Security audit

hwc-cli-guidance

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Huawei Cloud CLI guidance skill, but users should handle cloud credentials and state-changing command examples carefully.

Install only if you intend to manage Huawei Cloud resources with KooCLI. Treat AK/SK values and credentials.csv as secrets, use least-privilege IAM permissions, prefer CI secret stores or temporary credentials where possible, verify the CLI download source, and double-check profile, region, resource IDs, and production impact before running stop, restart, delete, or deployment commands.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 73% confidence
Finding: The CI/CD examples perform real configuration and deployment actions with cloud credentials and start servers without emphasizing secret handling, least privilege, or operational impact. In automation contexts, readers may copy these examples directly into production pipelines, increasing the chance of credential exposure, unintended resource changes, or unsafe rollout behavior.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide instructs users to generate, download, and enter long-lived cloud access keys, but provides no warning that these credentials are highly sensitive or guidance on secure storage and rotation. In an installation guide, this omission can lead users to mishandle secrets, keep them in unsafe locations, or expose them in shell history, screenshots, or shared files.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill includes operational examples that create, delete, stop, restart, and invoke cloud resources, but it does not warn users about data loss, downtime, cost impact, or the need for confirmation before destructive actions. In a CLI guidance skill, this omission increases the chance that users copy and run impactful commands without understanding consequences.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide tells users to obtain and enter Access Key ID and Secret Access Key but does not warn that these are sensitive credentials that must not be hardcoded, logged, shared, or committed to source control. Because this skill is aimed at automation and CI/CD use, the missing guidance materially increases the risk of credential exposure and account compromise.

Static analysis

No suspicious patterns detected.