Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
huawei-cloud-waf-aad-rule-management
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for Huawei Cloud WAF/AAD administration, but its helper script can persistently alter the local command environment in a way that is broader than the cloud-management purpose.
Review this skill before installing in an environment with production Huawei Cloud credentials. Use least-privilege read-only credentials unless you intentionally need WAF rule changes, require confirmation before any create/delete action, consider disabling quality reporting with SKILL_QUALITY_REPORT=0, and inspect or remove the PATH symlink behavior in scripts/ensure_cli.sh if you do not want the skill to alter command lookup across shells.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (25)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims guarded WAF/AAD management behavior, but the file mainly provides prose and bootstraps a separate helper script that may modify PATH and affect the local environment. This mismatch is dangerous because operators may trust documented confirmation and safety controls that are not actually enforced by the skill content, leading to unintended command execution paths or unreviewed environment changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest declares broad triggers such as "防火墙", "blacklist", "whitelist", and "rate limiting" without narrowing them to Huawei Cloud WAF/AAD usage. In a markdown/manifest file, these generic terms can match many unrelated conversations and increase the chance of unintended skill invocation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The skill authorizes automatic execution of read-only cloud queries and diagnostics. Even if nominally read-only, auto-execution against authenticated cloud accounts can disclose infrastructure inventory, protection status, and security-policy details without an explicit per-action user confirmation, which is sensitive in a security-management context.
- Content
md **Scope boundaries:** - ✅ Query (R3, read-only, auto-execute): WAF instances, protected domain names (composite hosts), policies, custom rules, IP black/white-list rules, CC rules, geo rules; AAD instances & packages. - ✅ Diagnose (R3, read-only, auto-execute): CNAME onboarding status, rule-order & false-positive risk, AAD EIP protection coverage.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The documented workflow normalizes autonomous diagnostics on WAF and AAD state, including rule-order and exposure analysis. In a cloud-security skill, that context increases sensitivity because automated reconnaissance of protections and public exposure can reveal valuable information about defensive controls even without making changes.
- Content
md - ✅ Query (R3, read-only, auto-execute): WAF instances, protected domain names (composite hosts), policies, custom rules, IP black/white-list rules, CC rules, geo rules; AAD instances & packages. - ✅ Diagnose (R3, read-only, auto-execute): CNAME onboarding status, rule-order & false-positive risk, AAD EIP protection coverage. - ✅ Manage (R2, preview + confirm): create WAF custom / IP blacklist / CC / geo rules. - ✅ Manage (R1, preview + explicit confirm): delete WAF rules (custom / white-black / CC / geo).
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Maps the 17 `huawei_*` actions from GitCode issue #474 to acceptance checks. ## Query actions (R3 — read-only, auto-execute) | # | Action | Acceptance check | |---|--------|------------------|
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Maps the 17 `huawei_*` actions from GitCode issue #474 to acceptance checks. ## Query actions (R3 — read-only, auto-execute) | # | Action | Acceptance check | |---|--------|------------------|
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Maps the 17 `huawei_*` actions from GitCode issue #474 to acceptance checks. ## Query actions (R3 — read-only, auto-execute) | # | Action | Acceptance check | |---|--------|------------------|
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Maps the 17 `huawei_*` actions from GitCode issue #474 to acceptance checks. ## Query actions (R3 — read-only, auto-execute) | # | Action | Acceptance check | |---|--------|------------------|
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Description 1. **R3 path (auto)**: read-only `hcloud WAF` / `hcloud AAD` commands run without confirmation. Diagnostics combine list/show outputs with external facts (DNS CNAME records, package type semantics) to produce warnings. 2. **R2 path (create)**: the rule intent is compiled into the exact `BatchCreate*` command,
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This helper script alters the caller's PATH and attempts to create a symlink named skill-quality-cli in the first writable directory found in PATH, which is persistence-like behavior unrelated to the stated WAF/AAD management function. Because the target binary location is user-controlled via SKILL_QUALITY_CLI_DIR and the symlink destination is chosen dynamically from writable PATH entries, a user or surrounding environment could cause an arbitrary executable to be exposed as a trusted command, increasing the risk of command hijacking or unintended execution in later shells.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The description says to use the skill when the user needs to inspect or change WAF protection and then provides a wide set of triggers, but it does not clearly state when generic security or firewall requests should not use this skill. For manifest/markdown trigger quality, missing exclusion conditions can make routing ambiguous.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 70% confidence
- Finding
Overly Broad Trigger: '限速' is too short and may match unintended inputs
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 70% confidence
- Finding
Overly Broad Trigger: '误报' is too short and may match unintended inputs
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Line L23 mixes English with Chinese text ('网段') in the skill's natural-language acceptance criteria. The file does not indicate that the skill is region- or language-specific, nor does it offer user opt-in or a language choice, which can violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The verification guidance hard-codes the package interpretation as "Standard = single IP, Enterprise = 网段", introducing Chinese-language output/content in an otherwise English document without offering a language choice or explaining a locale requirement. This is a natural-language locale policy issue because it implicitly forces one language variant for part of the user-facing guidance.
- Content
Static analysis
No suspicious patterns detected.