huawei-cloud-mrs-host-fault-diagnose

• Outcome: Review
• Latest audit: Sep 23, 2026 · 8:33 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent MRS diagnostic tool, but it ships risky defaults and exposes Manager operations that can change cluster or user state despite claiming to be read-only.

Review before installing. Use a least-privilege read-only Manager/LakeWatch account, change verify_ssl to true and configure a trusted CA before entering credentials, and remove or block Manager API definitions that mutate users, alarms, commands, or cluster state unless you intentionally want administrative control with explicit confirmation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lakewatch_api_config.yaml:48

Finding

Credential-bearing API connections disable TLS certificate verification by default

Content

View full analysis

Vulnerability Details

File Location: scripts/lakewatch_api_config.yaml:48, scripts/manager_api_config.yaml:56, scripts/lakewatch_api_client.py:158-165, 208-224, scripts/manager_api_client.py:160-167, 238-252
Vulnerability Type: Improper certificate validation exposing authentication credentials
Risk Level: High

Vulnerable Code

Both shipped configurations disable TLS verification:

yaml

# scripts/lakewatch_api_config.yaml:48
verify_ssl: false

yaml

# scripts/manager_api_config.yaml:56
verify_ssl: false

Both clients honor that setting by disabling hostname and certificate validation:

python

def _build_ssl_context(config: dict) -> ssl.SSLContext:
    """根据配置构建 SSL 上下文，支持跳过验证和自定义 CA 证书"""
    ctx = ssl.create_default_context()
    verify_ssl = config.get("crypto", {}).get("verify_ssl", True)
    if not verify_ssl:
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
    else:
        ca_cert = config.get("crypto", {}).get("ca_cert", "")
        if ca_cert and os.path.isfile(ca_cert):
            ctx.load_verify_locations(ca_cert)
    return ctx

The LakeWatch client decrypts and sends the account password in the request body:

python

password = decrypt(encrypted_password, self.config)

url = f"{scheme}://{host}:{port}/lakewatch/v1/system/get-token"
payload = json.dumps({"username": username, "password": password}).encode("utf-8")

ctx = _build_ssl_context(self.config)

req = urllib.request.Request(
    url=url,
    data=payload,
    headers={"Content-Type": "application/json"},
    method="POST",
)
try:
    res = urllib.request.urlopen(req, context=ctx)

The Manager client sends reusable account credentials through HTTP Basic authentication:

python

_cred_bytes = b":".join([username.encode("utf-8"), password.encode("utf-8")])
credentials = base64.b64encode(_cred_bytes).decode("utf-8")
del _cred_bytes
req = urllib.request.Request(
    url=url,
    data=b"",
    headers={
        "Con
...[truncated 2316 chars]

Remediation

View remediation

Remediation Suggestions

1. Change verify_ssl to true in both shipped configuration files.
2. Require a valid private CA certificate through ca_cert for deployments using self-signed or internally issued certificates.
3. Fail closed if the configured CA file is missing or invalid; do not silently fall back to disabled verification.
4. If insecure TLS is retained for exceptional diagnostics, require an explicit per-invocation flag with a prominent warning rather than a persistent default.
5. Consider refusing to transmit passwords or Basic authentication credentials whenever certificate validation is disabled.
6. Rotate all credentials that may previously have been transmitted using the insecure default.
7. Add automated tests verifying that the default SSL context uses CERT_REQUIRED and performs hostname validation.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/manager_api_client.py:493

Finding

Read-only diagnostic client exposes unguarded destructive and privilege-changing Manager APIs

Content

View full analysis

Vulnerability Details

File Location: scripts/manager_api_client.py:493-547, 690-701, scripts/manager_api_apis/permission.yaml:20-49, scripts/manager_api_apis/command.yaml:32-41, scripts/manager_api_apis/alarm.yaml:300-324
Vulnerability Type: Missing authorization and confirmation enforcement for state-changing operations
Risk Level: High

Vulnerable Code

The API catalog exposes account creation and deletion:

yaml

create_user:
  # 2.20.42 创建用户
  # 权限: 用户管理
  desc: "创建用户"
  method: "POST"
  path: "/api/v2/permission/users"
  required_params:
    - user_data
  optional_params: []
  request_body_template: "{user_data}"

get_user_detail:
  # 2.20.49 查询指定用户
  # 权限: 用户查看，用户管理
  desc: "查询指定用户"
  method: "GET"
  path: "/api/v2/permission/users/{user_name}"
  required_params:
    - user_name
  optional_params: []

delete_user:
  # 2.20.44 删除用户
  # 权限: 用户管理
  desc: "删除用户"
  method: "DELETE"
  path: "/api/v2/permission/users"
  required_params:
    - user_data
  optional_params: []
  request_body_template: "{user_data}"

It also exposes task cancellation:

yaml

abort_command:
  # 2.9.3 中止指定任务
  # 中止指定任务的执行
  # 权限: 集群管理
  desc: "中止指定任务"
  method: "PUT"
  path: "/api/v2/commands/{command_id}/abort"
  required_params:
    - command_id
  optional_params: []

Alarm state can be cleared or suppressed:

yaml

clear_alarm:
  # 2.8.21 清除告警
  # 权限: 集群管理
  desc: "清除告警"
  method: "PUT"
  path: "/api/v2/alarms/clusters/{cluster_id}/alarms/{alarm_id}/clear"
  required_params:
    - cluster_id
    - alarm_id
  optional_params: []

shield_alarms:
  # 2.8.22 屏蔽指定集群中服务或主机的告警
  # 权限: 集群管理
  desc: "屏蔽指定集群中服务或主机的告警"
  method: "POST"
  path: "/api/v2/alarms/clusters/{cluster_id}/alarms/shield"
  required_params:
    - cluster_id
  optional_params:
    - alarm_def_ids
    - service_name
    - hostname
  request_body_template:
    alarmDefIds: "{alarm_def_ids}"
    serviceName: "{service_name}"
    hostName: "{hostname}"

The generic client permits ...[truncated 3353 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all state-changing API definitions from this read-only diagnostic Skill, including user creation/deletion, command abortion, alarm clearing, and alarm shielding.
2. Enforce a hardcoded read-only allowlist in manager_api_client.py; do not rely exclusively on mutable YAML metadata to classify safe operations.
3. Reject PUT and DELETE methods entirely in the diagnostic client. Allow POST only for explicitly reviewed read-only query or collection endpoints.
4. If administrative operations must remain available, move them into a separate Skill with a distinct authorization model and least-privilege credentials.
5. Require operation-specific, explicit confirmation immediately before dispatching any state-changing request. A documentation statement alone is insufficient.
6. Add a --dry-run mode that prints the method, destination, and redacted request body without sending the request.
7. Use a Manager account restricted to read-only cluster, alarm, host, instance, and log permissions.
8. Add regression tests proving that mutating API names cannot be dispatched from the diagnostic entry point.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (80)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk does not match the declared primary purpose. The description promises a fault-diagnosis skill with progressive root cause localization, using knowledge-base content under specific directories and auto-detecting lakewatch vs manager mode. The actual code shown is only the Manager API client component: a transport/utilities layer for calling configured Manager REST endpoints. It can authenticate, cache sessions, construct URLs and request bodies from YAML, validate parameters, call arbitrary APIs, and return/download results. Those are supporting capabilities for a larger diagnosis system, but in this chunk there is no fault diagnosis logic, no service/instance/host troubleshooting flow, no use of fault_layer/scenarios knowledge bases, and no auto-detection of API mode. Because the supplied code’s actual primary behavior is a generic API client rather than diagnosis/root-cause localization, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scenarios/reinstall_host.md (reported line 62)May include surrounding context.

md

|-------------|----------------|-------------------|
| SSH connection refused | SSH key not restored or sshd not started | Restore omm user SSH key, start sshd service |
| Host key verification failed | known_hosts mismatch | Clear old host fingerprints from known_hosts |
| Permission denied | Incorrect SSH key permissions | Fix permissions: chmod 700 ~/.ssh, chmod 600 ~/.ssh/id_rsa |

### 1.3 Disk Space Check

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scenarios_manager/reinstall_host.md (reported line 61)May include surrounding context.

md

|-------------|----------------|-------------------|
| SSH connection refused | SSH key not restored or sshd not started | Restore omm user SSH key, start sshd service |
| Host key verification failed | known_hosts mismatch | Clear old host fingerprints from known_hosts |
| Permission denied | Incorrect SSH key permissions | Fix permissions: chmod 700 ~/.ssh, chmod 600 ~/.ssh/id_rsa |

### 1.3 Disk Space Check

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

This file performs outbound network access to configured LakeWatch endpoints and sends credentials to obtain tokens, yet no declared network permission is shown in the supplied metadata. In an agent setting, undeclared network capability is a significant security issue because it enables data transmission off-host without the platform or user being able to properly constrain or audit that behavior.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

This file performs outbound network access to configured LakeWatch endpoints and sends credentials to obtain tokens, yet no declared network permission is shown in the supplied metadata. In an agent setting, undeclared network capability is a significant security issue because it enables data transmission off-host without the platform or user being able to properly constrain or audit that behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

- The password MUST be encrypted with `--encrypt-password` and stored in `scripts/lakewatch_api_config.yaml` (`auth.encrypted_password`). Never store the plaintext password.
- **Security Rules**:
  - Never expose the LakeWatch password in conversation or command output
  - Never ask the user to input the plaintext password in conversation; use the interactive `--encrypt-password` flow
  - The token is cached locally with owner-only file permissions (Win: `%TEMP%\lakewatch_token\`, Linux: `/tmp/lakewatch_token/`)

### 3. MRS Manager Credential Configuration (Manager Mode)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

- The password MUST be encrypted with `--encrypt-password` and stored in `scripts/lakewatch_api_config.yaml` (`auth.encrypted_password`). Never store the plaintext password.
- **Security Rules**:
  - Never expose the LakeWatch password in conversation or command output
  - Never ask the user to input the plaintext password in conversation; use the interactive `--encrypt-password` flow
  - The token is cached locally with owner-only file permissions (Win: `%TEMP%\lakewatch_token\`, Linux: `/tmp/lakewatch_token/`)

### 3. MRS Manager Credential Configuration (Manager Mode)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file documents operational steps involving uninstall, reinstall, stop order, backups, and cleanup of Kerberos KDC data and keytabs, but it does not explicitly warn that these actions can cause authentication outages, irreversible data loss, or cluster-wide security disruption if performed incorrectly. In a fault-diagnosis skill, operators may follow these steps directly, so omission of safety gating and impact warnings increases the chance of harmful actions during troubleshooting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The uninstall guidance includes cleanup of residual BDB data, slapd.conf, certificates, and ldapclient configuration, but does not clearly warn that these removals are permanent and can break dependent services or prevent recovery if done prematurely. Because this skill is used for fault diagnosis in production clusters, an operator may treat the document as safe procedural guidance and unintentionally destroy recoverable state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The scale-in section instructs operators to stop a node and clean up its data directory without any explicit warning that these actions are destructive and may permanently remove LDAP data or hinder rollback if performed on the wrong node. In an operational diagnosis skill, omission of irreversibility and backup/confirmation guidance increases the risk of accidental data loss during troubleshooting or maintenance.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 68)May include surrounding context.

md

| Propagation path present | Contains root cause -> propagation -> symptom | Missing propagation path |
| Root cause section present | Contains root cause layer + root cause type | Root cause missing |
| Repair suggestion table present | Contains priority, operation, description, needs-user-confirmation | Missing table |
| All repair actions flagged "Yes" | Every repair row has needs-user-confirmation = Yes | Any repair marked as auto-execute |
| No fabricated data | All conclusions cite actual command output | Invented metrics or log content |

## 5. Error Handling Validation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 26)May include surrounding context.

bash

# CentOS / EulerOS / RHEL
sudo yum install -y python3 python3-pip

# Ubuntu / Debian
sudo apt-get update

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 29)May include surrounding context.

md

sudo yum install -y python3 python3-pip

# Ubuntu / Debian
sudo apt-get update
sudo apt-get install -y python3 python3-pip

# Verify

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 30)May include surrounding context.

md

sudo yum install -y python3 python3-pip

# Ubuntu / Debian
sudo apt-get update
sudo apt-get install -y python3 python3-pip

# Verify

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file documents that tokens are cached locally in /tmp or %TEMP% and that, on Windows, an AES key is auto-generated and stored in a local .aes_key file. Those behaviors affect credential handling and local system security, but the document presents them as implementation details rather than warning users to protect or clean up those files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly notes that SSL verification is skipped by default for Manager API calls, but does not present this as a strong security warning or require compensating controls. In a tool that handles Manager authentication and cluster diagnostics, disabling certificate validation enables man-in-the-middle attacks that could intercept credentials, session cookies, and sensitive cluster data if the network path is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file documents commands for collecting node resource data, process details, disk SMART data, adapter configuration, and remote connectivity information. Although these operations are central to diagnosis, the markdown does not disclose that they may access sensitive host metadata or process information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file documents browse_log, start_log_search, and related log-access operations, which can reveal application, system, or user-sensitive information. The section provides usage details but no user-facing warning about reviewing or handling potentially sensitive log contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs collection of controller and NodeAgent framework logs that can contain sensitive operational data such as hostnames, service names, internal paths, stack traces, tokens, or embedded credentials, but it provides no user-facing warning, minimization guidance, or redaction requirement. In a troubleshooting skill this may be operationally useful, but without explicit safeguards it creates unnecessary risk of exposing sensitive cluster information during diagnosis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This guidance discusses stopping services and references kill/terminate actions and stop timeouts without an explicit warning that these actions can disrupt live workloads, trigger HA failover, or affect availability. In an operational diagnosis skill, omission of impact/safety gating can lead an operator or downstream agent to take disruptive remediation steps prematurely during troubleshooting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section explicitly recommends forceful termination actions such as SIGKILL and node reboot for D-state or stuck processes, but does not warn about risks like data loss, corruption of in-flight operations, or broader node/service instability. Because this skill is for fault diagnosis, operators may treat the guidance as endorsed remediation, making unsafe termination more likely in production environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This uninstall scenario repeatedly instructs the operator to validate and proceed around component removal, residual cleanup, and manual killing of remaining processes, but it does not include an explicit warning that these actions can interrupt service, remove component state, or risk irreversible data loss if applied to the wrong target. In an operational troubleshooting skill, omission of such guardrails can cause users or downstream agents to perform destructive steps inappropriately during diagnosis, especially because the workflow blends observation with cleanup-oriented conclusions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guidance tells operators to manually clean residual processes and files during a reinstall, but it does not warn that killing processes or deleting files/data directories can be irreversible and may destroy recoverable state if the wrong component, path, or timing is chosen. In a production cluster-diagnosis skill, this is risky because users may treat the instruction as routine troubleshooting and perform destructive actions without safeguards or backup confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document recommends manually restoring configuration files after reinstall failures without warning that restore operations can overwrite newer or node-specific settings, reintroduce insecure or stale configuration, or break service startup. In this skill's operational context, users are likely to follow recovery guidance during an incident, which increases the chance of unsafe overwrite under time pressure.

Content

No source excerpt is available for this finding.