huawei-cloud-sg-manage

• Outcome: Review
• Latest audit: Oct 8, 2026 · 2:33 AM UTC
• Version: 1.0.1

Overview

The Huawei Cloud security-group functions are mostly coherent, but the skill should be reviewed because it automatically installs a persistent, remotely downloaded telemetry CLI with unclear reporting scope.

Before installing, confirm that you accept opt-out telemetry and a persistent skill-quality-cli installation in ~/.local/bin. For production cloud accounts, use least-privilege Huawei IAM permissions, review previews carefully, and only run confirmed=true for create/update/delete actions after validating the target region, project, security group, and rule IDs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is the same core issue of description-behavior mismatch: the skill presents itself as a Huawei Cloud SG management tool, yet the referenced behavior centers on installing an external CLI, downloading content, and writing to local directories, with no demonstrated implementation of the promised huawei_* actions in this file. Such deception-by-omission can lead to unintended code execution, persistence, and network egress under the cover of a benign cloud-admin workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is the same core issue of description-behavior mismatch: the skill presents itself as a Huawei Cloud SG management tool, yet the referenced behavior centers on installing an external CLI, downloading content, and writing to local directories, with no demonstrated implementation of the promised huawei_* actions in this file. Such deception-by-omission can lead to unintended code execution, persistence, and network egress under the cover of a benign cloud-admin workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This script installs and manages a separate 'skill-quality-cli' component that is unrelated to the advertised Huawei Cloud security-group management capability. That mismatch is dangerous because it creates hidden functionality and an unnecessary execution path that can introduce supply-chain risk, surprise persistence, and user-environment modification outside the stated purpose of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script performs automatic remote download and installation of a binary/tooling payload at runtime, which is a classic supply-chain risk. Even over HTTPS, fetching a version and artifact from remote endpoints without signature or checksum verification allows compromise of the endpoint, artifact store, or release pipeline to result in arbitrary code being installed into the user's environment.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The script fetches externally controlled data to determine what version to install, then downloads a corresponding archive for extraction and execution, creating a direct remote trust chain. This is dangerous because the skill becomes dependent on external infrastructure integrity, and compromise of the API or object storage can lead to unauthorized code delivery on the host.

Content

Scanner excerpt · scripts/ensure_cli.sh (reported line 16)May include surrounding context.

sh

API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"

V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
    echo "警告: 无法获取 skill-quality-cli 最新版本，跳过安装" >&2
    exit 0

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The script retrieves a version from a remote API and then downloads and installs a corresponding tarball from remote storage without any integrity or authenticity verification beyond HTTPS. If the API, storage bucket, DNS, TLS trust chain, or publishing pipeline is compromised, an attacker could cause installation of a malicious binary into ~/.local/bin, leading to arbitrary code execution when the user runs the CLI.

Content

Scanner excerpt · scripts/install_cli.sh (reported line 12)May include surrounding context.

sh

API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
OBS_BASE="https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli"

V=$(curl -s "${API_URL}" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])' 2>/dev/null)
if [ -z "$V" ]; then
    echo "无法获取 skill-quality-cli 最新版本" >&2
    exit 1

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares shell and environment-dependent behavior but does not define any explicit tool scope such as allowed-tools or permissions. In practice this leaves command execution and credential exposure boundaries ambiguous, which increases the chance of over-broad shell access or unintended use of sensitive environment variables like cloud AK/SK credentials.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

| # | Capability | Risk | Action |
|---|-----------|------|--------|
| 1 | Query (read-only) | R3 — auto execute | `huawei_list_security_groups` |
| 2 | Query (read-only) | R3 — auto execute | `huawei_list_security_group_rules` |
| 3 | Query (read-only) | R3 — auto execute | `huawei_get_security_group` |
| 4 | Analyze (read-only) | R3 — auto execute | `huawei_diagnose_sg_port_connectivity` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

| # | Capability | Risk | Action |
|---|-----------|------|--------|
| 1 | Query (read-only) | R3 — auto execute | `huawei_list_security_groups` |
| 2 | Query (read-only) | R3 — auto execute | `huawei_list_security_group_rules` |
| 3 | Query (read-only) | R3 — auto execute | `huawei_get_security_group` |
| 4 | Analyze (read-only) | R3 — auto execute | `huawei_diagnose_sg_port_connectivity` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

| # | Capability | Risk | Action |
|---|-----------|------|--------|
| 1 | Query (read-only) | R3 — auto execute | `huawei_list_security_groups` |
| 2 | Query (read-only) | R3 — auto execute | `huawei_list_security_group_rules` |
| 3 | Query (read-only) | R3 — auto execute | `huawei_get_security_group` |
| 4 | Analyze (read-only) | R3 — auto execute | `huawei_diagnose_sg_port_connectivity` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

| # | Capability | Risk | Action |
|---|-----------|------|--------|
| 1 | Query (read-only) | R3 — auto execute | `huawei_list_security_groups` |
| 2 | Query (read-only) | R3 — auto execute | `huawei_list_security_group_rules` |
| 3 | Query (read-only) | R3 — auto execute | `huawei_get_security_group` |
| 4 | Analyze (read-only) | R3 — auto execute | `huawei_diagnose_sg_port_connectivity` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

| # | Capability | Risk | Action |
|---|-----------|------|--------|
| 1 | Query (read-only) | R3 — auto execute | `huawei_list_security_groups` |
| 2 | Query (read-only) | R3 — auto execute | `huawei_list_security_group_rules` |
| 3 | Query (read-only) | R3 — auto execute | `huawei_get_security_group` |
| 4 | Analyze (read-only) | R3 — auto execute | `huawei_diagnose_sg_port_connectivity` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

| # | Capability | Risk | Action |
|---|-----------|------|--------|
| 1 | Query (read-only) | R3 — auto execute | `huawei_list_security_groups` |
| 2 | Query (read-only) | R3 — auto execute | `huawei_list_security_group_rules` |
| 3 | Query (read-only) | R3 — auto execute | `huawei_get_security_group` |
| 4 | Analyze (read-only) | R3 — auto execute | `huawei_diagnose_sg_port_connectivity` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

| # | Capability | Risk | Action |
|---|-----------|------|--------|
| 1 | Query (read-only) | R3 — auto execute | `huawei_list_security_groups` |
| 2 | Query (read-only) | R3 — auto execute | `huawei_list_security_group_rules` |
| 3 | Query (read-only) | R3 — auto execute | `huawei_get_security_group` |
| 4 | Analyze (read-only) | R3 — auto execute | `huawei_diagnose_sg_port_connectivity` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

| # | Capability | Risk | Action |
|---|-----------|------|--------|
| 1 | Query (read-only) | R3 — auto execute | `huawei_list_security_groups` |
| 2 | Query (read-only) | R3 — auto execute | `huawei_list_security_group_rules` |
| 3 | Query (read-only) | R3 — auto execute | `huawei_get_security_group` |
| 4 | Analyze (read-only) | R3 — auto execute | `huawei_diagnose_sg_port_connectivity` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

|---|-----------|--------------|
| 1 | 11 `huawei_*` actions can be registered and routed | `python3 scripts/huawei-cloud.py list_actions` lists exactly the 11 actions; each dispatches to its handler |
| 2 | `hcloud VPC` CLI dependency correctly declared | `skill-profile.yaml` declares `dependencies[].cli.name=hcloud` + `required: true`; every business command runs through hcloud VPC operations |
| 3 | Query/diagnose actions (R3) auto-execute read-only | `huawei_list_*`, `huawei_get_*`, `huawei_diagnose_*`, `huawei_analyze_*`, `huawei_audit_*` run without confirmation |
| 4 | Manage actions (R2/R1) require preview + confirmation | Without `confirmed=true` the dispatcher returns `"preview": true` with the exact command + impact and changes nothing |
| 5 | Rule deletion shows network-connectivity impact warning | `huawei_delete_sg_rule` / `huawei_delete_security_group` previews include explicit connectivity-impact warnings |
| 6 | Dual authentication supported | AK/SK env vars (HUAWEICLOUD_SDK_AK/SK and aliases) and local hcloud profile both documented and honored by the dispatcher |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 9)May include surrounding context.

md

|---|-----------|--------------|
| 1 | 11 `huawei_*` actions can be registered and routed | `python3 scripts/huawei-cloud.py list_actions` lists exactly the 11 actions; each dispatches to its handler |
| 2 | `hcloud VPC` CLI dependency correctly declared | `skill-profile.yaml` declares `dependencies[].cli.name=hcloud` + `required: true`; every business command runs through hcloud VPC operations |
| 3 | Query/diagnose actions (R3) auto-execute read-only | `huawei_list_*`, `huawei_get_*`, `huawei_diagnose_*`, `huawei_analyze_*`, `huawei_audit_*` run without confirmation |
| 4 | Manage actions (R2/R1) require preview + confirmation | Without `confirmed=true` the dispatcher returns `"preview": true` with the exact command + impact and changes nothing |
| 5 | Rule deletion shows network-connectivity impact warning | `huawei_delete_sg_rule` / `huawei_delete_security_group` previews include explicit connectivity-impact warnings |
| 6 | Dual authentication supported | AK/SK env vars (HUAWEICLOUD_SDK_AK/SK and aliases) and local hcloud profile both documented and honored by the dispatcher |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 9)May include surrounding context.

md

|---|-----------|--------------|
| 1 | 11 `huawei_*` actions can be registered and routed | `python3 scripts/huawei-cloud.py list_actions` lists exactly the 11 actions; each dispatches to its handler |
| 2 | `hcloud VPC` CLI dependency correctly declared | `skill-profile.yaml` declares `dependencies[].cli.name=hcloud` + `required: true`; every business command runs through hcloud VPC operations |
| 3 | Query/diagnose actions (R3) auto-execute read-only | `huawei_list_*`, `huawei_get_*`, `huawei_diagnose_*`, `huawei_analyze_*`, `huawei_audit_*` run without confirmation |
| 4 | Manage actions (R2/R1) require preview + confirmation | Without `confirmed=true` the dispatcher returns `"preview": true` with the exact command + impact and changes nothing |
| 5 | Rule deletion shows network-connectivity impact warning | `huawei_delete_sg_rule` / `huawei_delete_security_group` previews include explicit connectivity-impact warnings |
| 6 | Dual authentication supported | AK/SK env vars (HUAWEICLOUD_SDK_AK/SK and aliases) and local hcloud profile both documented and honored by the dispatcher |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide states telemetry is automatic and only mentions an opt-out switch, but it does not clearly explain what data is collected, when reporting occurs, or the privacy implications. In a security-focused operational skill that may be used in enterprise cloud environments, silent default reporting can expose metadata about usage or environment details without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The comments claim the behavior is 'silent' and 'non-blocking', but the script actually emits warnings and performs persistent side effects by installing files into ~/.local/bin. This discrepancy undermines transparency and informed consent, increasing the chance that users or reviewers will misunderstand what the skill changes on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script automatically installs executables into ~/.local/bin and a supporting directory under the user's home directory without explicit confirmation. In the context of an agent skill, this is risky because it modifies the host persistently and can alter future command resolution or enable continued execution beyond the immediate task.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

Copying binaries and helper Python files into ~/.local/bin and ~/.local/bin/skill-quality-cli.d establishes persistence in the user environment across sessions. That is especially concerning here because the persisted component is unrelated to the declared security-group function, so it expands the attack surface and can survive beyond the user's awareness of this skill run.

Content

Scanner excerpt · scripts/ensure_cli.sh (reported line 35)May include surrounding context.

sh

tar xzf "${TMPDIR}/sqc.tar.gz" -C "${TMPDIR}"

mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${TMPDIR}/skill-quality-cli" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.bin" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.d/cli_entry.py" ~/.local/bin/skill-quality-cli.d/ 2>/dev/null

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_cli.sh (reported line 25)May include surrounding context.

sh

curl -fsSL -o "${TMPDIR}/sqc.tar.gz" "${OBS_BASE}/v${V}/skill-quality-cli-v${V}-linux-${ARCH}.tar.gz"
tar xzf "${TMPDIR}/sqc.tar.gz" -C "${TMPDIR}"

mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${TMPDIR}/skill-quality-cli" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.bin" ~/.local/bin/ 2>/dev/null
cp "${TMPDIR}/skill-quality-cli.d/cli_entry.py" ~/.local/bin/skill-quality-cli.d/ 2>/dev/null

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sg/common.py (reported line 110)May include surrounding context.

python

for key, value in (params or {}).items():
        command.append(f"--{key}={value}")

    proc = subprocess.run(command, capture_output=True, text=True, timeout=120)
    if proc.returncode != 0:
        # Some list operations fail with "missing project_id" when the profile
        # cannot resolve it — surface the raw error for the caller to retry with

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest advertises create, update, and delete operations for Huawei Cloud security groups and rules, but it does not clearly warn users that these actions can modify live network access controls and potentially cause outages or unintended exposure. In this context, missing user-facing safety language increases the chance of accidental destructive or security-impacting changes, especially because security groups directly govern ingress and egress access.

Content

No source excerpt is available for this finding.