Huawei Cloud Cce Auto Remediation Runner

• Outcome: Review
• Latest audit: Jun 16, 2026 · 10:12 AM UTC
• Version: 0.1.3

Overview

This skill is a real Huawei Cloud CCE remediation tool, but it exposes extra high-impact cloud administration and secret-access capabilities that are not clearly disclosed.

Install only if you intend to give this skill broad Huawei Cloud and Kubernetes administrative authority, not just remediation authority. Use least-privilege credentials, avoid enabling or invoking unlisted actions, do not use include_data for Secrets, do not request kubeconfig export through this skill, and treat confirm=true as permission for live production changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (133)

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This wrapper exposes a much broader action surface than the skill metadata suggests, including deletion and management operations across multiple Huawei Cloud services. In an agent skill that is supposed to be a preview-first, confirm-required CCE remediation runner, this mismatch increases the risk that the agent can invoke unexpected destructive capabilities outside the declared scope.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The module docstring states that the script only queries Huawei Cloud resources and monitoring data, but the code wires in destructive operations such as cluster, node, and workload deletion and scaling. Misleading documentation is dangerous in agentic environments because reviewers, orchestrators, or policy layers may grant trust or permissions based on a false read-only description.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: A query-only description paired with actual mutation capabilities creates a scope-deception problem: operators may treat the tool as observational while it can perform destructive actions. In this skill context, that is especially risky because the skill is meant to enforce preview and confirmation semantics for remediation operations, yet the wrapper exposes broader mutating primitives behind a benign description.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file exposes broad AOM monitoring administration capabilities far beyond the stated purpose of a CCE auto-remediation runner, including creating, updating, enabling, disabling, and deleting alarm and notification rules. In an agent setting, this scope expansion is dangerous because a user or prompt injection can repurpose the skill to suppress monitoring, alter alerting behavior, or perform unauthorized cloud administration under the cover of remediation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill can delete AOM action/notification rules, which can disable or break alert delivery pipelines unrelated to remediation. Because this capability is not necessary for preview-first CCE recovery actions, it creates an unnecessary high-impact path for an attacker or confused deputy to silence notifications and reduce detection of subsequent malicious or operationally harmful actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill writes a report to a user-controlled path via output_file without any apparent path restriction, sandboxing, or allowlist. In an agent context, this creates an arbitrary local file write primitive that is unrelated to the core CCE remediation function and could overwrite sensitive files, plant data in unexpected locations, or interfere with other local workflows.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The function accepts an arbitrary output_file path and writes a generated markdown report to disk without any path restriction, explicit opt-in guard, or alignment with the skill’s stated preview/confirm mutation workflow. Even though the content written is diagnostic, arbitrary file writes are a side effect that can overwrite local files or place potentially sensitive cluster diagnostics in unintended locations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements far more than preview-first remediation planning: it exposes broad cluster inventory, Kubernetes object inspection, direct workload mutation, secret/config inspection, kubeconfig retrieval, and control-plane network changes. This materially expands the skill's authority and attack surface beyond its declared purpose, making misuse or prompt-driven abuse much more damaging.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: get_cce_kubeconfig returns full kubeconfig material, including client credentials and generated YAML, which grants direct cluster API access outside the stated remediation-runner scope. Exposing transferable access material lets a caller bypass the skill's safety workflow and operate on the cluster independently.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: list_cce_secrets can enumerate Kubernetes Secrets and optionally return secret data directly, which is a classic credential and sensitive-data exposure path unrelated to preview-first remediation. In this context, it enables exfiltration of API keys, passwords, tokens, and certificates from workloads across namespaces.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: bind_cce_cluster_eip and unbind_cce_cluster_eip modify control-plane network exposure, potentially making the Kubernetes API publicly reachable or changing its availability, which is outside the stated remediation scope. This is a high-risk security posture change because it can expose a previously private cluster to internet attack surface.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The drain implementation claims to evict non-system pods but actually deletes pods directly with delete_namespaced_pod, bypassing normal eviction semantics and disruption controls. That can cause unexpected downtime, ignore PodDisruptionBudgets, and make the operator believe a safer action occurred than what was really executed.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements addon install, uninstall, update, and live reconfiguration operations, which are broader than the skill’s declared preview-first remediation scope and include direct cluster mutations. In an agent setting, capability drift like this is dangerous because orchestration layers may trust the manifest and invoke functions that perform unreviewed infrastructure changes.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The install path performs an immediate remote addon creation via client.create_addon_instance without any preview or confirmation control, despite the skill metadata promising preview-first, confirm-required mutation behavior. This mismatch can cause unintended cluster changes if an agent or user relies on the manifest-level safety guarantees.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The update function immediately calls client.update_addon_instance and can alter live cluster addon configuration and versioning with no preview or confirmation gate. Because this skill advertises confirm-required mutations, the absence of such controls materially increases the risk of accidental or unauthorized operational impact.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The bursting addon configuration function reads current state, patches values, and immediately submits a live update to the cluster without preview or confirmation. Since it changes networking-related addon parameters, unintended execution could disrupt scheduling, connectivity, logging, or workload placement in production clusters.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This helper does more than log discovery: it can create and delete CCE LogConfig custom resources, which mutates cluster-wide log collection behavior. In a skill explicitly framed as preview-first, confirm-required remediation, adding configuration-management capabilities broadens the attack surface and could be abused to redirect, expand, or disable logging, undermining detection and incident response.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The file grants the skill the ability to create and delete CCE LogConfig resources even though the stated purpose is auto-remediation planning/execution for CCE recovery actions. That mismatch matters because log pipeline changes can hide activity, stop evidence collection, or exfiltrate broader application logs to attacker-chosen destinations if surrounding controls fail.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file implements broad provisioning and operational workflows for CCE/CCI bursting, including endpoint setup, addon installation, workload deployment, and verification, which exceeds the manifest’s declared auto-remediation scope. In an agent skill, scope drift is dangerous because it grants the agent capabilities to create or modify infrastructure beyond the user’s expected remediation boundary, increasing the chance of unintended or unauthorized changes.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create new VPCEP infrastructure endpoints and later install/configure the virtual-kubelet addon, which are privileged control-plane and network mutations not clearly justified by the stated remediation-runner purpose. Even with a confirm flag, embedding these capabilities in a remediation skill expands the blast radius: a user seeking recovery actions could unintentionally authorize persistent network and cluster changes that incur cost, alter routing, or weaken change-control boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This section creates or patches a namespace and Deployment for smoke testing, which is a mutation of tenant workloads outside the declared remediation-runner boundary. In context, this is less severe than raw infrastructure provisioning, but it still allows the skill to introduce or alter application resources, potentially consuming cluster capacity, affecting namespace hygiene, or violating expectations that the skill only performs recovery actions.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements full cluster lifecycle operations, including cluster creation and deletion, which materially exceed the skill’s stated purpose of preview-first auto-remediation. In an agentic environment, exposing broad infrastructure administration primitives increases blast radius and allows destructive or unauthorized provisioning actions unrelated to remediation.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The kubeconfig retrieval function returns cluster access material, enabling direct administrative access to Kubernetes rather than performing constrained remediation. In this skill context, that is especially dangerous because it turns a remediation runner into a credential-extraction path that can be used for lateral movement, persistence, or out-of-band cluster control.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: Binding or unbinding a public EIP on the cluster control plane changes the external exposure of the Kubernetes API server and is outside the declared remediation scope. This capability can make a previously private control plane reachable from the internet, sharply increasing attack surface and enabling follow-on compromise if other controls are weak.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Returning kubeconfig content is an unjustified privileged capability for a remediation runner because it exports reusable cluster credentials or access artifacts to the caller. That bypasses the intended constrained action model and can enable unauthorized direct control over cluster resources beyond any preview/confirm flow.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416