persistence, or tamper with generated IaC output.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The listed triggers include broad phrases like "infrastructure to code" and "cloud to IaC", which can describe many generic migration or documentation tasks beyond Huawei Cloud reverse-engineering. The description does not provide exclusion conditions or negative examples to narrow when the skill should or should not activate.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The guide instructs users to download and immediately execute a remote shell script via `curl ... | bash` without any integrity verification, code review step, or warning about the trust implications. If the hosting bucket, DNS path, TLS trust chain, or script content is compromised, users would execute attacker-controlled code on their systems with the privileges of the invoking shell.

Static analysis

No suspicious patterns detected.