Huawei Cloud ModelArts Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:00 AM UTC
• Version: 1.0.1

Overview

This is a broad Huawei ModelArts cloud-administration skill, but it can expose authentication tokens and perform destructive cloud operations despite claiming credentials stay hidden.

Install only in a Huawei Cloud project where you are comfortable giving an agent broad ModelArts administration authority. Avoid production credentials until token-returning exec/auth helpers are removed or redacted and destructive operations require narrow resource IDs plus explicit confirmation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/infer_v2_module/get_exec.py:26

Finding

Inference Exec API Discloses Cluster Authentication Tokens to Callers

Content

View full analysis

Dict[str, Any]: """查询服务exec登录信息 - v2版本 调用此接口可获取在线服务容器的 exec 登录信息（如容器 ID、登录命令等）， 用于调试或查看操作。调用者需具备足够权限，且目标容器必须处于运行状态。 参数: access: 认证信息 service_id: 服务ID，创建服务时返回，或通过"查询服务列表"接口获取 instance_group: 实例组名，创建服务时自动生成，或通过"查询服务实例组列表"接口获取 instance_name: 实例名，创建服务时填写，或通过"查询服务实例列表"接口获取 pod_name: Pod实例名，由K8S自动生成，或通过"查询服务pod列表"接口获取 返回: 包含exec登录信息的字典，包括: - endpoint: 资源池 api-server 地址 - pod_name: 待登录的容器名 - pod_status: Pod状态 - container_name: 待登录的容器名 - namespace: Pod所在的namespace - cluster_token: 集群所属租户token """ checks = [ (check_service_id(service_id), "service_id"), (check_instance_group(instance_group), "instance_group"), (check_instance_name(instance_name), "instance_name"), (check_pod_name(pod_name), "pod_name") ] for check, param in checks: if check: return format_api_result(False, error=f"{param}: {check}") print(f" 查询服务v2 exec登录信息: {service_id}") print(f" 实例组: {instance_group}, 实例名: {instance_name}, Pod: {pod_name}") query = { "instance_group": instance_group, "instance_name": instance_name, "pod_name": pod_name } if kwargs: query.update(kwargs) try: result = simple_api_call(access, 'GET', '/v2/{project_id}/services/{service_id}/exec', query=query, service_id=service_id) if not result: return format_api_result(False, error="API返回空结果") return format_api_result ...[truncated 2864 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/infer_v1_module/make_token_auth_request.py:13

Finding

Token-Related Inference API Responses Bypass Secret Redaction

Content

View full analysis

Dict[str, Any]: """ 推理服务操作 Args: service_id: 操作目标（必填） **kwargs: 其他配置参数 Returns: 操作结果 示例: >>> from infer1.0_module import make_token_auth_request >>> result = make_token_auth_request('service-xxx-xxx-xxx') >>> if result['success']: ... print("操作成功") """ if not service_id: return format_api_result(False, error="service_id is required") print(f" 操作推理服务: {service_id}") result = access.sdk().execute(lambda s: make_api_call( s, 'POST', '/v1/{project_id}/services/{service_id}', )) return format_api_result(True, data=result) ``` The header-related function follows the same unsafe pattern: ```python @authenticated_api_call def get_token_headers( access, service_id: str, **kwargs ) -> Dict[str, Any]: """ 查询推理服务 Args: service_id: 查询目标（必填） **kwargs: 其他配置参数 Returns: 查询结果 示例: >>> from infer1.0_module import get_token_headers >>> result = get_token_headers('service-xxx-xxx-xxx') >>> if result['success']: ... print("查询成功") """ if not service_id: return format_api_result(False, error="service_id is required") print(f" 查询推理服务: {service_id}") result = access.sdk().execute(lambda s: make_api_call( s, 'GET', ...[truncated 2652 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (259)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This finding captures the broader issue that the skill appears to encompass Lite Server/Dev Server helper logic and infrastructure operations far beyond the declared ModelArts-focused summary. The dangerous aspect is not merely missing implementation evidence, but the likelihood that users will underestimate the scope and privilege of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

OS reinstallation and OS switching are highly destructive administrative operations that can erase data, break workloads, and disrupt service. In the context of a purported ModelArts integration skill, these capabilities are context-inappropriate and substantially raise the risk of severe unintended changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Binding and listing public IPs enables external network exposure of compute resources, which is a materially sensitive capability not justified by the stated integration-focused purpose. If used inappropriately, it can expose internal services to the internet, expand attack surface, and bypass expected network isolation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

RoCE network creation is a powerful infrastructure capability that changes networking topology and is unrelated to a narrow ModelArts integration use case as described. Such capability can alter connectivity, require privileged cloud permissions, and introduce hard-to-audit network changes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth_manager.py (reported line 50)May include surrounding context.

python

try:
            from modelarts.session import Session
            session = Session()
            # Try to access credentials - will fail if not in notebook
            _ = session.access_key
            _ = session.secret_key
            _ = session.project_id

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function is named and documented as a parser, but it actually performs an authenticated POST to a remote ModelArts service endpoint. This kind of capability mismatch is dangerous because callers, reviewers, or higher-level agents may treat it as a harmless local transformation and invoke it in contexts where network side effects are not expected, enabling unintended remote actions under existing cloud credentials.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This tool exposes a high-impact DELETE operation over project authorizations with weak parameter constraints and no embedded authorization safety controls beyond whatever the external API enforces. In an agent skill, such a primitive can be abused through prompt-induced tool use or user error to revoke access broadly, causing denial of service or operational lockout.

Content

Scanner excerpt · scripts/management_module/authorization.py (reported line 94)May include surrounding context.

python

"""
    删除授权

    API: DELETE /v2/{project_id}/authorizations

    Args:
        user_id: 要删除的用户ID (optional)

Static analysis

No suspicious patterns detected.