huawei-cloud-sac-yolo

• Outcome: Review
• Latest audit: Sep 21, 2026 · 6:39 AM UTC
• Version: 1.0.2

Overview

This skill is mostly coherent for deploying Huawei Cloud infrastructure, but it asks for broad cloud permissions and can write cloud access keys to a local Terraform file by default.

Review before installing if you are not prepared to grant broad Huawei Cloud permissions. Use a limited IAM user where possible, avoid Tenant Administrator unless absolutely required, inspect terraform plan carefully, do not run apply or destroy without explicit intent, keep terraform.auto.tfvars.json out of source control, and prefer short-lived or tightly scoped AK/SK credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill relies on browser automation, subprocess execution, temporary file creation, and parsing of remote content, which expands the attack surface substantially beyond the stated purpose. When paired with shell and network access, this can expose the agent to command misuse, untrusted content handling, or unsafe local execution paths if the helper scripts are not tightly constrained.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill relies on browser automation, subprocess execution, temporary file creation, and parsing of remote content, which expands the attack surface substantially beyond the stated purpose. When paired with shell and network access, this can expose the agent to command misuse, untrusted content handling, or unsafe local execution paths if the helper scripts are not tightly constrained.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill relies on browser automation, subprocess execution, temporary file creation, and parsing of remote content, which expands the attack surface substantially beyond the stated purpose. When paired with shell and network access, this can expose the agent to command misuse, untrusted content handling, or unsafe local execution paths if the helper scripts are not tightly constrained.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill relies on browser automation, subprocess execution, temporary file creation, and parsing of remote content, which expands the attack surface substantially beyond the stated purpose. When paired with shell and network access, this can expose the agent to command misuse, untrusted content handling, or unsafe local execution paths if the helper scripts are not tightly constrained.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill relies on browser automation, subprocess execution, temporary file creation, and parsing of remote content, which expands the attack surface substantially beyond the stated purpose. When paired with shell and network access, this can expose the agent to command misuse, untrusted content handling, or unsafe local execution paths if the helper scripts are not tightly constrained.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill relies on browser automation, subprocess execution, temporary file creation, and parsing of remote content, which expands the attack surface substantially beyond the stated purpose. When paired with shell and network access, this can expose the agent to command misuse, untrusted content handling, or unsafe local execution paths if the helper scripts are not tightly constrained.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill instructs use of high-risk capabilities including environment variables, filesystem access, network retrieval, and shell execution, but declares no explicit tool scope or allowlist. In an agent setting this weakens containment and increases the chance the skill can invoke more powerful actions than intended, especially around credential handling and infrastructure changes.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad enough to activate this Huawei-specific infrastructure skill for generic requests about YOLO or GPU training. In an agent ecosystem, overbroad activation can cause the wrong skill to run, leading to unexpected credential prompts, network access, downloads, or infrastructure-related guidance in contexts where the user did not intend cloud deployment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Security

- 🚫 Never expose AK/SK in conversation or output
- 🚫 Never ask user to type AK/SK in chat
- ✅ Prefer IAM users over primary account
- ✅ Modification ops (`apply`, `destroy`) require explicit user confirmation

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file includes installation commands that download binaries and extract them into /usr/local/bin and $env:SystemRoot\system32, which modify system-wide locations and can affect system integrity. The guide provides no explicit warning that these commands change protected directories or may require administrative privileges.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Install — Linux / macOS

```bash
curl -fsSL -o /tmp/terraform.zip "<URL_from_table_above>"
unzip -o /tmp/terraform.zip -d /usr/local/bin/
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The deployment guidance expands narrowly listed create/delete permissions into wildcard permissions such as ecs:servers:* and rfs:stacks:* on all resources, and later instructs users to grant Tenant Administrator to the rf_admin_trust agency across all resources. This materially increases blast radius beyond minimum privilege, enabling destructive actions, privilege misuse, and broad account-wide changes if the deployment identity, agency, or automation is compromised.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file documents `terraform apply` and `terraform destroy`, which can modify or remove infrastructure and affect user data or system integrity. The page provides no warning, confirmation guidance, or cautionary language about the impact of running these commands.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The markdown includes `ssh root@<EIP>` commands for direct root access to a live instance. Direct root access can affect system integrity and operational safety, but the document does not warn users about the sensitivity of these commands or recommend limiting use to authorized operators.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The verification method explicitly requires writing Huawei Cloud access credentials into `terraform.auto.tfvars.json`, which places long-lived AK/SK secrets on local disk in a conventional Terraform autoload file. Although it notes the file should not be tracked in git, that does not address exposure through local compromise, backups, shell history, accidental archiving, CI artifacts, or broad filesystem permissions; in a deployment skill that handles real cloud credentials, this materially increases secret leakage risk.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module docstring and apparent scope imply harmless provider-source normalization, but the implementation additionally injects credential variables and emits a credential-bearing terraform.auto.tfvars.json. This mismatch is dangerous because operators may run the script under false assumptions, causing unintended secret materialization on disk in environments where they would not have approved secret handling.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script’s stated purpose is provider normalization, but it also reads Huawei cloud credentials from environment variables and writes them into terraform.auto.tfvars.json on disk. Persisting secrets to a local file increases the chance of accidental disclosure through source control, backups, logs, workspace sharing, or other tooling, especially because auto-loaded tfvars files are routinely created and consumed without additional scrutiny.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes terraform.auto.tfvars.json containing access_key and secret_key without an explicit pre-write confirmation, despite those values being sensitive credentials. In an agent/automation context, this can silently persist secrets in a repository or workspace and materially raises the risk of credential leakage through later commits, artifact collection, or multi-user access.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

allow_failure: bool = False,
) -> subprocess.CompletedProcess:
    full_cmd = [*base_cmd, f"-s={session}", *args]
    proc = subprocess.run(
        full_cmd,
        capture_output=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The script attempts to interact with the page using only Chinese button labels such as '知道了', '关闭', and '同意'. This is a natural-language locale constraint embedded in code, and there is no indication that the skill is intentionally region-specific or that users can choose or override the language behavior.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The comment and default value state that only "cn-north-4" is supported, which imposes a specific regional locale choice in natural-language configuration guidance. Under the policy, forcing a specific locale is a violation unless the constraint is clearly justified or presented as an opt-in choice.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The trigger definition hard-codes both English and Chinese activation phrases, including Chinese-only phrases, but does not explain language selection or whether multilingual triggering is optional. This can create an implicit language/locale policy choice without user opt-in.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: Publishing the platform access endpoint as plain HTTP encourages access to the YOLO training UI without transport encryption. In a cloud deployment, this can expose session tokens, credentials, and sensitive training data to interception or manipulation, especially if the service is reachable over untrusted networks.

Static analysis

No suspicious patterns detected.