Huawei Cloud Cce Alarm Correlation Engine

• Outcome: Review
• Latest audit: Jun 16, 2026 · 8:18 PM UTC
• Version: 0.1.3

Overview

This skill is not clearly malware, but its packaged dispatcher exposes far broader Huawei Cloud and Kubernetes powers than the alarm-correlation description discloses.

Install only if you are comfortable treating this as a broad Huawei Cloud/CCE administration toolkit, not just an alarm-correlation skill. Use least-privilege temporary credentials, avoid passing AK/SK as command parameters, do not use the subagent helpers until credential redaction is fixed, and review or remove the out-of-scope dispatcher actions before using it in production.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (46)

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The function writes a report to an arbitrary path supplied via `output_file` without any user-facing disclosure in the returned status beyond echoing the path. In an agent setting, this can cause unexpected filesystem modification or overwrite of local files if upstream user input is passed through, even though the content written is not attacker-controlled code.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function writes a generated diagnostic report to an arbitrary user-supplied path via `output_file` without any confirmation, path restriction, or disclosure that the report may contain sensitive cluster metadata and CA log excerpts. In an agent context, this can silently persist operationally sensitive information to unintended locations, increasing the risk of data exposure through shared workspaces, predictable paths, or later retrieval by other users/processes.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The skill collects Cluster Autoscaler pod logs by default when `include_ca_logs` is enabled, but there is no user-facing warning or opt-in acknowledging that pod logs may contain sensitive operational details, internal topology, identifiers, or error data. In a diagnostic skill for cloud infrastructure, this is more dangerous because users may not realize the tool is retrieving raw control-plane-adjacent logs rather than only high-level health metadata.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: get_cce_kubeconfig returns full kubeconfig material, including client credentials and endpoint data, directly to the caller and even renders it as YAML. In this skill context, that effectively hands out reusable cluster access tokens/certificates, enabling follow-on access well beyond the immediate action and creating a credential-exfiltration path.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: list_cce_secrets can return Kubernetes Secret data when include_data=True, without a strong warning or confirmation step. Secret objects commonly contain passwords, tokens, certificates, and cloud credentials, so this creates a straightforward sensitive-data disclosure primitive.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Pod logs frequently contain access tokens, API keys, PII, stack traces, and operational secrets. Returning logs directly without warning, redaction, or scoping safeguards can expose sensitive application data to the caller.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: bind_cce_cluster_eip exposes the Kubernetes API server publicly by attaching an EIP, but does so without explicit confirmation or a user-facing warning. This increases the cluster attack surface and can convert a private control plane into an internet-reachable target if security groups or API auth are weakly configured.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: unbind_cce_cluster_eip changes control-plane reachability and can disrupt remote administration, automation, or monitoring that depends on the public endpoint. While this is less of a confidentiality issue than binding, performing it without explicit warning can still cause operational impact and unsafe surprise changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The install_cce_addon function issues a real remote create_addon_instance call that changes the target CCE cluster, but it has no explicit confirmation gate, dry-run mode, or user-warning mechanism. In an agent setting, this increases the risk of accidental or prompt-induced infrastructure modification, especially because addon installation can affect cluster behavior, networking, observability, or availability.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The update_cce_addon function performs a remote update_addon_instance call that can alter live cluster addon configuration without any explicit confirmation step. In an LLM-driven skill, silent configuration changes are dangerous because a mistaken, ambiguous, or adversarial prompt can trigger impactful production changes without adequate user intent verification.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The configure_cce_bursting_addon function reads current addon state and then updates networking- and scheduling-related addon settings through update_addon_instance, again without a user-facing confirmation barrier. Because it modifies bursting/network parameters for a live CCE addon, unintended execution could disrupt scheduling, connectivity, logging, or cluster-cloud integration, making this more dangerous than a generic metadata update.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code decodes client certificate and private key material from the returned kubeconfig and writes them to temporary files on disk. Even though cleanup is attempted in a finally block, disk materialization increases exposure through race conditions, crashes, permissive filesystem access, backups, or forensic recovery, especially because tempfile.mktemp is used instead of a securely opened temporary file.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function can persist a full raw Kubernetes inventory to an arbitrary output directory when include_raw is enabled, and that inventory contains sensitive operational metadata such as node details, pod labels, workload specs, services, ingresses, and cluster topology. In an agent setting, writing this data to disk without an explicit user-facing warning, minimization, or redaction creates a confidentiality risk because other local users, processes, logs, backups, or later tool steps may access it.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When include_raw is enabled, the function writes full raw API responses to disk under the output directory. In this skill context, those responses can contain cluster inventory, node, deployment, HPA, and possibly cloud/AOM metadata, so storing them without explicit user acknowledgement or redaction increases the risk of sensitive operational data exposure through local filesystem access, backups, or artifact collection.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: History recording is enabled by default and persists analysis outputs to disk, including scope, capacity statistics, elasticity details, recommendations, action notes, and file references. In a cloud operations skill, this creates silent retention of potentially sensitive infrastructure and business-operational metadata, which can be exposed to other local users, logs collectors, backups, or later unintended disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function returns full kubeconfig material, including client certificate/key or equivalent cluster access credentials, directly to the caller with no explicit confirmation, masking, or least-privilege gating. In an agent skill context, this is highly sensitive because a user request or prompt injection could cause credential exfiltration and enable direct administrative access to the Kubernetes cluster.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Binding an EIP makes the Kubernetes API publicly reachable, materially increasing the attack surface of the control plane, yet this function performs the action immediately without an explicit confirmation step or risk warning. In an agent-operated environment, a mistaken or manipulated request could expose a previously private cluster endpoint to the internet.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When include_raw is enabled, the code writes detailed raw API responses for nodes, pods, deployments, HPAs, and metrics directly to disk. In a CCE/AOM operations context, those files can contain sensitive infrastructure inventory, internal IPs, namespace/workload names, and operational telemetry; writing them without minimization, redaction, retention controls, or an explicit warning increases the risk of local data exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function `scale_workload` performs a state-changing Kubernetes operation by patching a deployment's replica count, but there is no in-function confirmation gate, dry-run mode, or explicit user-facing warning about the operational impact. In an agent skill context, this is dangerous because a natural-language request or misparsed input could trigger live scaling of production workloads, causing outages, cost increases, or masking incidents.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: `huawei_expand_nodepool` is a thin wrapper around `resize_node_pool` and exposes infrastructure-changing behavior without any local disclosure of cost, capacity, or service impact. In this skill's diagnosis context, embedding node pool expansion alongside read-only diagnostic actions increases the chance that an automation flow performs unintended infrastructure changes.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The generated subagent task command embeds raw AK/SK directly into a user-visible command string. This exposes long-lived cloud credentials to logs, transcripts, UIs, shell history, and any downstream agent or operator that can view the task, enabling credential theft and unauthorized access to Huawei Cloud resources.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The auto-subagent command generation repeats the same unsafe pattern by distributing executable command strings containing raw access credentials. In a multi-agent workflow, this broadens exposure because every consumer of the generated task data can read or persist the secrets.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The formatted prompt prints both AK and SK in natural-language output and instructs their use in the command. This is especially dangerous because prompts are commonly surfaced to users, stored in conversation history, and forwarded to other models or systems not authorized to receive cloud secrets.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The `list_cce_secrets` function can return Kubernetes Secret contents when `include_data=True`, exposing base64-encoded secret material directly to callers without any warning, redaction, or additional authorization gate. In an agent skill context, this is especially dangerous because it turns a diagnostic/inventory capability into a credential-exfiltration primitive for all readable cluster secrets.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The create_node_pool function submits a real infrastructure creation request immediately, unlike the resize and delete paths which require explicit confirm=true gating. In an agent skill context, this increases the risk of accidental or prompt-induced resource provisioning, causing unapproved compute creation, configuration drift, and unexpected billing.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416