Security audit

Huawei Cloud Cce Alarm Correlation Engine

Security checks for vulnerabilities and agentic risk

Overview

This alarm-correlation skill packages a much broader Huawei Cloud and Kubernetes admin interface than it discloses, including secret-reading and infrastructure-changing actions.

Install only in a tightly restricted test environment or after the publisher removes the undeclared dispatcher actions and secret-return paths. Do not use broad production Huawei Cloud or Kubernetes credentials with this package; if it must be evaluated, use a dedicated least-privilege identity limited to the documented AOM actions and assume command output or logs could expose sensitive cluster data.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/dispatcher.py:1470
Finding: Alarm-focused skill exposes broad destructive cloud and Kubernetes operations
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/cce.py:3313
Finding: Dispatcher permits extraction of raw Kubernetes Secret values across all namespaces
Content: View full analysis
Dict[str, Any]: return cce.list_cce_secrets( params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id") ) # Registered as a public dispatcher action: "huawei_list_cce_secrets": ( ("region", "cluster_id"), _list_cce_secrets ), ``` Secret collection and output: ```python def list_cce_secrets( region: str, cluster_id: str, namespace: Optional[str] = None, limit: int = 100, include_data: bool = False, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None ) -> Dict[str, Any]: """List Secrets in a CCE Kubernetes cluster""" access_key, secret_key, proj_id = get_credentials(ak, sk, project_id) # ... # List secrets core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str( secret.metadata.creation_timestamp ) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secr ...[truncated 2664 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce.py:3375
Finding: Kubernetes API TLS verification is disabled while client credentials are written to predictable temporary files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (479)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The skill can enumerate Kubernetes Secrets and optionally return raw secret data, which may include credentials, tokens, keys, and connection material. This is unrelated to alarm correlation and creates a direct secret-exfiltration path from production clusters through the skill interface.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The skill can list Kubernetes Secrets and, when include_data is enabled, return secret material directly to the caller. In the context of an alarm-correlation skill, this is highly dangerous and unjustified because it enables credential and token extraction from the cluster, facilitating privilege escalation, lateral movement, and compromise of dependent systems.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL-CN.md (reported line 1)May include surrounding context.
md
--- name: alarm-correlation-engine description: 华为云 AOM 告警关联分析技能，支持查询 active/history 告警、当前活跃告警、告警去重归并、严重级别分组、突发/常态告警识别，以及告警规则查询、创建、修改、删除、动作规则和静默规则核对。 ---

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS-by-IP and VPC security group data appears aimed at security posture or connectivity inspection rather than AOM alarm analysis. The mismatch is relevant because it introduces additional infrastructure discovery capabilities under a misleading label.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416