T03 · Remote Payload Retrieval and Execution
Error
- Location
skill.md:41- Finding
Unverified Mutable Executable Download and Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
hwc-cli-guidance
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only Huawei Cloud CLI skill, but it gives under-scoped guidance for installing tools, handling cloud credentials, and running live infrastructure-changing commands.
Review this skill carefully before installing. Use pinned, verified KooCLI versions; avoid sudo/system-wide installation unless needed; do not paste long-lived AK/SK secrets into command lines or logs; use least-privilege cloud credentials; and do not reuse the Python shell=True examples with dynamic input.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T08 · Insecure Dependencies
Warning
- Location
skill.md:34- Finding
Unpinned Python Dependencies from Mutable Package Registries
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:229- Finding
Shell Command Injection Through Interpolated Upload Parameters
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:272- Finding
Generic Command Helper Executes Caller-Controlled Strings Through a Shell
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
reference/best-practices.md:251- Finding
Huawei Cloud Access Keys Exposed in Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
subprocess.run(cmd, shell=True) executes the provided string through the system shell, so any untrusted content in cmd can inject additional commands. In a reusable helper shown as best practice, this strongly increases the chance that downstream users will introduce command injection into automation handling cloud credentials and infrastructure.
- Content
md def safe_command(cmd): try: result = subprocess.run(cmd, shell=True, capture_output=True, text=True) if result.returncode != 0: print(f"Error: {result.stderr}") return None
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The command string interpolates bucket, filename, and path values directly into a shell command and then executes it with shell=True. If any of these values contain shell metacharacters, an attacker could run arbitrary commands, which is especially dangerous in batch automation touching cloud storage.
- Content
batch = files[i:i+BATCH_SIZE] for file in batch: cmd = f"hcloud obs upload-object --bucket={bucket} --key={file} --file={local_dir}/{file}" subprocess.run(cmd, shell=True) print(f"Uploaded batch {i//BATCH_SIZE + 1}")
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The retry helper also uses shell=True on an arbitrary command string, reproducing the same command-injection primitive inside logic that may be reused widely. Because it is framed as resilient infrastructure code, users may adopt it without recognizing that it executes shell syntax from untrusted inputs.
- Content
md def request_with_retry(cmd, max_retries=3): for attempt in range(max_retries): result = subprocess.run(cmd, shell=True, capture_output=True, text=True) if result.returncode != 429: return result
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # Linux/macOS sudo rm /usr/local/bin/hcloud # Windows Remove-Item -Path "huaweicloud-cli-windows-amd64" -Recurse -Force
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The Python example builds a shell command with untrusted values derived from bucket, local_dir, and especially filenames from os.listdir(), then executes it with shell=True. A crafted filename containing shell metacharacters could trigger command injection and arbitrary code execution on the machine running the script.
- Content
batch = files[i:i+BATCH_SIZE] for file in batch: cmd = f"hcloud obs upload-object --bucket={bucket} --key={file} --file={local_dir}/{file}" subprocess.run(cmd, shell=True) print(f"Uploaded batch {i//BATCH_SIZE + 1}")
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The generic helper safe_command(cmd) executes arbitrary command strings with shell=True, which normalizes an unsafe pattern and invites callers to pass untrusted input. In an automation skill for cloud administration, this can lead to local command execution and compromise of credentials or infrastructure-management environments.
- Content
md def safe_command(cmd): try: result = subprocess.run(cmd, shell=True, capture_output=True, text=True) if result.returncode != 0: print(f"Error: {result.stderr}") return None
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document advises against hardcoding AK/SK, but later examples pass secrets on the command line, which can expose them through process listings, shell history, CI logs, and audit output. This inconsistency can train users into unsafe secret-handling practices.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The function is explicitly named and presented as a safe pattern, yet it executes arbitrary command strings with shell=True. In documentation, this is dangerous because readers are likely to reuse it with untrusted input, creating command-injection risk while believing the pattern is secure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file includes examples that start cloud servers in bulk, which can affect system state and incur cost, but the surrounding documentation does not explicitly warn users about operational impact or recommend validating targets before execution. Under the markdown-file criteria, behaviours affecting user systems or resources should be accompanied by a clear warning.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The GitHub Actions and Jenkins examples inject cloud access keys and run deployment commands against Huawei Cloud, but the markdown does not include an explicit warning about protecting secrets, avoiding log exposure, and verifying that commands target the correct environment. For markdown guidance that affects privacy, credentials, or system integrity, an explicit user-facing warning is expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown reference lists commands that start, stop, reboot, restart, create, upload, download, delete, and invoke resources, but it does not include warnings about potential service disruption, data modification, or irreversible effects. Because the file is a markdown command reference, SQP-2 applies and user-facing safety disclosures are expected for operations that can affect system integrity or user data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide instructs users to obtain, download, and later enter cloud Access Key and Secret Access Key material, but it does not warn that these are highly sensitive secrets or provide handling guidance. In a cloud CLI context, exposed AK/SK credentials can enable unauthorized access to cloud resources, data exposure, or destructive actions across the account.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzvf huaweicloud-cli-linux-amd64.tar.gz # 移动到系统路径 sudo mv huaweicloud-cli-linux-amd64 /usr/local/bin/hcloud # 添加执行权限 sudo chmod +x /usr/local/bin/hcloud
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzvf huaweicloud-cli-linux-amd64.tar.gz # 移动到系统路径 sudo mv huaweicloud-cli-linux-amd64 /usr/local/bin/hcloud # 添加执行权限 sudo chmod +x /usr/local/bin/hcloud
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzvf huaweicloud-cli-linux-amd64.tar.gz # 移动到系统路径 sudo mv huaweicloud-cli-linux-amd64 /usr/local/bin/hcloud # 添加执行权限 sudo chmod +x /usr/local/bin/hcloud
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzvf huaweicloud-cli-linux-amd64.tar.gz # 移动到系统路径 sudo mv huaweicloud-cli-linux-amd64 /usr/local/bin/hcloud # 添加执行权限 sudo chmod +x /usr/local/bin/hcloud
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzvf huaweicloud-cli-linux-amd64.tar.gz # 移动到系统路径 sudo mv huaweicloud-cli-linux-amd64 /usr/local/bin/hcloud # 添加执行权限 sudo chmod +x /usr/local/bin/hcloud
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md tar -xzvf huaweicloud-cli-linux-amd64.tar.gz # 移动到系统路径 sudo mv huaweicloud-cli-linux-amd64 /usr/local/bin/hcloud # 添加执行权限 sudo chmod +x /usr/local/bin/hcloud
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guide instructs users to create and enter long-lived Access Key ID and Secret Access Key credentials but provides no warning about secure storage, least privilege, rotation, or avoiding exposure in logs, shells, and shared environments. In a cloud-management skill, this omission increases the chance of credential leakage and subsequent unauthorized access to Huawei Cloud resources.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash curl -LO https://dl.koo.cloud/cli/latest/huaweicloud-cli-linux-amd64.tar.gz tar -xzvf huaweicloud-cli-linux-amd64.tar.gz sudo mv huaweicloud-cli-linux-amd64 /usr/local/bin/hcloud方法三：使用 PowerShell 安装（Windows）
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash curl -LO https://dl.koo.cloud/cli/latest/huaweicloud-cli-linux-amd64.tar.gz tar -xzvf huaweicloud-cli-linux-amd64.tar.gz sudo mv huaweicloud-cli-linux-amd64 /usr/local/bin/hcloud方法三：使用 PowerShell 安装（Windows）
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation includes destructive commands such as deleting configuration profiles and objects without warning about permanence, targeting mistakes, or recovery limitations. In a cloud CLI context, users may run these commands against the wrong profile or bucket object and cause operational disruption or data loss.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill documents commands that start, stop, reboot servers, restart databases, and invoke functions without noting service-impact, outage risk, or production-safety considerations. Because this skill is specifically about managing live cloud infrastructure, omission of impact warnings makes accidental disruption more likely.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This file forces a single language presentation throughout the skill documentation and does not offer an alternate language or note that the guide is intentionally region-specific. The policy calls for flagging language or locale constraints when they are imposed without user opt-in or clear justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The instructions tell users to move a binary into /usr/local/bin and chmod it using sudo, which performs privileged system modification, but the guide does not explain the privilege requirement or associated risk. While common for installation docs, copying commands blindly with elevated privileges can increase the impact of mistakes or tampered downloads.
- Content