huawei-cloud-obs-website-host

• Outcome: Review
• Latest audit: Oct 14, 2026 · 3:14 AM UTC
• Version: 1.0.3

Overview

This skill is mostly coherent for Huawei OBS website setup, but it deserves review because it handles cloud credentials and private keys and can make persistent OBS/DNS changes with broad permissions.

Install only if you are comfortable granting an agent access to Huawei Cloud credentials and allowing it to change OBS website/custom-domain settings and DNS records. Prefer temporary least-privilege credentials scoped to the target bucket and DNS zone, use managed certificate IDs instead of pasting private keys, and avoid putting AK/SK or private keys directly on the command line.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A second description/behavior mismatch exists because the skill claims to configure website hosting and DNS, but the documented workflow relies on external scripts and read-only verification while not demonstrating those promised mutations in the visible skill content. That discrepancy is dangerous because users may believe the bucket was made public or DNS was updated when it was not, or conversely may approve execution without realizing the verifier performs broader network and TLS diagnostics. Security review depends on accurate declarations, and this file does not provide them consistently.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A second description/behavior mismatch exists because the skill claims to configure website hosting and DNS, but the documented workflow relies on external scripts and read-only verification while not demonstrating those promised mutations in the visible skill content. That discrepancy is dangerous because users may believe the bucket was made public or DNS was updated when it was not, or conversely may approve execution without realizing the verifier performs broader network and TLS diagnostics. Security review depends on accurate declarations, and this file does not provide them consistently.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill instructs use of environment variables, local credential files, network access, and script execution, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where an agent may invoke broader capabilities than reviewers expect, especially around reading ~/.obsutilconfig and making outbound DNS/HTTP calls. In a security-sensitive cloud-configuration skill, undeclared capabilities materially increase the chance of unintended secret exposure or unreviewed side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

- Use it instead of writing a one-off SDK call in the response.
8. Register the required custom domain on the bucket via the OBS SDK path used by the script:
   - `client.setBucketCustomDomain(bucket_name, custom_domain)` — required even if DNS CNAME already exists.
   - If DNS record changes are requested in this run, create a DNS CNAME record to the OBS website hostname and wait for propagation. (read `references/hcloud-dns-obs-website.md`)
   - If DNS is managed outside Huawei Cloud or outside this run, provide the required CNAME target and explicitly instruct the user to create or update the CNAME record with their external DNS provider after OBS custom-domain registration is complete.
   - For externally managed DNS, include the practical handoff details the user needs: record type `CNAME`, host/name, target/value, and a verification command such as `dig`.
9. Verify the published site by running `scripts/verify_obs_website.py --bucket-name <bucket_name> --region <region> [--domain <custom_domain>] [--index-document <name>]`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs users to pass cloud access key and secret key directly as command-line arguments to hcloud configure set. Secrets provided on the command line can be captured in shell history, process listings, audit logs, or terminal recording systems, which can lead to credential compromise and unauthorized access to Huawei Cloud resources.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 90)May include surrounding context.

wget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz tar -xzvf obsutil_linux_amd64.tar.gz cd obsutil_linux_amd64_* chmod 755 obsutil ./obsutil version

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 100)May include surrounding context.

wget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz tar -xzvf obsutil_linux_amd64.tar.gz cd obsutil_linux_amd64_* chmod 755 obsutil ./obsutil version

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 110)May include surrounding context.

wget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz tar -xzvf obsutil_linux_amd64.tar.gz cd obsutil_linux_amd64_* chmod 755 obsutil ./obsutil version

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 152)May include surrounding context.

md

### Notes

- Internet connectivity is required when downloading packages.
- `chmod 755 obsutil` is required before running `obsutil` on Linux/macOS.
- If `./obsutil version` returns version information, installation is successful.
- For macOS, run `chmod 755 obsutil` in the extracted directory before first use.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 154)May include surrounding context.

md

### Notes

- Internet connectivity is required when downloading packages.
- `chmod 755 obsutil` is required before running `obsutil` on Linux/macOS.
- If `./obsutil version` returns version information, installation is successful.
- For macOS, run `chmod 755 obsutil` in the extracted directory before first use.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes configuring OBS static website hosting and connecting a custom domain, but this file also instructs users to upload or reference TLS certificate material for that domain, including direct handling of PEM certificates and private keys. Managing certificate attachment and secret key material is a separate security-sensitive capability that is not clearly justified by the stated website-hosting scope in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation shows direct upload of a TLS certificate and unencrypted private key in code without any warning about secure handling, storage, redaction, or preference for safer alternatives. In an agent skill context, this can normalize pasting private keys into prompts, scripts, logs, chat transcripts, or source control, increasing the risk of credential disclosure and compromise of HTTPS identity for the custom domain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code reads access credentials from ~/.obsutilconfig and environment variables such as HW_ACCESS_KEY, HW_SECRET_KEY, and HW_SECURITY_TOKEN, then uses them for SDK calls. Although the CLI help mentions defaults, there is no runtime warning, confirmation, or explicit user-facing notice that the script will inspect local credential sources and transmit them to OBS endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code makes live network calls that modify bucket website hosting and custom-domain settings, which can affect service availability and external traffic routing. Although the argparse description states the script's purpose, there is no explicit user-facing warning or confirmation before applying these remote configuration changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.