T09 · Insecure Skill Coding Practices
Warning
- Location
references/pricing-api.md:263- Finding
Unnecessary Requirement for Huawei Cloud Access Credentials in an Offline Pricing Workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
Huaweicloud
Security checks for vulnerabilities and agentic risk
Overview
This Huawei Cloud skill is mostly coherent, but it asks users to expose cloud credentials and shows risky Terraform secret-handling guidance more broadly than its offline workflow needs.
Review before installing. Use the skill for planning and template generation, but do not export real Huawei Cloud AK/SK credentials for the bundled offline cost script. If you use the Terraform examples, use least-privilege credentials, avoid committing tfvars or state files with secrets, verify Terraform downloads, and run terraform plan before any apply.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/terraform-providers.md:483- Finding
Plaintext Database Password Recommended in Terraform Variable File
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/terraform-providers.md:27- Finding
Terraform Binary Installed into a Privileged Path Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明覆盖了多个能力：云架构设计、资源配置推荐、成本预估、Terraform 模板生成。但提供的代码仅实现了其中一部分——成本估算。它没有执行架构分析、没有根据业务需求推荐服务配置、也没有生成任何 Terraform 模板。虽然“成本预估”与声明的一部分一致，但整体描述显著高于代码实际能力，属于描述与实际行为不匹配。代码也未使用声明外的敏感权限；环境变量中的 AK/SK 仅在注释中提及，代码本身未实际调用云 API。
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md variable "public_key_path" { type = string default = "~/.ssh/id_rsa.pub" description = "SSH 公钥路径" }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md variable "public_key_path" { type = string default = "~/.ssh/id_rsa.pub" description = "SSH 公钥路径" }
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README presents the skill name, description, and usage example exclusively in Chinese. This can constitute a language/locale policy violation because the skill appears to force a specific language without stating that users may choose another language or that the restriction is intentional.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to read reference files and generate Terraform output files, which implies file read/write capability, but it does not declare any tool scope or allowed-tools boundary. Missing explicit scoping weakens least-privilege controls and can let the runtime grant broader filesystem access than the skill actually needs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description and main skill content are written entirely in Chinese and present the skill's interaction model in that language, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents its heading entirely in Chinese ("计算资源模板"), which indicates a fixed language choice in the skill content. The policy requires either user opt-in for a specific language/locale or a clear documented justification for the locale constraint, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The markdown content and comments are written entirely in Chinese, including the title and explanatory notes, with no indication that the skill is region-specific or that another language option is available. This can violate a language/locale policy when users are not given an opt-in or documented justification for the enforced locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The heading
# vpc.tf - 网络配置模板presents the skill as a Chinese-language template, while the file provides no indication that language selection is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例：
bash curl -X POST "https://bss.myhuaweicloud.com/v2/products/prices" \ -H "X-Auth-Token: ${TOKEN}" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document explicitly tells users to place cloud credentials in environment variables without any accompanying guidance on secure handling, scoping, rotation, or avoiding shell history/log exposure. In a skill that may be followed operationally by users or agents, this can normalize unsafe secret-handling practices and increase the chance of credential leakage through terminals, CI logs, screenshots, or shared sessions.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux
wget https://releases.hashicorp.com/terraform/1.6.0/terraform_1.6.0_linux_amd64.zip unzip terraform_1.6.0_linux_amd64.zip sudo mv terraform /usr/local/bin/
text ### 验证安装
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
初始化项目
bash mkdir my-hwc-project cd my-hwc-project terraform init
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide shows setting cloud credentials via shell commands and storing them in a local config file, then later recommends verbose debug logging, but it does not warn that secrets may be captured in shell history, world-readable files, CI logs, or provider debug output. In a cloud provisioning skill, this can directly expose AK/SK credentials that allow unauthorized access to Huawei Cloud resources.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Policy violations include language or locale constraints imposed without user opt-in. The title, usage notes, environment variable descriptions, and later CLI help strings are all presented only in Chinese, with no option for another language or indication that the tool is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The heading uses Chinese text ("数据库资源模板") with no indication that language choice is optional or that the file is intended only for a Chinese-speaking or region-specific audience. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown-scoped file presents headings, descriptions, and summary text in Chinese alongside English identifiers, effectively imposing a locale on users without any opt-in or explanation. The policy requires flagging language or locale constraints when no user choice or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This file contains natural-language text in Chinese in the title, which signals a fixed language choice. The file does not indicate that language selection is optional or that the Chinese-only wording is required for a region-specific purpose, so it may violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This file's natural-language content is entirely in Chinese, including the title and all variable descriptions, with no indication that the skill is region-specific by design or that users can opt into another language. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file presents all guidance in Chinese and does not indicate that users may request another language or locale. The policy requires flagging language or locale constraints when they are imposed without user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents all user-facing content exclusively in Chinese, and it does not indicate that the language is optional or tailored to a region-specific audience. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
A language or locale policy violation applies to all file types when a skill forces a specific language without user opt-in. This file presents all instructions exclusively in Chinese and does not offer an alternative language or explain a justified region-specific language constraint.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This is a code file, so sensitive credential access and related operations should have some form of user disclosure. The docstring names HWC_ACCESS_KEY and HWC_SECRET_KEY, but the script provides no warning or explanation about secret sensitivity, despite presenting these variables as part of normal use.
- Content