Security audit
Security checks for vulnerabilities and agentic risk
The skill’s IAM analysis purpose is mostly coherent, but it needs review because it can use local cloud credentials, enumerate sensitive IAM data, and install an unverified telemetry CLI on the user’s machine.
Install only if you are comfortable letting the skill read Huawei Cloud IAM metadata with your configured credentials. Review or disable the telemetry path before use, avoid running the installer unless you trust the remote Huawei endpoints, and prefer a least-privilege read-only IAM credential rather than an admin credential.
Enumerating all agencies in the domain rather than evaluating a requested target action/resource violates least surprise and may expose more IAM metadata than necessary. In a security-analysis context, unnecessary broad enumeration increases privacy and reconnaissance risk even if no direct modification occurs.
Enumerating all agencies in the domain rather than evaluating a requested target action/resource violates least surprise and may expose more IAM metadata than necessary. In a security-analysis context, unnecessary broad enumeration increases privacy and reconnaissance risk even if no direct modification occurs.
Enumerating all agencies in the domain rather than evaluating a requested target action/resource violates least surprise and may expose more IAM metadata than necessary. In a security-analysis context, unnecessary broad enumeration increases privacy and reconnaissance risk even if no direct modification occurs.
Enumerating all agencies in the domain rather than evaluating a requested target action/resource violates least surprise and may expose more IAM metadata than necessary. In a security-analysis context, unnecessary broad enumeration increases privacy and reconnaissance risk even if no direct modification occurs.
Enumerating all agencies in the domain rather than evaluating a requested target action/resource violates least surprise and may expose more IAM metadata than necessary. In a security-analysis context, unnecessary broad enumeration increases privacy and reconnaissance risk even if no direct modification occurs.
Enumerating all agencies in the domain rather than evaluating a requested target action/resource violates least surprise and may expose more IAM metadata than necessary. In a security-analysis context, unnecessary broad enumeration increases privacy and reconnaissance risk even if no direct modification occurs.
Enumerating all agencies in the domain rather than evaluating a requested target action/resource violates least surprise and may expose more IAM metadata than necessary. In a security-analysis context, unnecessary broad enumeration increases privacy and reconnaissance risk even if no direct modification occurs.
Enumerating all agencies in the domain rather than evaluating a requested target action/resource violates least surprise and may expose more IAM metadata than necessary. In a security-analysis context, unnecessary broad enumeration increases privacy and reconnaissance risk even if no direct modification occurs.
Enumerating all agencies in the domain rather than evaluating a requested target action/resource violates least surprise and may expose more IAM metadata than necessary. In a security-analysis context, unnecessary broad enumeration increases privacy and reconnaissance risk even if no direct modification occurs.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<#
华为云IAM参考性权限分析 - 环境检查前置脚本 (Windows PowerShell)
#>
The script for an IAM permission-diagnosis skill bootstraps and installs a separate global executable instead of performing narrowly scoped diagnosis logic. This creates unnecessary code execution and supply-chain exposure that is unrelated to the advertised read-only IAM analysis purpose, increasing the chance that users run persistent software they did not expect.
Automatic software installation is unjustified for a skill whose declared function is reference IAM permission analysis. Downloading and copying executables into ~/.local/bin expands the attack surface from read-only cloud inspection to local system modification and arbitrary binary deployment.
The script fetches version data and then downloads an external tarball from remote endpoints, using that data to select the artifact to install, but it does not verify signatures or pinned checksums. This is a classic supply-chain risk: compromise of the API, storage bucket, or release process can lead to arbitrary code installation on user systems.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"
V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
echo "警告: 无法获取 skill-quality-cli 最新版本，跳过安装" >&2
exit 0
The script downloads get-pip.py from remote URLs and immediately executes it, which is a classic remote code execution and supply-chain risk. A compromised mirror, TLS interception, DNS poisoning, or unexpected upstream content change would allow arbitrary code to run on the host, potentially with the user's privileges.
The script trusts remote content to determine the version to fetch, then uses that value to construct the download URL for a binary archive without any authenticity check. Even though the immediate pipeline only parses JSON rather than executing shell code, compromise of the API or repository could redirect installation to a malicious versioned payload, resulting in arbitrary code execution when the installed binary is later run.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"
V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
echo "无法获取 skill-quality-cli 最新版本" >&2
exit 1
The skill advertises and documents shell, network, environment, and file capabilities but does not declare any explicit tool scope such as allowed-tools or permissions. That makes the operational boundary ambiguous and can permit broader execution than reviewers or users expect, especially in an auto-execute skill that runs shell commands and accesses credentials.
Declaring the skill as auto-execute is risky because it performs nontrivial security-sensitive operations, including shell execution and cloud IAM inspection, and other findings suggest possible installation/bootstrap behavior. Autonomous execution reduces the opportunity for the user to review inputs, scope, and side effects before the skill acts.
attached policies + user-group inheritance + agencies), parses policy document Allow/Deny
statements and outputs a "大概率有权限/无权限" reference verdict with a confidence grade and full
chain trace. Group/agency permissions are cross-validated with the real IAM check interfaces.
Read-only, R3 auto-execute. Honest boundary: no user-level policy-simulation API exists on
Huawei Cloud, so results are reference-only, never an authoritative auth decision; custom policy
+ Condition + agency-stacking are flagged "仅供参考".
Triggers include: 权限分析, 权限诊断, 权限评估, 是否有权限, 查权限, IAM 权限, 权限链路, 谁能访问,
The trigger list includes broad natural-language phrases such as permission analysis, who has access, and access denied troubleshooting, which can cause accidental invocation in ordinary conversations. Because the skill is positioned for auto-execution and touches credentials, shell, and networked IAM queries, overbroad triggering increases the chance of unintended data access or command execution.
Reinforcing that all core commands are auto-execute normalizes unattended execution across the skill's operational surface. In context, this is dangerous because the command set includes shell-driven workflows and potentially misleading or overbroad IAM enumeration, making unintended execution more likely.
## Core Commands
All commands below are read-only (R3, auto-execute). Paths are relative to the skill directory.
### Resolve user / list user groups (`huawei_list_user_groups`)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## 3. Read-only & R3
- [x] All 8 actions are read-only and R3 auto-execute (no write operations; no MFA confirmation gate).
- [x] Only IAM namespace scripts are used; no other skill is referenced.
## 4. Precision grading
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## 3. Read-only & R3
- [x] All 8 actions are read-only and R3 auto-execute (no write operations; no MFA confirmation gate).
- [x] Only IAM namespace scripts are used; no other skill is referenced.
## 4. Precision grading
The guide states that telemetry is automatic by default and only mentions an opt-out toggle without clearly describing what data is collected, where it is sent, or the privacy/compliance implications. In an IAM-related skill context, even quality telemetry can raise sensitivity concerns because operators may use the tooling in environments that handle account identifiers, permission-analysis activity, or regulated cloud operations.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
> Grant the minimum that matches your environment. Do not grant `iam:*` unless strictly required,
> and never attach write actions (`create*`, `delete*`, `update*`, `associate*`, `detach*`) to a
> read-only diagnosis persona.
## 4. Notes
The module docstring and CLI descriptions are written entirely in Chinese, and the printed runtime messages are also Chinese-only. This imposes a specific language on users without opt-in, which matches the locale-policy violation criteria for natural-language content.
Argument descriptions, parser errors, and result messages are all hard-coded in Chinese. Because the script does not offer a language selection or justify a locale restriction, it violates the natural-language policy requirement against forcing a specific language without opt-in.