huawei-cloud-obs-stats

• Outcome: Pass
• Latest audit: Sep 29, 2026 · 10:36 AM UTC
• Version: 1.0.2

Overview

This is a read-only Huawei Cloud OBS statistics helper, but users should configure credentials carefully and grant only read-only access.

Install only if you need Huawei Cloud OBS statistics. Use a read-only IAM user with CES read access, avoid OBS Administrator, prefer interactive credential setup over commands containing AK/SK, and review any bucket inventory or traffic output as potentially sensitive business data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a broader OBS monitoring skill covering three major functions: bucket inventory/capacity/object-count listing, download traffic statistics, and total request statistics with month-over-month comparison. The supplied code only implements the request-statistics portion, and even that is limited to a single bucket passed via --bucket. It queries CES metrics for request counts by HTTP method, sums them, and optionally includes 4xx/5xx error counts and comparison-period output when --compare is enabled. There is no code for listing buckets, retrieving storage capacity, counting objects, or querying intranet/extranet download traffic. Because substantial declared capabilities are absent and the actual implementation is materially narrower, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly overstates and partly misstates the implementation. The script accepts a required --bucket argument and queries CES metrics for that one bucket only. It uses download_traffic_extranet/download_traffic_intranet and optionally upload_traffic_extranet/upload_traffic_intranet, then prints totals and optional comparison percentages. Although REQUEST_METRICS is defined, it is never used, so request-count querying is not implemented. There is also no code to enumerate buckets or retrieve storage capacity/object counts from OBS. Additionally, the code supports upload traffic, which is not mentioned in the declared description. Therefore, the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs use of shell commands and network-backed cloud CLIs, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization gap where an agent may invoke broader command execution than reviewers or runtime policy expect, increasing the chance of unintended command or network access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger list contains broad terms like monitoring, requests, and traffic that may activate the skill for loosely related cloud tasks. Overbroad activation can cause the agent to enter a shell/network-enabled workflow in contexts the user did not intend, increasing risk of unnecessary cloud queries or command execution.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

>
> **If the response is `Please set ak, sk and endpoint in the configuration file!` or `InvalidAccessKeyId`, obsutil credentials are not configured.**
>
> **Resolution: Provide the following example command and have the user configure it in their terminal (do not ask the user to provide AK/SK directly in the conversation):**
>
> ```
> obsutil credentials are not configured. Please run the following command in your terminal to configure (AK/SK can be obtained from the Huawei Cloud console "My Credentials" page):

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

> ```
>
> **Prohibited actions:**
> - ❌ Do not ask the user to provide AK/SK directly in the conversation
> - ❌ Do not extract AK/SK from hcloud config files (credentials are encrypted and cannot be used directly)
> - ❌ Do not skip the credential check before performing OBS operations

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

> **⚠️ Important: Handling user-provided credentials**
>
> If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
> 1. **Stop immediately** - Do not execute any commands
> 2. **Politely refuse** and return the following message:
>    ```
>    For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 28)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-macos-amd64.tar.gz tar -xzf hcloudcli-macos-amd64.tar.gz chmod +x hcloud sudo mv hcloud /usr/local/bin/

text

### Linux (x86_64)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 37)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-macos-amd64.tar.gz tar -xzf hcloudcli-macos-amd64.tar.gz chmod +x hcloud sudo mv hcloud /usr/local/bin/

text

### Linux (x86_64)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 46)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-macos-amd64.tar.gz tar -xzf hcloudcli-macos-amd64.tar.gz chmod +x hcloud sudo mv hcloud /usr/local/bin/

text

### Linux (x86_64)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 68)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-macos-amd64.tar.gz tar -xzf hcloudcli-macos-amd64.tar.gz chmod +x hcloud sudo mv hcloud /usr/local/bin/

text

### Linux (x86_64)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 77)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-macos-amd64.tar.gz tar -xzf hcloudcli-macos-amd64.tar.gz chmod +x hcloud sudo mv hcloud /usr/local/bin/

text

### Linux (x86_64)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 86)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-macos-amd64.tar.gz tar -xzf hcloudcli-macos-amd64.tar.gz chmod +x hcloud sudo mv hcloud /usr/local/bin/

text

### Linux (x86_64)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The obsutil example passes AK/SK directly on the command line, which can expose secrets through shell history, process listings, audit logs, or terminal recording. In a credentialed cloud administration skill, this is a real secret-handling weakness because users are likely to copy-paste the command verbatim.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The resource-level policy example is internally inconsistent: it includes the global action to list all buckets while constraining resources to a specific bucket/object ARN pattern. This can mislead operators into believing they have granted least-privilege access for account-wide bucket enumeration when the policy may not behave as intended, causing authorization failures or prompting them to broaden permissions unnecessarily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The troubleshooting guidance instructs users to place access key and secret key values directly on the command line via hcloud obs config -i=<AK> -k=<SK> .... Passing secrets as CLI arguments can expose them through shell history, process listings, terminal logging, screenshots, or support transcripts, creating a realistic credential leakage path. In the context of a cloud storage administration skill, these are high-value credentials that could enable unauthorized access to buckets and data if disclosed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/obs_request_stats.py (reported line 174)May include surrounding context.

python

f"--to={to_ms}",
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, check=False)
    except subprocess.SubprocessError as e:
        raise CESQueryError(f"Query for {metric_name} failed to execute: {e}")
    if result.returncode != 0:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/obs_traffic_stats.py (reported line 184)May include surrounding context.

python

f"--to={to_ms}",
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, check=False)
    except subprocess.SubprocessError as e:
        raise CESQueryError(f"Query for {metric_name} failed to execute: {e}")
    if result.returncode != 0:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest scope covers listing buckets, download traffic with month-over-month comparison, and total requests. This file defines upload traffic metrics and later exposes a --direction flag supporting "upload" and "both", which extends behavior beyond the declared skill purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The argument parser allows users to request "upload" or "both" traffic directions, while the manifest and top-level docstring describe download traffic statistics only. This is a clear description-to-behavior mismatch because the code supports a broader analytics function than the skill claims.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Activation appears to be driven mostly by keyword presence without strong contextual constraints. Weak activation boundaries can cause accidental invocation of a privileged operational skill for ambiguous requests, which is risky when the skill uses shell commands and cloud credentials.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

Ensure the IAM user has the required permissions. See [references/iam-policies.md](references/iam-policies.md) for details.

**Minimum required permissions:**
- `obs:bucket:list` — List buckets
- `obs:bucket:get` — Get bucket attributes
- `obs:object:get` — Read object information