huawei-cloud-sac-new-api

• Outcome: Review
• Latest audit: Sep 21, 2026 · 6:56 AM UTC
• Version: 1.0.2

Overview

This skill is a coherent Huawei Cloud Terraform deployment helper, but it needs review because it combines cloud mutation authority with unverified remote infrastructure downloads, plaintext local credential materialization, and an unsafe Playwright npx fallback.

Review before installing. Use a least-privilege Huawei Cloud IAM user, inspect and verify any downloaded Terraform template before running Terraform, avoid exposing cloud credentials in shared workspaces, remove `terraform.auto.tfvars.json` after use, restrict SSH and web access to trusted IPs, and avoid the `npx playwright-cli` fallback unless the package identity and version are pinned.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/playwright_utils.py:19

Finding

Unscoped npx Fallback May Execute an Unintended Registry Package

Content

View full analysis

Vulnerability Details

File Location: scripts/playwright_utils.py, lines 19–24
Vulnerability Type: Dependency confusion caused by an incorrect package fallback
Risk Level: High

Vulnerable Code

python

def build_pw_command() -> list[str]:
    pw = resolve_command("playwright-cli")
    if pw:
        return [pw]
    npx = resolve_command("npx")
    if npx:
        return [npx, "playwright-cli"]
    raise RuntimeError(
        "playwright-cli is not installed. Install with: npm install -g @playwright/cli@latest"
    )

The installation instructions identify the intended dependency as the scoped package @playwright/cli. However, when the playwright-cli executable is unavailable, the fallback invokes:

text

npx playwright-cli

This resolves the unscoped registry package named playwright-cli, not necessarily the documented @playwright/cli package.

Technical Analysis

The returned command is passed to run_pw(), where it is executed through subprocess.run() with the current Agent or user privileges. Although shell=False prevents shell metacharacter injection, it does not address package identity: npx may retrieve and execute code associated with the unintended unscoped package.

The issue is reachable when all of the following conditions hold:

1. The Skill runs extract_sac_deploy_info.py.
2. No local playwright-cli executable is found.
3. npx is available.
4. The fallback command resolves the unscoped playwright-cli package from the configured npm registry.

This is classified as an insecure dependency flaw rather than malicious behavior because the reviewed project contains no evidence that the authors control the resolved package or intentionally seek to execute a malicious payload.

Attack Path

1. A user invokes the Skill’s solution-information extraction workflow.
2. extract_sac_deploy_info.py calls build_pw_command().
3. The expected playwright-cli executable is absent, while npx is pres ...[truncated 1094 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic npx fallback and fail closed when the expected executable is unavailable.
2. If fallback execution is necessary, explicitly select the intended scoped package and pin its version, for example:

python

return [
    npx,
    "--yes",
    "--package=@playwright/cli@<reviewed-version>",
    "playwright-cli",
]

3. Keep the package version consistent with the installation guide and avoid @latest in automated execution paths.
4. Verify the resolved executable or package identity before execution.
5. Use a lockfile or controlled installation process where practical.
6. Run the extraction helper in a restricted environment that does not expose Huawei Cloud credentials unless they are required.
7. Document the exact trusted package name and version so installation and fallback behavior cannot diverge.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill directs users to download a Terraform template from a remote URL and proceed toward deployment, yet it does not require integrity verification of the fetched infrastructure code. In a deployment skill, that context makes this more dangerous because compromised or swapped templates could lead to unauthorized resource creation, credential exposure, or hostile bootstrap commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill directs users to download a Terraform template from a remote URL and proceed toward deployment, yet it does not require integrity verification of the fetched infrastructure code. In a deployment skill, that context makes this more dangerous because compromised or swapped templates could lead to unauthorized resource creation, credential exposure, or hostile bootstrap commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill directs users to download a Terraform template from a remote URL and proceed toward deployment, yet it does not require integrity verification of the fetched infrastructure code. In a deployment skill, that context makes this more dangerous because compromised or swapped templates could lead to unauthorized resource creation, credential exposure, or hostile bootstrap commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill directs users to download a Terraform template from a remote URL and proceed toward deployment, yet it does not require integrity verification of the fetched infrastructure code. In a deployment skill, that context makes this more dangerous because compromised or swapped templates could lead to unauthorized resource creation, credential exposure, or hostile bootstrap commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill directs users to download a Terraform template from a remote URL and proceed toward deployment, yet it does not require integrity verification of the fetched infrastructure code. In a deployment skill, that context makes this more dangerous because compromised or swapped templates could lead to unauthorized resource creation, credential exposure, or hostile bootstrap commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill directs users to download a Terraform template from a remote URL and proceed toward deployment, yet it does not require integrity verification of the fetched infrastructure code. In a deployment skill, that context makes this more dangerous because compromised or swapped templates could lead to unauthorized resource creation, credential exposure, or hostile bootstrap commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill directs users to download a Terraform template from a remote URL and proceed toward deployment, yet it does not require integrity verification of the fetched infrastructure code. In a deployment skill, that context makes this more dangerous because compromised or swapped templates could lead to unauthorized resource creation, credential exposure, or hostile bootstrap commands.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs use of powerful capabilities including environment-variable access, file reads/writes, network downloads, and shell execution, but it declares no corresponding tool scope or permission boundary. This increases the blast radius if the skill is misused or if supporting scripts behave unexpectedly, because reviewers and runtime policy layers lack explicit constraints.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

### Security

- 🚫 Never expose AK/SK in conversation or output
- 🚫 Never ask user to type AK/SK in chat
- 🚫 Never read or display `terraform.auto.tfvars.json` in conversation context (contains AK/SK)
- ✅ Prefer IAM users over primary account
- ✅ Modification ops (`apply`, `destroy`) require explicit user confirmation

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The JSON sets "region" to "cn-north-4", which imposes a specific locale/region in natural-language-like configuration without any indication that this choice is optional or user-selected. Per the policy, locale constraints should either offer user choice or be clearly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 63)May include surrounding context.

Install — Linux / macOS

bash

curl -fsSL -o <temp_dir>/terraform.zip "<URL_from_table_above>"
unzip -o <temp_dir>/terraform.zip -d /usr/local/bin/

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file is a markdown document, so SQP-2 applies to whether the description warns about behaviors affecting user data or system integrity. The document enumerates destructive permissions such as deleting ECS instances, VPCs, subnets, EIPs, and volumes, but does not clearly warn readers near the deployment section about the operational impact or potential data/resource loss from Apply/Destroy actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents terraform apply and terraform destroy, which can modify or remove infrastructure, but it provides no warning about their impact on user data, service availability, or irreversibility. Under the markdown-specific warning criterion, destructive or system-affecting behaviors should be accompanied by clear cautionary language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file explicitly recommends ssh root@<EIP> for remote administration, normalizing direct root login over the network without any warning or safer alternative. In the context of an internet-exposed LLM gateway deployment, this increases the risk of credential compromise, weak access practices, and high-impact host takeover if operators follow the example literally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly instructs writing Huawei Cloud access credentials into terraform.auto.tfvars.json and only checks that the file is 'not in git', which is not sufficient protection for sensitive secrets. This creates a realistic risk of credential exposure through local disk persistence, shell history, backups, logs, artifact collection, or accidental sharing during troubleshooting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The verification steps require opening ports 22 and 3000 and validating public HTTP access to the deployed service, but they provide no warning about attack surface expansion, public exposure, or cloud cost/resource consequences. In the context of deploying an internet-reachable LLM gateway, this omission can lead operators to expose administrative or application interfaces without understanding the security implications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script persists HuaweiCloud access credentials into terraform.auto.tfvars.json, creating a local plaintext secrets file as part of a normalization workflow. Even though it warns not to commit the file and masks console output, the secret material is still written to disk, where it can be accidentally committed, included in artifacts, read by other local users/processes, or exfiltrated by malware.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script reads cloud credentials from environment variables and then materializes them into a local file, increasing secret exposure beyond the process environment. In the context of a deployment skill for an LLM gateway on cloud infrastructure, this is more dangerous because such automation commonly runs in CI/CD, shared workspaces, or operator laptops where generated files may be archived, logged, synced, or accidentally checked into version control.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/playwright_utils.py (reported line 37)May include surrounding context.

python

allow_failure: bool = False,
) -> subprocess.CompletedProcess:
    full_cmd = [*base_cmd, f"-s={session}", *args]
    proc = subprocess.run(
        full_cmd,
        capture_output=True,
        text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The automation only attempts to dismiss dialogs using Chinese button text such as '知道了', '关闭', and '同意'. This imposes a specific language/locale assumption in the skill logic without offering a language choice or documenting that the skill is intentionally limited to Chinese-language pages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The configuration sets the region to "cn-north-4" by default, which imposes a specific locale/region selection in natural-language-relevant configuration without any indication that the user can choose or opt in. Under the policy, forcing a specific locale is a violation unless it is clearly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file instructs users to install Terraform for deploying the NewAPI LLM Gateway and includes commands that place binaries into system locations such as /usr/local/bin and system32. The guide does not include any user-facing warning that these steps modify privileged system paths and enable subsequent infrastructure deployment actions that could affect system integrity or cloud resources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The verification criteria require region to equal cn-north-4, which imposes a specific locale/region constraint. This file does not explain the reason for the restriction or indicate that the user can opt into this region-specific behavior.

Content

No source excerpt is available for this finding.