Security audit

huawei-cloud-sms-migration-assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Huawei Cloud migration assistant, but it includes unsafe high-impact migration and repair instructions that could expose or damage migrated systems.

Review before installing. Use this only with experienced Huawei Cloud migration operators, replace the hard-coded helper password with unique short-lived credentials or keys, restrict SSH and migration ports to exact trusted CIDRs, avoid writing AK/SK to predictable temp files, back up disks before repair commands, and require explicit approval before partition, bootloader, root password, SSH, EIP, or security-group changes.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: references/MIGRATION_REFERENCE.md:262
Finding: Public Helper ECS Uses a Shared Hard-Coded Root Password
Content: View full analysis
Vulnerability Details

File Location: references/MIGRATION_REFERENCE.md, lines 262–279
Vulnerability Type: Hard-coded administrative credential
Risk Level: High

Vulnerable Code

bash
hcloud ECS CreateServers --cli-region=<region> \ --server.name=helper_${TIMESTAMP} --server.imageRef=<image_id> --server.flavorRef=s6.large.05 \ --server.vpcid=<vpc_id> --server.nics.1.subnet_id=<subnet_id> \ --server.publicip.eip.iptype=5_bgp --server.publicip.eip.bandwidth.size=10 --server.publicip.eip.bandwidth.sharetype=PER \ --server.root_volume.volumetype=GPSSD --server.root_volume.size=40 \ --server.availability_zone=<az> --server.security_groups.1.id=<sg_id> --server.adminPass='Helper@2026' # 创建后重启一次使密码生效 hcloud ECS BatchRebootServers --cli-region=<region> --reboot.servers.1.id=<helper_id> --reboot.type=SOFT

The subsequent repair procedure authenticates with the same published password:

bash
sshpass -p 'Helper@2026' ssh root@<helper_eip> '

Technical Analysis

The repair workflow creates a helper ECS with a public EIP and assigns the fixed root password Helper@2026. The same password is embedded in the SSH command, confirming that it is intended to be an active reusable credential rather than an illustrative value to be replaced.

The helper ECS receives the migrated system disk and executes privileged repair operations against it. Consequently, compromise of the helper provides access not only to the temporary instance but also to the complete migrated filesystem, including application data, password hashes, configuration files, and credentials stored on the disk.

The attacker-controlled point is an SSH connection from any party within the security group's permitted ingress scope. The crossed trust boundary is from an untrusted network client to a root shell on the publicly addressed helper ECS.

Attack Path

An operator follows the documented post-migration repair procedure.

The workflow creates a helper ECS w ...[truncated 934 chars]
Remediation: View remediation
Remediation Suggestions

Do not embed a reusable administrative password in the Skill.

Prefer a unique, ephemeral SSH key pair generated for each repair operation.

If password authentication is unavoidable, generate a cryptographically random, single-use password and deliver it through a protected secret channel.

Restrict helper SSH ingress to the operator's exact source address or a dedicated private management network.

Do not expose the helper through an EIP when private connectivity is available.

Disable root password authentication after the repair and destroy all temporary credentials.

Detach the migrated disk and delete the helper ECS and EIP immediately after successful validation.

T09 · Insecure Skill Coding Practices

Warning

Location: references/MIGRATION_REFERENCE.md:48
Finding: Huawei Cloud AK/SK Credentials Are Written to a Predictable Unsafe Temporary File
Content: View full analysis
Vulnerability Details

File Location: references/MIGRATION_REFERENCE.md, lines 48–67
Vulnerability Type: Predictable temporary file containing plaintext credentials
Risk Level: Medium

Vulnerable Code

bash
# 首次（通过临时文件传递凭据，避免 AK/SK 出现在进程参数中） ssh -i key.pem user@ip 'sudo bash -c "cd /root/SMS-Agent && cat > /tmp/.sms_input << '\''EOF'\'' y y <AK> <SK> sms.ap-southeast-3.myhuaweicloud.com 0 EOF bash ./startup.sh < /tmp/.sms_input && rm -f /tmp/.sms_input"' # 重启 ssh -i key.pem user@ip 'sudo bash -c "cd /root/SMS-Agent && cat > /tmp/.sms_input << '\''EOF'\'' y y <AK> <SK> y 0 EOF bash ./startup.sh < /tmp/.sms_input && rm -f /tmp/.sms_input"'

Technical Analysis

The non-interactive installation procedure writes the Huawei Cloud access key and secret key in plaintext to the fixed path /tmp/.sms_input. The command does not securely create the file, set mode 0600, verify ownership, or reject a pre-existing symbolic link.

Because the redirection is performed by a privileged shell, a local attacker can pre-create /tmp/.sms_input as a symbolic link to another path and cause the root shell to follow it. Depending on the target and resulting file permissions, this can produce privileged file overwrite or allow the attacker to read the credentials. A typical permissive root umask may also make the newly created file readable by other local users while it exists.

Cleanup is performed with:

bash
bash ./startup.sh < /tmp/.sms_input && rm -f /tmp/.sms_input

The use of && means the credential file is deleted only when startup.sh exits successfully. A startup failure therefore leaves the plaintext AK/SK on disk.

The attacker-controlled point is the predictable shared temporary-file path. The trust boundary crossed is from a low-privilege local user to root-managed cloud credentials and privileged filesystem writes.

Attack Path

A local low-privilege attacker anticipates use of the documented installer.

Before installa ...[truncated 908 chars]
Remediation: View remediation
Remediation Suggestions

Create the input file with mktemp inside a root-only directory such as /run or a securely permissioned runtime directory.

Set umask 077 before file creation and explicitly enforce mode 0600.

Use creation semantics that fail if the file already exists, and verify that it is a regular root-owned file rather than a symbolic link.

Install an unconditional trap to remove the file on normal exit, error, interruption, or termination.

Prefer an official protected secret-input mechanism that avoids writing AK/SK credentials to disk.

Use short-lived, least-privileged cloud credentials and rotate them immediately if this documented procedure has already been used on a shared host.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/MIGRATION_REFERENCE.md:106
Finding: Migration Service Port Is Opened to All IPv4 Sources
Content: View full analysis
Vulnerability Details

File Location: references/MIGRATION_REFERENCE.md, lines 106–114
Vulnerability Type: Overly broad network access control
Risk Level: Medium

Vulnerable Code

bash
# 检查 hcloud VPC ListSecurityGroupRules --cli-region=<region> --project_id=<pid> --security_group_id.1=<sg_id> # 添加（以 8899 为例） hcloud VPC CreateSecurityGroupRule --cli-region=<region> --project_id=<pid> --security_group_rule.security_group_id=<sg_id> \ --security_group_rule.direction=ingress --security_group_rule.protocol=tcp \ --security_group_rule.multiport=8899 --security_group_rule.remote_ip_prefix=0.0.0.0/0 \ --security_group_rule.action=allow --security_group_rule.ethertype=IPv4

Technical Analysis

The documented command authorizes inbound TCP traffic to port 8899 from 0.0.0.0/0, making the migration service port reachable from every IPv4 source when the associated instance has a routable path.

This is broader than required for SMS migration, which should only need traffic from identified source systems, private migration networks, or documented service ranges. It also directly conflicts with the prohibition in SKILL.md against security groups that allow 0.0.0.0/0.

The attacker-controlled point is arbitrary traffic originating from an external IPv4 address. The trust boundary crossed is the cloud security-group perimeter protecting the migration control/data service.

Attack Path

An operator follows the documented block-migration security-group setup.

The command creates an ingress rule for TCP port 8899 with source 0.0.0.0/0.

The rule is associated with a migration-reachable ECS or service endpoint.

An external attacker discovers the exposed address and connects to port 8899.

The attacker can probe, abuse, or attempt to exploit the listening migration service from outside the authorized migration network.

Exploitation beyond network access depends on the behavior and security of the listening service; howev ...[truncated 471 chars]
Remediation: View remediation
Remediation Suggestions

Replace 0.0.0.0/0 with the exact source-server addresses, VPN CIDRs, dedicated-line CIDRs, or narrowly scoped trusted SMS service ranges.

Use private networking for migration traffic whenever possible.

Create a dedicated migration security group rather than modifying a broadly reused group.

Apply rules only for the ports required by the selected migration mode.

Remove temporary ingress rules immediately after migration.

Add a validation step that rejects universal source prefixes before applying security-group changes.

T09 · Insecure Skill Coding Practices

Warning

Location: references/MIGRATION_REFERENCE.md:287
Finding: Repair Workflow Performs Unvalidated Fixed-Offset Disk Repartitioning
Content: View full analysis
Vulnerability Details

File Location: references/MIGRATION_REFERENCE.md, lines 287–296
Vulnerability Type: Unsafe destructive disk modification
Risk Level: Medium

Vulnerable Code

bash
# 0. 挂载分区（先通过 lsblk 确认分区号，不同源端分区布局不同） lsblk /dev/vdb -o NAME,SIZE,FSTYPE,MOUNTPOINT,PARTLABEL mount /dev/vdb<root_part> /mnt # root 分区 mount /dev/vdb<boot_part> /mnt/boot 2>/dev/null # boot 分区（如有） mount /dev/vdb<efi_part> /mnt/boot/efi 2>/dev/null # EFI 分区（如有） # 根据 lsblk 输出确认 root/boot/efi 分区号，替换上方 <root_part>/<boot_part>/<efi_part> # ============================================================ # 修复项 1: 安装 BIOS GRUB（UEFI→BIOS） # ============================================================ # 创建 BIOS Boot Partition（GPT 上 i386-pc GRUB 需要） parted /dev/vdb mkpart primary 8588MB 8589MB parted /dev/vdb set <part_num> bios_grub on && partprobe /dev/vdb && sleep 2

Technical Analysis

The repair instructions unconditionally create a partition at the fixed range 8588MB–8589MB on the migrated disk. Although the workflow tells the operator to inspect partition numbers, it does not require validation that this byte range is unallocated, does not overlap an existing partition, and is suitable for a BIOS boot partition.

The source disk layout is explicitly acknowledged as variable. A fixed offset therefore cannot safely apply to every migrated disk. The instructions also lack a dry run, partition-table backup, automated overlap check, or explicit confirmation immediately before the destructive change.

The dangerous operation modifies the destination's partition table. The crossed authorization boundary is from a boot-repair operation to potentially destructive modification of user data outside verified free space.

Attack Path

A migrated ECS is unreachable, causing the operator or agent to invoke the documented repair workflow.

The migrated system disk is attached to the helper as /dev/vdb.

The source disk ...[truncated 712 chars]
Remediation: View remediation
Remediation Suggestions

Parse the current GPT/partition map and identify verified unallocated space before creating a BIOS boot partition.

Abort if no suitable non-overlapping range exists.

Back up the partition table with an appropriate disk-management tool before making changes.

Display the proposed partition change and require explicit user confirmation immediately before execution.

Provide a dry-run or validation-only mode.

Verify the disk identity, expected volume ID, partition boundaries, and filesystem layout before modifying /dev/vdb.

Prefer image preparation or migration mechanisms that reserve a BIOS boot partition in advance rather than repartitioning a disk containing migrated data.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises an orchestration skill for the full migration lifecycle, from ingesting host data in OBS through pre-checks, agent startup, task creation, error-handling guidance, and replication monitoring. The supplied code does none of that. Its primary purpose is materially different: it is a post-migration audit/check script. It consumes a JSON host list from a file path, optionally calls hcloud CLI to inspect ECS/volume details, and validates target specs, source snapshot integrity, network connectivity, and application/business check results. While this is related to migration in a broad sense, it is not the described end-to-end migration workflow and omits nearly all declared core capabilities. Therefore this is a clear description/behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a full migration workflow, but the supplied code implements only one subset: pre-migration checking. The script parses a local input file and performs validation/reporting; it contains no logic for OBS access, interactive user confirmation, SMS agent startup, task creation, error-reference expansion, or task monitoring/completion reporting. While pre-check is one legitimate component of the declared workflow, the actual code chunk’s purpose is materially narrower than the declared end-to-end migration behavior, so this is a description/behavior mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
pre-check, start up the sms agent, create sms migration tasks, read and expand 'MIGRATION_REFERENCE.md' if encounter error during the migration, monitor the tas

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
pre-check, start up the sms agent, create sms migration tasks, read and expand 'MIGRATION_REFERENCE.md' if encounter error during the migration, monitor the tas

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
pre-check, start up the sms agent, create sms migration tasks, read and expand 'MIGRATION_REFERENCE.md' if encounter error during the migration, monitor the tas

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
pre-check, start up the sms agent, create sms migration tasks, read and expand 'MIGRATION_REFERENCE.md' if encounter error during the migration, monitor the tas

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
pre-check, start up the sms agent, create sms migration tasks, read and expand 'MIGRATION_REFERENCE.md' if encounter error during the migration, monitor the tas

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.
md
pre-check, start up the sms agent, create sms migration tasks, read and expand 'MIGRATION_REFERENCE.md' if encounter error during the migration, monitor the tas

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
md
pre-check, start up the sms agent, create sms migration tasks, read and expand 'MIGRATION_REFERENCE.md' if encounter error during the migration, monitor the tas

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.
md
pre-check, start up the sms agent, create sms migration tasks, read and expand 'MIGRATION_REFERENCE.md' if encounter error during the migration, monitor the tas

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The skill explicitly discusses how migrated systems preserve and overwrite password state via /etc/shadow and then directs resetting credentials later. In context, this normalizes handling of credential material and creates a dangerous workflow where an agent may manipulate privileged authentication state during migration, increasing risk of credential exposure or unauthorized access.
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
| is_template=true | 模板被级联删除 | | **target_password** | 见下方说明 | **`target_password` 的真相**：该参数设置 SMS 创建中间 ECS 时的密码。但全盘迁移完成后，源盘的 `/etc/shadow` 会覆盖中间 ECS 的密码 — **最终迁移盘上的密码是源端的，不是 `target_password` 设的值**。因此必须在迁移后修复脚本中重新设置密码（见第七节修复项 6）。完整命令见 `references/MIGRATION_REFERENCE.md` C.3 节。

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: This section states that the migrated root password is preserved from /etc/shadow and later instructs setting a new root password and enabling password-based root SSH login. In a high-privilege migration skill, that combination materially lowers the security posture of the destination host and could enable persistent privileged access if the workflow is abused or misconfigured.
Content: Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.
md
| 1 | **源端使用UEFI, 华为云只支持BIOS，ECS启动不匹配** | AWS 用 UEFI，华为云 ECS 用 BIOS | ECS 完全无法启动 | | 2 | **AWS 内核不兼容** | 源端内核（如 `vmlinuz-7.0.0-1010-aws`）在华为云虚拟硬件上不启动 | 启动到内核即 halt，无日志 | | 3 | **网络配置残留** | netplan 配 AWS 静态 IP + 网卡名 ens5；cloud-init 用 DataSourceEc2Local | 网卡无 IP，SSH 不通 | | 4 | **root 密码不是预期值** | 全盘迁移保留源端 `/etc/shadow`，`target_password` 被覆盖 | 无法登录 | | 5 | **grub.d 覆盖内核参数** | `50-cloudimg-settings.cfg` 覆盖 `GRUB_CMDLINE_LINUX_DEFAULT`，`net.ifnames=0` 丢失 | 网卡名不正确 | ### 判断标志

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/MIGRATION_REFERENCE.md (reported line 11)May include surrounding context.
A.1 前置条件检查

bash
whoami && sudo -n true 2>/dev/null && echo "sudo OK" sudo test -w /root/ && echo "/root writable" which rsync && rsync --version | head -1 uname -m # 应为 x86_64

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/MIGRATION_REFERENCE.md (reported line 57)May include surrounding context.
md
sms.ap-southeast-3.myhuaweicloud.com 0 EOF bash ./startup.sh < /tmp/.sms_input && rm -f /tmp/.sms_input"' # 重启 ssh -i key.pem user@ip 'sudo bash -c "cd /root/SMS-Agent && cat > /tmp/.sms_input << '\''EOF'\'' y

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/MIGRATION_REFERENCE.md (reported line 67)May include surrounding context.
md
sms.ap-southeast-3.myhuaweicloud.com 0 EOF bash ./startup.sh < /tmp/.sms_input && rm -f /tmp/.sms_input"' # 重启 ssh -i key.pem user@ip 'sudo bash -c "cd /root/SMS-Agent && cat > /tmp/.sms_input << '\''EOF'\'' y

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/MIGRATION_REFERENCE.md (reported line 57)May include surrounding context.
md
sms.ap-southeast-3.myhuaweicloud.com 0 EOF bash ./startup.sh < /tmp/.sms_input && rm -f /tmp/.sms_input"' # 重启 ssh -i key.pem user@ip 'sudo bash -c "cd /root/SMS-Agent && cat > /tmp/.sms_input << '\''EOF'\'' y

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/MIGRATION_REFERENCE.md (reported line 67)May include surrounding context.
md
sms.ap-southeast-3.myhuaweicloud.com 0 EOF bash ./startup.sh < /tmp/.sms_input && rm -f /tmp/.sms_input"' # 重启 ssh -i key.pem user@ip 'sudo bash -c "cd /root/SMS-Agent && cat > /tmp/.sms_input << '\''EOF'\'' y

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The document instructs setting a root password directly and elsewhere enables root SSH password login, which materially weakens host access controls and creates a high-value credential target. In a migration workflow this is especially dangerous because the procedure may be applied repeatedly across many servers, expanding blast radius if the password is exposed, reused, logged, or guessed.
Content: Scanner excerpt · references/MIGRATION_REFERENCE.md (reported line 347)May include surrounding context.
md
# ============================================================ # 修复项 6: 设置 root 密码（⚠️ 用用户预期密码！） # ============================================================ # 全盘迁移保留源端 /etc/shadow，target_password 被覆盖 # 必须在此重设为用户预期密码 chroot /mnt /bin/bash -c "echo \"root:<EXPECTED_PASSWORD>\" | chpasswd"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The script deletes kernel and initrd files using broad wildcards after modifying boot configuration, which can render the migrated system unbootable if matching assumptions are wrong or multiple kernels are needed for fallback. In a recovery workflow operating on attached disks, an incorrect deletion can cause destructive, hard-to-recover service outages at scale.
Content: Scanner excerpt · references/MIGRATION_REFERENCE.md (reported line 369)May include surrounding context.
md
# 更新 grub 配置（会读取 99-net-ifnames.cfg） update-grub # 新内核已生效，安全删除 AWS 旧内核 rm -f /boot/vmlinuz-*-aws /boot/initrd.img-*-aws 2>/dev/null # 重建 initramfs（使用新内核） update-initramfs -u -k all # 验证 netplan 语法

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/MIGRATION_REFERENCE.md (reported line 411)May include surrounding context.
md
| 3. netplan DHCP | 源端配 AWS 静态 IP + 网卡名 ens5 | 网卡无 IP | | 4. 99-net-ifnames.cfg | 50-cloudimg-settings.cfg 覆盖 GRUB_CMDLINE | net.ifnames=0 丢失，网卡名不正确 | | 5. 禁用 cloud-init 网络 | cloud-init 用 DataSourceEc2Local 覆盖 netplan | cloud-init 启动后网络配置被覆盖 | | 6. 设置 root 密码 | 全盘迁移保留源端 /etc/shadow | 用户无法用预期密码登录 | | 7. 更新 grub | 新内核需要 grub.cfg 入口 | grub 找不到新内核 | | 8. 重建 initramfs | 新内核需要匹配的 initrd | 内核无法加载驱动 | | 9. SSH 密码登录 | sshd_config 可能禁用密码登录 | 仅密钥可用，密码登录被拒 |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares shell and file-reading style capabilities in its instructions but does not define an explicit tool scope such as allowed-tools or permissions. In an agent setting, this creates an over-privileged execution surface where the model may invoke filesystem or shell actions beyond what is minimally required for safe migration assistance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown skill forces a specific language/locale for core operating instructions, examples, and warnings. The policy for SQP-3 says to flag language or locale constraints when the skill does not offer user opt-in or clearly justify the locale restriction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill expands from migration orchestration into invasive post-migration OS repair, including bootloader changes, kernel replacement, network reconfiguration, password resets, and SSH policy changes. This materially increases the blast radius because a migration assistant now instructs privileged system modification steps that can weaken host security or brick systems if misapplied.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Earlier guidance states that destination hosts must be created strictly according to the provided input with no deviations or modifications. Later, the workflow instructs the agent to rename the destination ECS if its name does not match the enforced naming convention, which contradicts the earlier 'no deviation' rule when user-provided naming differs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing operational instructions exclusively in Chinese, including safety-critical migration and recovery procedures. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Tp4

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Credential Access

Credential Access

Chaining Abuse

A.1 前置条件检查

Tool Parameter Abuse

Tool Parameter Abuse

Chaining Abuse

Chaining Abuse

Credential Access

Tool Parameter Abuse

Credential Access

Undeclared Tool Scope

Natural-Language Policy Violations

Description-Behavior Mismatch

Intent-Code Divergence

Natural-Language Policy Violations

Static analysis