Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because scanners reported risks involving destructive database cleanup, exposed cloud credentials, an incomplete cost estimate, and a conversion confirmation gate; the review is not a claim of malicious intent.
Consider the potential for data loss during database verification, exposure of cloud credentials, understated prepaid costs, and an irreversible conversion proceeding without the documented confirmation. Skillspector scanned all 18 listed components but marked analysis partial because a local reference in SKILL.md could not be resolved, so coverage is incomplete. Review the referenced procedures and permission needs carefully before installing.
scripts/convert.pyInitial conversion bypasses the documented explicit-confirmation gate
A direct or premature Agent invocation can commit an unapproved irreversible deployment change, increase ongoing charges and automatically charge the prepaid price difference.
CREATE DATABASE IF NOT EXISTS can reuse an existing ha_test_db, while the cleanup unconditionally drops that entire database, including unrelated tables. Although these are user-run instructions rather than automatic execution, following them against a production instance can cause substantial data loss.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
original `convert.py` was killed after calling `StartInstanceSingleToHaAction` but before its response was captured), `resume.py` would have to (re-)issue the irreversible `StartInstanceSingleToHaAction` to continue. In that case:
* The script gates the (re-)start on a `--confirm` flag; without `--confirm` it writes a `conversion.refused=true` report and exits non-zero, **without** calling `StartInstanceSingleToHaAction`
* **MUST** first disclose to the user that this resume path will (re-)start the irreversible single-to-HA conversion, obtain explicit user confirmation, and only then invoke `resume.py` with `--confirm`; without confirmation **MUST NOT** pass `--confirm`
* The pure-polling resume paths (state file already has `job_id` or `order_id`) do **not** need `--confirm` and do not (re-)issue the conversion
* If the task fails, present the failure reason to the user and suggest retrying with a different `--target-az`; a failed conversion does not affect the instance
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
AKSK authentication (a successful JSON response means authenticated; a DNS or
authentication error means not); terminates with guidance if any check fails.
- [ ] **Step 1 (Instance discovery and selection)**: when the user provided the instance ID
at trigger time, the step is skipped entirely (no echo, no confirmation); the
existence / `Single` / `ACTIVE` check is delegated to the read-only `pre_check.py`
in Step 4. When not provided, it runs `list_instances.py` and presents the
**cross-region** result as a table (ID, name, region, flavor, database version,
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
for its region — **MUST NOT** ask again for either. An empty result terminates the
workflow with that reason.
- [ ] **Step 2 (Availability zone discovery and selection)**: when the user provided the
target AZ at trigger time, the step is skipped entirely (no echo, no confirmation);
its availability is verified by the read-only `pre_check.py` in Step 4. When not
provided, it runs `list_azs.py --region <instance region> --database-name MySQL
--version-name <engine_version> --spec-code <flavor_ref> --instance-id <iid>` and
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Environment check | 0 | Python/hcloud installed and authenticated | - |
| Instance discovery | 1 | Cross-region JSON of convertible single MySQL instances, table presented, ID and region confirmed (optional) | - |
| AZ discovery | 2 | HA-flavor `az_status` JSON, table presented, AZ confirmed (optional, same-AZ allowed) | - |
| Risk disclosure | 3 | Complete risks/impact content presented before any change; no confirmation requested here | - |
| Precondition check | 4 | Precheck report with pass/fail per condition, run before the change confirmation | - |
| Cost assessment | 5 | single/HA prices in the instance's actual charge mode only, delta, actual multiple | - |
| Monitoring baseline | 6 | 300s snapshot, single-instance replication delay null | - |
Replacing the placeholders with real AK/SK credentials places secrets in command-line arguments and potentially persistent shell history, terminal recordings, or agent execution logs. Exposure of these cloud credentials can enable unauthorized operations within their IAM privileges, making this particularly sensitive in a database-administration workflow.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Billing Mode | Change Operation | Cost Impact |
| --- | --- | --- |
| Prepaid (monthly/yearly) | Single to primary/standby | After the change, pay the price difference based on the remaining time in the billing cycle (the SKILL automatically sends `is_auto_pay=true` and Huawei Cloud auto-charges the difference from the account — ensure the account balance is sufficient) |
| Pay-per-use (on-demand) | Single to primary/standby | After the change, billed hourly at the primary/standby instance price |
### 4.2 Prepaid Price-Difference Calculation
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
command = ["hcloud"] + cmd_args
LOGGER.debug("Executing: %s", " ".join(command))
try:
completed = subprocess.run(
command,
capture_output=True,
text=True,
In the standard run() workflow, quote_period() is called without its optional storage argument, so prepaid estimates exclude storage even when --storage-size-gb is supplied. Because this skill provides cost estimates before confirmation of an HA upgrade, incomplete estimates can mislead spending authorization and cause unexpected charges; this is a financial-integrity issue rather than direct infrastructure compromise. The comparison workflow passes storage correctly, limiting the affected scope to the standard workflow.
The overview states that the script never re-runs the conversion and only polls persisted operations. However, L233–L272 initiate StartInstanceSingleToHaAction when no job or order ID is persisted and --confirm is supplied, contradicting the polling-only guarantee even though later documentation describes this branch.