Huaweicloud

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:34 PM UTC
• Version: 0.1.1

Overview

This Huawei Cloud skill is mostly coherent, but it asks users to expose cloud credentials and shows risky Terraform secret-handling guidance more broadly than its offline workflow needs.

Review before installing. Use the skill for planning and template generation, but do not export real Huawei Cloud AK/SK credentials for the bundled offline cost script. If you use the Terraform examples, use least-privilege credentials, avoid committing tfvars or state files with secrets, verify Terraform downloads, and run terraform plan before any apply.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/pricing-api.md:263
• Finding: Unnecessary Requirement for Huawei Cloud Access Credentials in an Offline Pricing Workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:97-98`; `references/pricing-api.md:263-268`; related implementation at `scripts/hwc-pricing.py:225-259` **Vulnerability Type**: Unnecessary credential exposure and violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```bash export HWC_ACCESS_KEY="your-ak" export HWC_SECRET_KEY="your-sk" ``` The Skill documentation states that these credentials are prerequisites for cost estimation. However, the pricing implementation only reads a local JSON file, uses the embedded `PRICE_TABLE`, and writes or prints a Markdown report: ```python with open(args.input, "r", encoding="utf-8") as f: resources = json.load(f) resources["billing_mode"] = args.billing result = calculate_cost(resources) md_content = format_markdown(result) if args.output: with open(args.output, "w", encoding="utf-8") as f: f.write(md_content) else: print(md_content) ``` ### Technical Analysis The pricing script does not read `HWC_ACCESS_KEY` or `HWC_SECRET_KEY` and does not make any network request. Requiring users to place active cloud credentials in the environment therefore exceeds the minimum privileges necessary for the declared offline pricing functionality. Environment variables may be inherited by child processes or exposed through debugging output, crash diagnostics, CI/CD configuration, shell initialization files, or other processes operating in the same execution environment. The project does not itself exfiltrate these credentials, but its documentation unnecessarily increases the available credential exposure surface. ### Attack Path 1. A user follows the documented prerequisite and exports an active Huawei Cloud AK/SK pair. 2. The credentials remain available in the shell and are inherited by subsequently launched processes. 3. A compromised local dependency, CI task, debugging tool, or process with access to that environment obtains the credentials. 4. The credentials are used ...[truncated 642 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the AK/SK prerequisite from `SKILL.md` and the offline pricing-script instructions. 2. Clearly state that `scripts/hwc-pricing.py` operates exclusively from an embedded static price table. 3. If live pricing is implemented later, separate it into an explicit opt-in mode. 4. Use the official Huawei Cloud credential provider chain rather than custom credential handling. 5. Require a narrowly scoped, read-only pricing or billing identity for live queries. 6. Avoid printing credentials or including them in command-line arguments. 7. Document credential rotation, CI secret masking, and environment cleanup procedures. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/terraform-providers.md:483
• Finding: Plaintext Database Password Recommended in Terraform Variable File<![CDATA[ ## Vulnerability Details **File Location**: `references/terraform-providers.md:483-493` **Vulnerability Type**: Plaintext secret storage guidance **Risk Level**: Medium ### Vulnerable Code ```hcl variable "db_password" { type = string sensitive = true description = "Database password" } region = "cn-north-4" vpc_cidr = "10.0.0.0/16" db_password = "your-secure-password" ``` ### Technical Analysis The guide recommends supplying a database password through a plaintext `terraform.tfvars` file. Marking a Terraform variable as `sensitive` suppresses ordinary CLI display, but it does not encrypt the value in variable files or Terraform state. A populated `terraform.tfvars` file may be committed to source control, included in backups, copied into CI artifacts, or left readable by other local users. Database passwords passed to managed-resource fields may also be retained in Terraform state, depending on provider behavior. The guidance does not include file-permission restrictions, source-control exclusions, encrypted state requirements, or secret-manager integration. ### Attack Path 1. A user replaces the placeholder with a production database password. 2. The populated `terraform.tfvars` file or generated Terraform state remains stored in plaintext. 3. The file is committed to a repository, uploaded as a CI artifact, copied into a backup, or read by another local account. 4. An attacker recovers the database password. 5. The attacker connects from an allowed network location or uses an existing foothold in the VPC to authenticate to the database. ### Impact Assessment Successful exploitation can grant the database privileges assigned to the configured account. The template's connection summary identifies the MySQL user as `root`, so reuse of a privileged database account could expose the entire database, including the ability to read, modify, or delete application data. Network security groups restrict direct external datab ...[truncated 156 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not recommend storing production passwords directly in committed `.tfvars` files. 2. Add `*.tfvars`, `*.tfstate`, `*.tfstate.*`, crash logs, and plan files containing secrets to `.gitignore`. 3. Retrieve secrets from a supported secret manager or inject them through protected CI secret variables. 4. Protect local secret files with restrictive permissions such as mode `0600`. 5. Use an encrypted, access-controlled remote backend for Terraform state. 6. Restrict access to state storage through least-privilege IAM policies and enable audit logging. 7. Use a dedicated database administrator identity only for provisioning, then rotate the password and provision lower-privilege application accounts. 8. Document that Terraform's `sensitive = true` is display redaction, not encryption. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/terraform-providers.md:27
• Finding: Terraform Binary Installed into a Privileged Path Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/terraform-providers.md:27-29` **Vulnerability Type**: Unverified third-party binary installation **Risk Level**: Medium ### Vulnerable Code ```bash wget https://releases.hashicorp.com/terraform/1.6.0/terraform_1.6.0_linux_amd64.zip unzip terraform_1.6.0_linux_amd64.zip sudo mv terraform /usr/local/bin/ ``` ### Technical Analysis The installation instructions download a precompiled executable and move it into `/usr/local/bin` using elevated privileges without verifying its SHA-256 checksum or HashiCorp signature. HTTPS protects the transport under normal conditions, and the documented domain is the official HashiCorp release host. However, HTTPS alone does not verify that the downloaded artifact matches the publisher's expected release. A compromised upstream artifact, trusted proxy, certificate authority, local download destination, or preexisting archive could result in an attacker-controlled executable being installed as the system-wide `terraform` command. Because `/usr/local/bin` commonly appears early in `PATH`, replacing this binary can affect users and automation beyond the current Skill execution. ### Attack Path 1. An attacker substitutes or modifies the downloaded ZIP archive before installation. 2. The user extracts the archive without verifying a publisher-provided checksum or signature. 3. The user runs `sudo mv`, installing the attacker-controlled binary as `/usr/local/bin/terraform`. 4. A user or automation process subsequently invokes `terraform`. 5. The malicious binary executes with that caller's privileges and can access Terraform configuration, state files, environment credentials, provider credentials, and cloud deployment inputs. ### Impact Assessment A malicious Terraform binary would execute with the privileges of each user or automation account that invokes it. It could steal cloud credentials and Terraform state, alter infrastructure plans, deploy unauthorized ...[truncated 265 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Download the official release checksum file and its publisher signature. 2. Verify the signature using HashiCorp's documented signing key. 3. Verify the archive with `sha256sum --check` before extraction or installation. 4. Abort installation immediately if signature or checksum validation fails. 5. Prefer an operating-system package repository or trusted package manager that performs signature verification. 6. Download into a newly created, permission-restricted temporary directory. 7. Use `sudo install` with explicit ownership and mode only after successful verification. 8. Pin the expected Terraform version and periodically review whether it remains supported. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明覆盖了多个能力：云架构设计、资源配置推荐、成本预估、Terraform 模板生成。但提供的代码仅实现了其中一部分——成本估算。它没有执行架构分析、没有根据业务需求推荐服务配置、也没有生成任何 Terraform 模板。虽然“成本预估”与声明的一部分一致，但整体描述显著高于代码实际能力，属于描述与实际行为不匹配。代码也未使用声明外的敏感权限；环境变量中的 AK/SK 仅在注释中提及，代码本身未实际调用云 API。

Credential Access

High

• Category: Privilege Escalation

Content

variable "public_key_path" {
  type        = string
  default     = "~/.ssh/id_rsa.pub"
  description = "SSH 公钥路径"
}

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

variable "public_key_path" {
  type        = string
  default     = "~/.ssh/id_rsa.pub"
  description = "SSH 公钥路径"
}

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README presents the skill name, description, and usage example exclusively in Chinese. This can constitute a language/locale policy violation because the skill appears to force a specific language without stating that users may choose another language or that the restriction is intentional.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to read reference files and generate Terraform output files, which implies file read/write capability, but it does not declare any tool scope or allowed-tools boundary. Missing explicit scoping weakens least-privilege controls and can let the runtime grant broader filesystem access than the skill actually needs.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The manifest description and main skill content are written entirely in Chinese and present the skill's interaction model in that language, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file presents its heading entirely in Chinese ("计算资源模板"), which indicates a fixed language choice in the skill content. The policy requires either user opt-in for a specific language/locale or a clear documented justification for the locale constraint, neither of which appears here.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The markdown content and comments are written entirely in Chinese, including the title and explanatory notes, with no indication that the skill is region-specific or that another language option is available. This can violate a language/locale policy when users are not given an opt-in or documented justification for the enforced locale.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The heading `# vpc.tf - 网络配置模板` presents the skill as a Chinese-language template, while the file provides no indication that language selection is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

External Transmission

Medium

• Category: Data Exfiltration

Content

**请求示例：**

```bash
curl -X POST "https://bss.myhuaweicloud.com/v2/products/prices" \
  -H "X-Auth-Token: ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document explicitly tells users to place cloud credentials in environment variables without any accompanying guidance on secure handling, scoping, rotation, or avoiding shell history/log exposure. In a skill that may be followed operationally by users or agents, this can normalize unsafe secret-handling practices and increase the chance of credential leakage through terminals, CI logs, screenshots, or shared sessions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Linux
wget https://releases.hashicorp.com/terraform/1.6.0/terraform_1.6.0_linux_amd64.zip
unzip terraform_1.6.0_linux_amd64.zip
sudo mv terraform /usr/local/bin/
```

### 验证安装

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 初始化项目

```bash
mkdir my-hwc-project
cd my-hwc-project
terraform init
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide shows setting cloud credentials via shell commands and storing them in a local config file, then later recommends verbose debug logging, but it does not warn that secrets may be captured in shell history, world-readable files, CI logs, or provider debug output. In a cloud provisioning skill, this can directly expose AK/SK credentials that allow unauthorized access to Huawei Cloud resources.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: Policy violations include language or locale constraints imposed without user opt-in. The title, usage notes, environment variable descriptions, and later CLI help strings are all presented only in Chinese, with no option for another language or indication that the tool is intentionally region-specific.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The heading uses Chinese text ("数据库资源模板") with no indication that language choice is optional or that the file is intended only for a Chinese-speaking or region-specific audience. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown-scoped file presents headings, descriptions, and summary text in Chinese alongside English identifiers, effectively imposing a locale on users without any opt-in or explanation. The policy requires flagging language or locale constraints when no user choice or justification is provided.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: This file contains natural-language text in Chinese in the title, which signals a fixed language choice. The file does not indicate that language selection is optional or that the Chinese-only wording is required for a region-specific purpose, so it may violate language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This file's natural-language content is entirely in Chinese, including the title and all variable descriptions, with no indication that the skill is region-specific by design or that users can opt into another language. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown file presents all guidance in Chinese and does not indicate that users may request another language or locale. The policy requires flagging language or locale constraints when they are imposed without user opt-in or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This markdown file presents all user-facing content exclusively in Chinese, and it does not indicate that the language is optional or tailored to a region-specific audience. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: A language or locale policy violation applies to all file types when a skill forces a specific language without user opt-in. This file presents all instructions exclusively in Chinese and does not offer an alternative language or explain a justified region-specific language constraint.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This is a code file, so sensitive credential access and related operations should have some form of user disclosure. The docstring names HWC_ACCESS_KEY and HWC_SECRET_KEY, but the script provides no warning or explanation about secret sensitivity, despite presenting these variables as part of normal use.