Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
huawei-cloud-ucs-policy-governor
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed Huawei Cloud UCS policy-governance guide, but it also includes under-scoped cluster credential generation and live cluster mutation steps inside audit workflows.
Review this skill carefully before installing. It is suitable only for users who intend to administer Huawei Cloud UCS policies, not for read-only compliance review. Use least-privilege IAM, prefer temporary credentials, avoid storing kubeconfig or AK/SK files unless necessary, and require explicit human confirmation before any create, update, delete, enable, disable, registration, or kubectl apply command.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The command generates cluster access credentials and writes them to a local kubeconfig file. Credential material for managed clusters is highly sensitive; persisting it in a general audit workflow materially increases exposure risk through logs, shell history, filesystem access, or downstream agent handling.
- Content
md hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4 hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4 # 2. Access the cluster with kubeconfig hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml # 3. Fix violations using kubectl
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section instructs users to create a kubeconfig file and then use it to apply manifests directly to a cluster. That introduces credential access plus live cluster mutation in a document framed as compliance auditing, creating a high-risk path for credential exposure, unauthorized changes, and misuse by an agent or operator expecting non-invasive audit behavior.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Referencing kubeconfig in the command sequence normalizes use of sensitive cluster credentials in an audit path and can cause operators or agents to handle secrets more broadly than necessary. This is especially risky because the file’s stated purpose does not justify privileged credential acquisition or use.
- Content
md hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4 # 2. Access the cluster with kubeconfig hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml # 3. Fix violations using kubectl kubectl --kubeconfig=cluster-kubeconfig.yaml apply -f <fix-manifest>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Referencing kubeconfig in the command sequence normalizes use of sensitive cluster credentials in an audit path and can cause operators or agents to handle secrets more broadly than necessary. This is especially risky because the file’s stated purpose does not justify privileged credential acquisition or use.
- Content
md hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4 # 2. Access the cluster with kubeconfig hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml # 3. Fix violations using kubectl kubectl --kubeconfig=cluster-kubeconfig.yaml apply -f <fix-manifest>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Using kubectl with the generated kubeconfig applies manifests directly to the cluster, meaning the retrieved credentials are not merely viewed but actively used for privileged changes. This turns a credential exposure issue into an operational compromise risk: anyone following or automating the workflow can modify workloads and cluster resources.
- Content
md hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml # 3. Fix violations using kubectl kubectl --kubeconfig=cluster-kubeconfig.yaml apply -f <fix-manifest> # 4. Re-trigger enforcement hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide recommends exporting long-lived cloud credentials as environment variables for CI/CD without warning that they can be exposed through shell history, process inspection, debug output, or CI job logs. In the context of a cloud policy governance skill, compromise of these credentials could let an attacker query or modify UCS policy state and potentially affect compliance enforcement across clusters or fleet groups.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation tells users they may store access and secret keys directly in ~/.hcloud/config.json but does not instruct them to protect the file with restrictive permissions or avoid plaintext secrets at rest. On multi-user systems, developer workstations, or compromised hosts, plaintext cloud credentials in an unprotected config file can be harvested and then used to access UCS governance APIs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document includes a live
DeletePolicyInstancecommand as part of remediation steps without any warning that it is destructive, irreversible for the targeted policy instance, or should only be run after explicit confirmation of the resource identity. In an agent skill context, examples are often reused verbatim, so this increases the chance that an operator or downstream agent executes deletion accidentally while troubleshooting scope changes.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file is supposed to cover compliance auditing, but the remediation workflow expands into credential retrieval, direct cluster modification with kubectl, and policy disable/enable operations. That scope drift is dangerous because an audit-oriented skill may be invoked in read-only contexts, yet the documented steps enable privileged state changes and remediation actions that could alter production systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The remediation workflow creates a kubeconfig file and performs cluster-changing commands without any explicit warning about credential sensitivity, persistence to disk, or operational impact. In practice, that omission increases the likelihood of accidental credential leakage, unsafe storage, and unreviewed production changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The compliance-audit task includes cluster registration for a new cluster, which is an administrative onboarding action unrelated to audit/reporting. This broadens the skill from assessment into infrastructure modification, increasing the chance that an audit request could trigger unintended enrollment or management changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest limits this skill to policy instances, policy definitions, enabling/disabling policies, job status, and compliance auditing. At L171, the workflow invokes
hcloud UCS RegisterClusterGroupto create a fleet group, which is a separate cluster-group management capability not justified by the declared purpose of policy governance itself.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guide instructs users to place long-lived Huawei Cloud access keys directly into shell environment variables without any warning about shell history, process inheritance, CI/CD exposure, or multi-user host leakage. In a cloud administration skill, these credentials can grant broad control over UCS resources, so normalizing this handling increases the risk of credential disclosure and downstream account compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The create policy instance example uses enforcement modes like
denybut does not clearly warn that applying or later enabling such policies can immediately alter Kubernetes admission behavior and block workloads or deployments. In a UCS governance skill, users are likely to run these commands against production clusters, so omission of operational risk guidance can cause self-inflicted outages or service disruption.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The update operation allows changing
enforcementActionand parameters but does not warn that tightening an existing policy can take effect immediately and disrupt active deployment pipelines or cluster operations. Because this skill is specifically for policy governance, users may assume updates are low-risk administrative changes when they can in fact cause abrupt enforcement failures.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The verification instructions include operationally impactful actions such as enabling, disabling, and changing enforcement behavior for cluster and fleet-group policies, but they do not prominently warn that these steps can disrupt governance posture or workload behavior in real environments. In a policy-governance skill, operators may treat verification steps as safe smoke tests, so undocumented enforcement changes increase the risk of accidental service impact or weakened compliance controls.
- Content
Static analysis
No suspicious patterns detected.