ClawHub
Back to skill

Security audit

huawei-cloud-lts-manage

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Huawei Cloud LTS management helper, but users should install the CLI carefully and use scoped cloud credentials.

Install only if you intend to let an agent operate Huawei Cloud LTS through hcloud. Prefer the read-only IAM policy for search and diagnostics, use the full policy only when create/update/delete is needed, confirm the exact resource IDs before destructive actions, and verify the hcloud installer source before running the downloaded script.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description claims the skill manages Huawei Cloud LTS resources directly across the full lifecycle. However, the provided code chunk is only a testing script for running predeclared CLI commands from a JSON file and summarizing their results. While it is related to LTS and does preserve a safeguard by skipping destructive tests, its primary behavior is command testing/verification, not actual resource management. This is a material purpose mismatch. There is no evidence in this code chunk of implementing the declared management features themselves; instead it acts as supporting QA infrastructure.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md
| `--start_time` / `--end_time` | For log search | Time range (ms) | `1700000000000` |
| `--log_transfer_type` | For transfer filter | Transfer type | `OBS`, `DIS`, `DMS` |

### Delete Safety Rules

1. **Single resource deletion only** — each Delete call must specify exactly one resource ID
2. **No wildcard/batch delete** — `DeleteLogGroup` deletes all streams under the group; always confirm the cascade impact

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill describes use of the hcloud CLI and references authenticated cloud operations, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent environment, that omission can permit overly broad execution context or ambiguous authorization boundaries, increasing the chance of unintended command or environment access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger list includes broad phrases such as generic log-management and troubleshooting terms, which can cause the skill to activate for requests beyond the intended Huawei Cloud LTS scope. Because this skill supports destructive and high-impact cloud actions, unintended invocation raises the risk of accidental data exposure, resource mutation, or deletion workflows being initiated in the wrong context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 37)May include surrounding context.

md
| ID | Requirement |
|----|-------------|
| NF-01 | All query operations are read-only and safe to execute without confirmation |
| NF-02 | All Create/Update operations return a resource configuration snapshot |
| NF-03 | All Delete operations require explicit user confirmation (confirm/ok/确认) |
| NF-04 | Batch deletion of all LTS resources is prohibited |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide instructs users to download a shell script over the network and execute it immediately with bash without any integrity verification, signature check, pinning, or warning about the risks of remote code execution. If the download host, transport path, or published script is compromised, users could run attacker-controlled commands with their local user privileges during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The default region is set to "cn-north-4", which forces a specific locale/region in natural-language configuration without indicating that the user can choose another region. Under the policy, locale constraints should be optional or clearly documented as justified for a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The summary line includes hardcoded Chinese text ("真实通过率") in a shell script whose other output is in English. This imposes a specific language in user-facing output without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.