ClawHub
Back to skill

Security audit

huawei-cloud-migration-vmware-ecs-private

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for Huawei Cloud VM migration, but it needs Review because it uses permanent cloud credentials and root SSH while showing unsafe SSH, proxy, and command-execution patterns.

Install only after reviewing the SSH host-key policy, Squid ACLs, credential persistence, and command-launch behavior. Use narrowly scoped Huawei Cloud credentials, restrict source CIDRs and proxy access, verify host fingerprints out of band, and avoid running it against production hosts without backups and an explicit rollback plan.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ssh_utils.py:105
Finding

SSH Connections Trust Unverified Host Keys

Content
View full analysis

Vulnerability Details

File Location: scripts/ssh_utils.py:105-121, scripts/ssh_utils.py:175-193, scripts/sms_agent_push.py:452-461, scripts/post_migration_verify.py:128-142, scripts/post_migration_verify.py:153-192, and scripts/migrate_worker.py:1378, 1391, 1403
Vulnerability Type: Missing SSH host identity verification
Risk Level: High

Complete Code Snippet

The central SSH wrapper uses AutoAddPolicy for both initial connections and reconnections:

python
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
connect_kwargs = {
    "hostname": self.host,
    "port": self.port,
    "username": self.username,
    "timeout": timeout,
}
if self.key_path and os.path.exists(self.key_path):
    connect_kwargs["key_filename"] = self.key_path
elif self.password:
    connect_kwargs["password"] = self.password
client.connect(**connect_kwargs)
python
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

connect_kwargs = {
    "hostname": _host,
    "port": _port,
    "username": _username,
    "timeout": timeout,
}
if _key_path and os.path.exists(_key_path):
    connect_kwargs["key_filename"] = _key_path
elif _password:
    connect_kwargs["password"] = _password

client.connect(**connect_kwargs)

The post-migration proxy path applies the same policy to both the proxy and target:

python
proxy_client = paramiko.SSHClient()
proxy_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
proxy_kwargs = {
    "hostname": self.proxy_ip,
    "port": self.proxy_port,
    "username": self.proxy_username,
    "timeout": self.timeout,
}
if self.proxy_key_path and os.path.exists(self.proxy_key_path):
    proxy_kwargs["key_filename"] = self.proxy_key_path
elif self.proxy_password:
    proxy_kwargs["password"] = self.proxy_password

proxy_client.connect(**proxy
...[truncated 3179 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace AutoAddPolicy with strict host-key validation:
    python
    client = paramiko.SSHClient()
client.load_system_host_keys()
client.load_host_keys(application_known_hosts)
client.set_missing_host_key_policy(paramiko.RejectPolicy())
  2. Obtain expected ECS host-key fingerprints through an authenticated provisioning channel or require the user to approve a displayed fingerprint before the first connection.
  3. Maintain an application-specific known_hosts file with permissions restricted to the executing user.
  4. Verify the hostname or IP, key algorithm, and fingerprint on every initial and re-established connection.
  5. Apply the same policy consistently to:
    • Direct source and target connections
    • Proxy ECS connections
    • SSH connections established through proxy channels
    • Reconnection logic
    • Migration and post-migration verification paths
  6. Treat host-key changes as a hard failure unless the user explicitly authorizes a verified infrastructure replacement.
  7. Add automated tests that present an unknown or changed host key and confirm that the connection is rejected before credentials are submitted.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/squid_ops.py:166
Finding

Squid Configuration Allows Unrestricted HTTPS CONNECT Relay

Content
View full analysis

Vulnerability Details

File Location: scripts/squid_ops.py:166-186
Vulnerability Type: Proxy access-control bypass
Risk Level: Medium

Complete Code Snippet

python
# 访问规则
# 允许源端 IP 访问目标域名
src_acl_names = " ".join(f"src_net_{i}" for i in range(len(allowed_source_ips)))
dst_acl_names = " ".join(f"dst_domain_{i}" for i in range(len(allowed_target_domains)))

if src_acl_names and dst_acl_names:
    # 逐条添加允许规则 (squid ACL 是 AND 逻辑)
    for si in range(len(allowed_source_ips)):
        for di in range(len(allowed_target_domains)):
            lines.append(f"http_access allow src_net_{si} dst_domain_{di}")
elif src_acl_names:
    # 只有源端限制
    for si in range(len(allowed_source_ips)):
        lines.append(f"http_access allow src_net_{si}")
lines.append("")

# SSL 端口
lines.append("http_access allow CONNECT ssl_ports")
lines.append("")

# 拒绝其他
lines.append("http_access deny all")

The relevant ACL definitions are:

python
lines.append("acl ssl_ports port 443")
lines.append("acl safe_ports port 80")
lines.append("acl safe_ports port 443")
lines.append("acl CONNECT method CONNECT")

Technical Analysis

Squid evaluates http_access rules sequentially. The source-and-destination rules initially limit access to configured source IP addresses and Huawei Cloud domains. However, the later rule:

text
http_access allow CONNECT ssl_ports

independently permits every request whose method is CONNECT and whose destination port matches ssl_ports, which is port 443. It does not include any src_net_* or dst_domain_* condition.

Consequently, any client that can reach the Squid listener can request a TCP tunnel to an arbitrary destination on port 443. The final http_access deny all does not block such traffic because the unconditional CONNECT rule has already allowed it.

scripts/network_ops.py rejects 0.0.0.0/0 as an ingress source CIDR, which limits ...[truncated 1455 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional rule:
    text
    http_access allow CONNECT ssl_ports
  2. Require source, destination, method, and port restrictions in the same allow rule. For example:
    text
    http_access allow src_net_0 dst_domain_0 CONNECT ssl_ports
http_access allow src_net_0 dst_domain_1 CONNECT ssl_ports
http_access deny all
  3. Ensure no fallback branch emits a source-only allow rule unless unrestricted destinations are explicitly intended.
  4. Validate allowed_source_ips and allowed_target_domains before generating the configuration, rejecting empty or overly broad values.
  5. Restrict the cloud security group to exact source host addresses or narrowly scoped VPN CIDRs.
  6. Add Squid configuration tests confirming that:
    • Approved sources can access approved Huawei Cloud endpoints.
    • Unapproved sources are denied.
    • Approved sources cannot tunnel to arbitrary domains on port 443.
    • Non-CONNECT and unsafe-port requests are denied.
  7. Run squid -k parse before replacing the active configuration and fail deployment if the generated ACL policy is invalid.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (162)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The finding indicates undocumented environment modification, including possible package installation, within a skill that claims to perform private migration. Unannounced dependency installation and local environment changes are risky because they alter system state and may introduce supply-chain or stability concerns outside the user's expectation.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md
流程：读取 Excel → 生成迁移任务列表 → 对每个任务执行 `migrate_worker.py` → 记录结果并输出汇总报告

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The clean routine performs recursive deletion on a caller-supplied target_dir with rm -rf and only minimal validation. If an attacker or operator supplies an unsafe path such as /, an empty-expanded variable in wrapper code, or a critical system directory, the script can destroy arbitrary files on the host, which is especially dangerous in a migration skill likely run with elevated privileges.

Content

Scanner excerpt · scripts/agent_state_check.sh (reported line 161)May include surrounding context.

sh
fi

    # 清理临时包
    rm -f /opt/sms-agent-linux.tar.gz /tmp/sms-agent-linux.tar.gz 2>/dev/null

    echo "CLEAN_DONE=yes"
}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Passing a concatenated command string into subprocess.Popen with shell=True enables tool parameter abuse: attacker-controlled CLI inputs can alter shell parsing and inject arbitrary commands. Because this tool handles cloud credentials, SSH access, and migration infrastructure, successful exploitation could lead to full host compromise and credential theft.

Content

Scanner excerpt · scripts/batch_migrate.py (reported line 1227)May include surrounding context.

python
relaunch_args.append(f"--log-file={log_path}")
        relaunch_cmd = "nohup " + " ".join(relaunch_args) + f" > {log_path} 2>&1 &"
        logger.info(f"Launching background process: {relaunch_cmd}")
        proc = _sp.Popen(
            relaunch_cmd,
            shell=True,
            stdout=open("/dev/null", "w"),

Direct flow: open (file read) → subprocess.Popen (code execution)

High
Category
Data Flow
Confidence
80% confidence
Finding

Data flows directly from a source (env vars, files, network) to a sink (network output, exec, file write) without intermediate validation.

Content

Scanner excerpt · scripts/batch_migrate.py (reported line 1227)May include surrounding context.

python
relaunch_args.append(f"--log-file={log_path}")
        relaunch_cmd = "nohup " + " ".join(relaunch_args) + f" > {log_path} 2>&1 &"
        logger.info(f"Launching background process: {relaunch_cmd}")
        proc = _sp.Popen(
            relaunch_cmd,
            shell=True,
            stdout=open("/dev/null", "w"),

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring explicitly promises that environment-variable credentials are never written to disk configuration files, but the code later runs 'obsutil config', which typically stores credentials in obsutil's config on disk. This mismatch is security-relevant because users may trust the stronger guarantee and supply sensitive long-lived AK/SK under false assumptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

delete_and_wait performs irreversible ECS deletion immediately once called, with no confirmation, soft-delete protection, ownership verification, or dependency checks. In an automated agent setting, a mistaken or adversarial prompt could destroy production instances and attached resources, causing service outage and data loss.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The code permits fallback downloads of an executable package using external tools and remote URLs influenced by environment configuration, then later installs that binary onto a managed host without any checksum or signature verification. In a security-sensitive migration tool that deploys software over SSH to infrastructure, this creates a supply-chain risk: a compromised endpoint, DNS/TLS interception, or poisoned object path could lead to remote installation of a malicious binary.

Content

Scanner excerpt · scripts/gost_ops.py (reported line 204)May include surrounding context.

python
try:
            import subprocess as _sp
            # 优先用 wget，其次 curl
            for downloader in ["wget", "curl"]:
                _r = _sp.run(["which", downloader], capture_output=True, text=True, timeout=5)
                if _r.returncode != 0:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/credential_manager.py (reported line 520)May include surrounding context.

python
capture_output=True,
                    timeout=timeout,
                    text=True,
                    env=os.environ.copy(),
                )

                if proc.returncode == 0:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/hcloud_wrapper.py (reported line 134)May include surrounding context.

python
capture_output=True,
                    timeout=timeout,
                    text=True,
                    env=os.environ.copy(),
                )

                if proc.returncode == 0:

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The wrapper includes EIP creation, binding, and deletion capabilities even though the skill is described as a private-network migration workflow with no public IP/EIP. That mismatch expands the attack surface and could let downstream flows expose instances to the public Internet or violate network-segmentation assumptions in a supposedly private migration scenario.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code SSHes into the source host and forcibly kills agent processes, then deletes agent configuration files and temporary directories without an execution-time confirmation or safety checks. In a migration skill operating on production systems, these destructive remote actions can disrupt existing services or invalidate prior agent state if triggered on the wrong host or at the wrong time.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The code deletes agent configuration on the remote source host over SSH using a shell command. Even though the target path is specific and appears intended for agent recovery, destructive remote file operations can cause service disruption or misconfiguration if host selection is wrong or the path assumptions are incorrect.

Content

Scanner excerpt · scripts/migrate_worker.py (reported line 734)May include surrounding context.

python
# 3. 清理 Agent 配置 (只删除源端注册相关文件，保留 error.cfg 等默认配置)
                clean_cmds = [
                    "rm -f /opt/SMS-Agent/agent/config/agent_conf.json 2>/dev/null; true",
                    "rm -f /opt/SMS-Agent/config/sms_domain.txt 2>/dev/null; true",
                    "rm -rf /tmp/SMS-Agent* 2>/dev/null; true",
                ]

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/migrate_worker.py:42