huawei-cloud-obs-upload

• Outcome: Review
• Latest audit: Nov 5, 2026 · 1:06 PM UTC
• Version: 1.0.5

Overview

The upload workflow is clearly disclosed, but scheduled-task cleanup can remove other jobs and the recommended permissions allow deletion despite claims otherwise.

Use a bucket-scoped custom policy without deletion permissions. Before enabling scheduled uploads, correct cleanup to remove only the exact approved job, preserve a backup, and stop if reading crontab fails. Confirm the directory carefully: recurring uploads continue after the session ends. All bundled documents were reviewed; live cloud behavior and downloaded installers were not tested.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (52)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: huawei-cloud-obs-upload
description: |
  Upload a local file or directory to a specified Huawei Cloud OBS (Object Storage Service) bucket with obsutil, and set up a scheduled/periodic upload task (crontab) that syncs a local directory to an OBS bucket. Also lists OBS buckets with storage capacity and object count.
  Use this skill when the user wants to: (1) upload a specific local file or directory to a named OBS bucket, (2) set up a scheduled/periodic upload task that automatically syncs a local directory to a named OBS bucket, (3) list their OBS buckets and check capacity and object count.
  Triggers include: user

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

a crontab. **Upload operations use obsutil; bucket listing/stats use `hcloud obs ls` + CES metrics.**

**Tool separation principle:**
- **obsutil** — File/directory upload, scheduled upload sync (**upload core tool; hcloud CLI has no PutObject support**)
- **hcloud CLI** — Bucket listing via `hcloud obs ls` (obsutil mode), bucket capacity/object count stats via `hcloud CES ShowMetricData`
- **crontab / Task Scheduler** — OS-level scheduled task for periodic upload (no daemon process dependency)

**Security architecture:**
- AK/SK are never read, echoed, or printed in conversation
- obsutil credentials are configured by the user in their terminal (never asked in conversation)
- Delete operations are strictly forbidden (irreversible); out-of-scope operations are refused with guided alternatives
- For directory uploads, whether to preserve directory structure (`-flat`) is decided by the customer's explicit answer, never assumed
- **Every upload (Task 2) and every scheduled-upload se

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.

md

r details. For common issues and solutions, see [references/troubleshooting.md](references/troubleshooting.md).

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 411)May include surrounding context.

md

| [troubleshooting.md](references/troubleshooting.md) | Troubleshooting and practical experience |

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.

md

See [references/verification-method.md](references/verification-method.md) for details. For common issues and solutions, see [references/troubleshooting.md](ref

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 408)May include surrounding context.

md

| [verification-method.md](references/verification-method.md) | Verification steps |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 20)May include surrounding context.

md

> **⚠️ Security note on installing CLI tools**
>
> - **Always download the installer/package from the official Huawei Cloud site only** (the URLs in this document), and verify the package integrity (SHA256) with the official checksum before executing.
> - **Never pipe a remote script directly into a shell** (e.g. `curl ... | bash`). Download the script first, review it, verify its integrity, and only then run it.
> - **Never run `sudo` commands that elevate an unverified downloaded binary.** Prefer installing to a user-local directory and adding it to `PATH`, or running `sudo` only on a verified package.
> - If you cannot verify the integrity of a download, stop and obtain the tool from the official install channel instead.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/related-apis.md (reported line 230)May include surrounding context.

the task later (see "Managing scheduled tasks" below).

Period description	Crontab expression
Every 30 minutes	*/30 * * * *
Every hour	0 * * * *
Daily at 8:00	0 8 * * *
Monday at 0:00	0 0 * * 1
1st of month at 0:00	0 0 1 * *

bash

# Add crontab task (must be explicitly confirmed by the user before running)
(crontab -l 2>/dev/null; echo "<CronExpr> /bin/bash $HOME/obs-scheduled-upload-<BucketName>.sh") | crontab -

Step 3: Verify

bash

crontab -l

⚠️ Crontab environment notes

• Crontab has a minimal PATH environment variable; use the full path to obsutil in the script
• Recommend adding at the top of the script: export PATH=/usr/local/bin:$PATH
• Confirm the obsutil AK/SK config file path is accessible in the crontab environment

Managing scheduled tasks:

bash

# List all scheduled tasks
crontab -l

# Remove a specific scheduled task (run only after the us

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/task-scheduled-upload.md (reported line 111)May include surrounding context.

ally uploads <LocalDirPath> to obs://<BucketName>/<Prefix> in the cloud."

2. Restate the local directory, bucket, target prefix, and schedule period. 3. Obtain the user's explicit approval. If the user declines or is unsure, do not write the task.

Never silently append a crontab entry.

Step 4: Set crontab scheduled task (after user confirmation)

bash

# Run every hour
(crontab -l 2>/dev/null; echo "0 * * * * /bin/bash $HOME/obs-scheduled-upload-<BucketName>.sh") | crontab -

# Run daily at 8:00
(crontab -l 2>/dev/null; echo "0 8 * * * /bin/bash $HOME/obs-scheduled-upload-<BucketName>.sh") | crontab -

# Run every 30 minutes
(crontab -l 2>/dev/null; echo "*/30 * * * * /bin/bash $HOME/obs-scheduled-upload-<BucketName>.sh") | crontab -

Step 5: Verify scheduled task is set

bash

crontab -l

Implementation (Windows - Task Scheduler)

**⚠️ Same as Linux/macOS: ask the customer first (Step 1) whether to preserve the source directory structu

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/task-scheduled-upload.md (reported line 166)May include surrounding context.

md

crontab -l | grep -v "obs-scheduled-upload-<BucketName>" | crontab -

# Windows: delete the scheduled task after user confirmation
# schtasks /delete /tn "OBS-ScheduledUpload-<BucketName>" /f

# Remove the upload script and log
rm $HOME/obs-scheduled-upload-<BucketName>.sh $HOME/obs-scheduled-upload-<BucketName>.log

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/task-scheduled-upload.md (reported line 169)May include surrounding context.

schtasks /delete /tn "OBS-ScheduledUpload-" /f

Remove the upload script and log

rm $HOME/obs-scheduled-upload-.sh $HOME/obs-scheduled-upload-.log

text

> **⚠️ `crontab -r` clears ALL scheduled tasks and is never used by this skill.**

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/verification-method.md (reported line 119)May include surrounding context.

ocal/bin:$PATH LOG_FILE="$HOME/obs-scheduled-upload-test.log" echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting scheduled upload" >> "$LOG_FILE" obsutil cp /tmp/obs-scheduled-test/ obs:///scheduled-test/ -r >> "$LOG_FILE" 2>&1 EOF chmod +x $HOME/obs-scheduled-upload-test.sh

text

### Step 2: Write crontab entry (every 5 minutes, for testing only; requires user confirmation first)

```bash
(crontab -l 2>/dev/null; echo "*/5 * * * * /bin/bash $HOME/obs-scheduled-upload-test.sh") | crontab -

⚠️ This appends a persistent scheduled task to the user's crontab. Write it only after the user has explicitly confirmed. Once written, the task runs until it is removed (see Step 4).

Step 3: Verify scheduled task

bash

# Check crontab
crontab -l

# Wait 5 minutes then check log
sleep 310
cat $HOME/obs-scheduled-upload-test.log

# Check files in OBS bucket
obsutil ls obs://<BucketName>/scheduled-test/ -limit=10

Step 4: Clean up scheduled task (after explicit conf

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/verification-method.md (reported line 144)May include surrounding context.

Remove the test scheduled task (this line must only be executed after the user confirms cleanup)

crontab -l | grep -v "obs-scheduled-upload-test" | crontab -

Remove the test script and log

rm $HOME/obs-scheduled-upload-test.sh $HOME/obs-scheduled-upload-test.log

text

> **⚠️ Cleanup confirmation**: Removing the crontab entry must also be confirmed with the user, since it modifies the user's crontab.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

| ❌ Ask user to provide AK/SK directly in conversation | Credentials must never appear in conversation |
| ❌ Extract AK/SK from hcloud config files | Credentials are encrypted and cannot be used directly |
| ❌ Skip obsutil credential check before OBS operations | Operations fail without configured credentials |
| ❌ Use `-flat` for directory uploads without asking the customer | `-flat` discards directory structure; must follow customer's explicit answer |
| ❌ Guess local path, bucket name, or target prefix | Required parameters must be provided by the user |

> **If a user requests a delete operation, you must refuse and inform:**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 107)May include surrounding context.

bash

obsutil upload /home/user/file.txt obs://my-bucket/  # Incorrect: obsutil upload command is cp, not upload
obsutil cp /home/user/file.txt my-bucket/path/file.txt  # Incorrect: Target must start with obs://
obsutil cp /home/user/data/ obs://my-bucket/ -r -flat  # Incorrect: using -flat without asking the customer first; -flat must follow the customer's explicit answer

5. CES Namespace and Metric Names

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

>
> **If the response is `Please set ak, sk and endpoint in the configuration file!` or `InvalidAccessKeyId`, obsutil credentials are not configured.**
>
> **Resolution: Direct the user to configure obsutil credentials in their own terminal (do not ask the user to provide AK/SK directly in the conversation), with the security warning below:**
>
> ```
> obsutil credentials are not configured. Please run the following command in your terminal to configure (AK/SK can be obtained from the Huawei Cloud console "My Credentials" page):

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

> **⚠️ Important: Handling user-provided credentials**
>
> If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
> 1. **Stop immediately** - Do not execute any commands
> 2. **Politely refuse** and return the following message:
>    ```
>    For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

2. **1b. Query bucket stats** — CES capacity metrics or OBS API for capacity and object count
3. **1c. Report stats** — Present bucket name, capacity, object count in a table

> **ℹ️ Task 1 is read-only (bucket listing and stats query). No confirmation gate is required for this task.**

### Task 2: Upload Local File or Directory to Target Bucket

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

md

**Sub-tasks:**

1. **2a. Confirm parameters** — local path, target bucket name, target prefix (optional) with the user
2. **2b. Decide `-flat`** — single file: use `-flat` without asking; directory: ask customer whether to preserve directory structure
3. **2c. Get explicit user confirmation** — restate the target (path → bucket/prefix), warn that data persists remotely, and obtain approval
4. **2d. Execute upload** — `obsutil cp` single file or directory (with/without `-flat` per customer answer)
5. **2e. Verify result** — check upload exit code and confirm object exists in bucket

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/task-upload-file.md (reported line 67)May include surrounding context.

md

>
> - With `-flat`: `/home/user/data/sub/file.txt` → `obs://bucket/prefix/file.txt` (directory structure lost, only filenames kept)
> - Without `-flat`: `/home/user/data/sub/file.txt` → `obs://bucket/prefix/sub/file.txt` (directory structure preserved)
> - **For single file uploads: `-flat` can be used without asking** (a single file has no directory structure to preserve).

> **⚠️ Large file automatic multipart upload**
>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md

3. **3c. Warn about persistence + get explicit confirmation** — tell the user the task persists on the host and repeatedly uploads data to the cloud; obtain explicit approval for the recurring upload
4. **3d. Generate upload script** — `$HOME/obs-scheduled-upload-<BucketName>.sh` (with/without `-flat` per customer answer)
5. **3e. Set scheduled task** — crontab (Linux/macOS) or Task Scheduler (Windows)
6. **3f. Verify** — `crontab -l` or `schtasks /query` to confirm task is set

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/related-apis.md (reported line 236)May include surrounding context.

Step 3: Verify

bash

crontab -l

⚠️ Crontab environment notes

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/related-apis.md (reported line 249)May include surrounding context.

bash

# List all scheduled tasks
crontab -l

# Remove a specific scheduled task (run only after the user confirms removal)
crontab -l | grep -v "obs-scheduled-upload-<BucketName>" | crontab -

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/verification-method.md (reported line 128)May include surrounding context.

bash

# Check crontab
crontab -l

# Wait 5 minutes then check log
sleep 310

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 48)May include surrounding context.

md

tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
chmod +x hcloud

# Recommend: install to a user-local directory (no sudo needed) and add to PATH
mkdir -p "$HOME/.local/bin" && mv hcloud "$HOME/.local/bin/"
export PATH="$HOME/.local/bin:$PATH"   # add to ~/.bashrc or ~/.zshrc