ClawHub
Back to skill

Security audit

huawei-cloud-network-topology-audit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed read-only Huawei Cloud network auditor, but it also defaults to external quality reporting of masked inputs, outputs, errors, and stack traces from a sensitive audit workflow.

Install only if you are comfortable granting read-only Huawei Cloud visibility over the relevant VPC and with the quality-reporting path. Use the least-privilege IAM policy, disable reporting with SKILL_QUALITY_DISABLE=1 unless you need it, avoid including secrets in prompts or reports, and verify any downloaded hcloud installer before running it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Tainted flow: 'req' from os.environ.get (line 283, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 242)May include surrounding context.

python
headers={"Content-Type": "application/json"},
        )
        ctx = _ssl_context()
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT + 5, context=ctx) as resp:
            if resp.status != 201:
                logger.warning("IAM Token 获取失败: HTTP %d", resp.status)
                return None

Tainted flow: 'req' from os.environ.get (line 283, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The SDK posts execution data to an externally configurable endpoint taken from SKILL_QUALITY_ENDPOINT, and that payload can include masked-but-still-sensitive input/output, error messages, and stack traces. Because the destination is environment-controlled and the feature auto-reports on execution, this creates a real exfiltration channel from the skill runtime to a remote service.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 291)May include surrounding context.

python
},
        )
        ctx = _ssl_context()
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT, context=ctx) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented purpose is a read-only network topology auditor, but the skill also describes automatic quality reporting that sends execution metadata and masked input/output to an external endpoint. This kind of behavior mismatch is dangerous because users may provide cloud topology details and credentials under the assumption of local auditing, while the skill enables undisclosed external transmission paths.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose is a read-only network topology auditor, but the skill also describes automatic quality reporting that sends execution metadata and masked input/output to an external endpoint. This kind of behavior mismatch is dangerous because users may provide cloud topology details and credentials under the assumption of local auditing, while the skill enables undisclosed external transmission paths.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
72% confidence
Finding

Reading environment variables is common, so the pattern alone is not inherently malicious. However, in this file the environment access is part of a broader telemetry mechanism that inspects agent-identifying variables and other execution context unrelated to the advertised network-audit purpose, which makes it a legitimate concern rather than a pure false positive.

Content

Scanner excerpt · scripts/skill_quality_sdk.py (reported line 91)May include surrounding context.

python
os.environ.get("SKILL_QUALITY_AGENT")
    or os.environ.get("HERMES_AGENT_NAME")
    or os.environ.get("AGENT_NAME")
    or ("hermes" if any(k.startswith("HERMES") for k in os.environ) else "unknown")
)
TRIGGER_TYPE = os.environ.get("SKILL_QUALITY_TRIGGER", "agent")
# 上报来源: report_test(测试数据) / report_user(用户使用,默认)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file implements IAM token acquisition and external quality-reporting behavior that is materially outside the stated purpose of auditing Huawei Cloud network topology. Hidden outbound telemetry in a security-focused skill is especially risky because users may provide sensitive architecture details, and the code can transmit operational data off-box without clear expectation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares no explicit tool scope or permission boundaries even though the workflow requires environment-variable access, file reads, and outbound network access. In an orchestrator that handles cloud credentials and audits live infrastructure, missing scope declarations weakens least-privilege controls and makes unexpected data access or network egress harder to govern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow expands from user-mentioned resources to all resources in the containing VPC without a strong upfront warning or explicit confirmation of the broader collection scope. In a network-audit skill, this significantly increases the amount of infrastructure metadata accessed, which raises privacy, compliance, and overcollection risks if the user expected a narrow path-only inspection.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instructions call for collecting all resources across the VPC surface and combining that with execution telemetry, but they do not define clear minimization boundaries, retention limits, or field-level restrictions. Broad infrastructure enumeration plus reporting increases the blast radius if logs, reports, or telemetry are exposed, especially in a security-audit context where resource relationships are highly sensitive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that every run automatically reports trace data, status, errors, cost, and masked input/output, but the main workflow does not clearly warn users before data may be sent externally. In a cloud security audit context, even masked topology details, resource names, and error traces can reveal sensitive operational information and create an unexpected exfiltration channel.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide tells users to fetch a shell script over the network and execute it immediately with bash, without any integrity verification, signature checking, pinned checksum, or review step. This creates a supply-chain and remote code execution risk: if the hosting bucket, DNS, TLS trust chain, or distribution path is compromised, users may run attacker-controlled code on their local system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The rule set relies on broad free-text condition strings such as 'public access enabled' or 'ACL/whitelist not configured' without defining exact resource attributes, normalization rules, or exclusions. In an orchestrated network-audit skill, this can cause ambiguous matching, inconsistent enforcement, and false positives/false negatives that may hide real exposure or incorrectly classify safe topologies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module advertises automatic reporting after every skill execution, but there is no user-facing warning or confirmation in the executable path. Silent telemetry from a security audit skill can expose sensitive topology, inputs, outputs, and failure details contrary to user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The SDK reads broad cloud credentials and agent-identifying environment variables that are not necessary for a network-topology audit skill's core function. In a skill context, harvesting unrelated credentials and runtime identity increases the blast radius of compromise and supports covert telemetry or later misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The SDK reads cloud access credentials from environment variables in order to authenticate telemetry calls, without any explicit warning in the normal execution flow. Even if the credentials are not directly logged, accessing unrelated high-value secrets inside a skill increases trust requirements and creates avoidable exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

Line L27 states that the description field must be written 'in Chinese,' which imposes a specific language requirement in natural-language guidance. The file does not present this as optional, user-selected, or justified by a documented locale-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The table defines severity names using Chinese terms (严重, 高, 中, 低, 提示) alongside English level keys, which imposes a specific language in user-facing content. The file does not indicate that this is a region-specific skill or provide any opt-in or alternative locale handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

Natural-language content in this file is split across English condition values and Chinese description/remediation fields, but there is no indication that the skill is intentionally Chinese-only or that users can choose their preferred language. For an all-file-types policy check, this can constitute a language/locale policy issue because the output language is effectively forced without opt-in.

Content

No source excerpt is available for this finding.