huawei-cloud-waf-policy-query

• Outcome: Review
• Latest audit: Sep 21, 2026 · 6:37 AM UTC
• Version: 1.0.0

Overview

This skill is a WAF policy viewer, but it needs review because it defaults to saving detailed security configuration locally and changes CLI configuration despite being framed as read-only.

Install only if you are comfortable with an agent querying detailed Huawei Cloud WAF configuration and potentially saving raw policy details, IP groups, value lists, hostnames, and project metadata to local JSON files. Before use, require explicit consent for any export and avoid running the CLI language configuration change unless you actually want that persistent hcloud setting changed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

- `hosts` — Bound domains
- `rules_count` — Number of rules per category

**Display Rules**:
- If the number of returned policies is <= 5: display all
- If the number of returned policies is > 5: display only the first 5 and inform the user of the total count

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md

- `hosts` — Bound domains
- `rules_count` — Number of rules per category

**Display Rules**:
- If the number of returned policies is <= 5: display all
- If the number of returned policies is > 5: display only the first 5 and inform the user of the total count

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.

1. Rule "xxx": When a visitor triggers WAF blocking rules times within seconds, block all requests from that visitor for seconds. Currently <enabled/disabled>.
2. ...

Note: Only display rule details for enabled modules; disabled modules do not need to be shown. Rule explanations for each module must be described in plain language so that users can understand the rule's actual protection effect without needing to read API field names.

text

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section makes local JSON export mandatory after policy-detail queries unless the user explicitly opts out, which is inconsistent with the skill's read-only positioning and creates an unnecessary data exfiltration/persistence path. Because the saved report includes raw rule JSON and referenced value lists/IP groups, it may store highly sensitive security configuration and network allow/block data on the endpoint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims only read-only operations are supported, but later instructions require the Write tool to save results locally. This mismatch can mislead users and higher-level policy systems into approving the skill under a lower-risk classification while it still performs filesystem writes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prerequisite block includes hcloud configure set --cli-lang=cn, which changes the user's CLI configuration without opt-in. Even if framed as setup, this is a persistent configuration write that alters the environment and may disrupt automation, operator expectations, or downstream parsing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as read-only/query-only, but it instructs the agent to persist full policy JSON to local storage. That creates a side effect outside the cloud control plane and can expose sensitive infrastructure metadata such as hostnames, policy structure, rule contents, and protection posture on disk without a clear necessity or explicit opt-in.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 458)May include surrounding context.

md

The following constraints are mandatory rules and must not be violated under any circumstances:

1. **Read-Only**: All operations in this SKILL are read-only. Creating (Create), updating (Update), or deleting (Delete) any cloud resources is strictly prohibited. Commands such as `Create*`, `Update*`, `Delete*` and other write operations must not be invoked.
2. **No Credential Leakage**: Exposing any hcloud configuration information in output is strictly prohibited, including but not limited to AK/SK, SecretKey, Project ID, Region configuration, Profile information, credential content returned by `hcloud configure`, etc.
3. **No Write Operation Guidance**: Proactively suggesting, mentioning, or guiding the user toward create, modify, or delete operations in the conversation is strictly prohibited. After completing the query, end the interaction directly; do not follow up with "Would you like to perform further operations?"

## Reference Documentation

Static analysis

No suspicious patterns detected.