T09 · Insecure Skill Coding Practices
Error
- Location
scripts/huawei_cloud/cce.py:1324- Finding
Kubernetes client credentials are written to predictable, potentially insecure temporary files
- Content
View full analysis
- Remediation
View remediation
Security audit
Huawei Cloud Cce Autoscaling Diagnoser
Security checks for vulnerabilities and agentic risk
Overview
The skill promises read-only autoscaling diagnosis, but its packaged dispatcher can also read secrets and perform destructive cloud or Kubernetes changes.
Review before installing. Use only a tightly scoped read-only Huawei IAM identity and Kubernetes RBAC role, exclude Secret access and mutation permissions, avoid the password-based helper, and do not open generated HTML reports with network access until remote scripts are removed or integrity-pinned. The package should be narrowed to a diagnosis-only dispatcher before routine use.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/huawei_cloud/cce.py:1310- Finding
TLS certificate verification is disabled for Kubernetes API connections
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/cce.py:3312- Finding
The diagnosis dispatcher exposes cluster-wide Kubernetes Secret data
- Content
View full analysis
Dict[str, Any]: # ... core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secret.data.keys()) if secret.data else [] } if include_data and secret.data: secret_info["data"] = secret.data secret_list.append(secret_info) ``` The dispatcher forwards the sensitive option: ```python def _list_cce_secrets(params: Dict[str, str]) -> Dict[str, Any]: return cce.list_cce_secrets( params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id") ) ``` The action is registered at `scripts/huawei_cloud/dispatcher.py:1514`: ```python "huawei_list_cce_secrets": (("region", "cluster_id"), _list_cce_secrets) ...[truncated 1910 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/dispatcher.py:1470- Finding
Read-only autoscaling Skill exposes destructive and mutating cloud actions through the same dispatcher
- Content
View full analysis
Dict[str, Any]: return cce.delete_cce_cluster( params["region"], params["cluster_id"], params.get("confirm", "").lower() == "true", params.get("delete_evs", "").lower() == "true", params.get("delete_net", "").lower() == "true", params.get("delete_obs", "").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id") ) ``` ### Technical Analysis `SKILL.md:263-281` explicitly states that the Skill is read-only and must never scale workloads, modify node pools, install or upgrade addons, or otherwise remediate resources. However, the only approved executable entry point imports a broad dispatcher containing deletion, scaling, resizing, Secret access, addon management, alarm-rule mutation, remediatio ...[truncated 1773 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/huawei_cloud/chart_generator.py:343- Finding
Generated HTML reports execute remotely hosted JavaScript without integrity pinning
- Content
View full analysis
' adapter_tag = '' ``` A similar dependency appears in `scripts/huawei_cloud/report_generator.py:353`: ```html ``` ### Technical Analysis The generated report does not contain a fully reviewed and immutable payload. When a user opens the HTML report, the browser retrieves JavaScript from a third-party CDN and executes it in the report’s document context. Although version numbers are present, there is no Subresource Integrity (`integrity`) attribute and no restrictive Content Security Policy. If the CDN, package publication account, DNS resolution, network path, or delivered artifact is compromised, the effective code executed by the report changes after the Skill itself has been audited. The remote script can read report DOM content, including cluster identifiers, namespaces, workload names, operational evidence, metrics, and logs embedded in the report. It can then transmit those values to an external server from the viewer’s browser. ### Attack Path 1. The Skill generates an HTML report containing cluster diagnosis data. 2. The report is opened in a browser with network access. 3. The browser requests Chart.js and its adapter from `cdn.jsdelivr.net`. 4. An attacker compromises the CDN response, package release, DNS path, or network trust chain. 5. The attacker-controlled JavaScript executes in the report. 6. The script reads sensitive report content and transmits it externally or alters the displayed diag ...[truncated 488 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/huawei_get_node_security_groups.py:22- Finding
Standalone helper accepts cloud account passwords through command-line arguments
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:65- Finding
Installation instructions use unpinned dependencies from the live package index
- Content
View full analysis
= 3.6 installed - Required packages: `huaweicloudsdkcore`, `huaweicloudsdkcce`, `huaweicloudsdkaom`, `kubernetes` - Verify: `python3 --version` - Install packages: `pip3 install huaweicloudsdkcore huaweicloudsdkcce huaweicloudsdkaom kubernetes` ``` ### Technical Analysis The installation command retrieves the latest versions available from the configured Python package index without version constraints or hash verification. The effective code executed by the Skill can therefore change independently of the audited project. The packages are named as expected for Huawei Cloud and Kubernetes SDKs; the audit found no evidence of typosquatting in the listed names. The risk arises from mutable dependencies, compromised package releases, dependency-chain compromise, or incompatible future versions. The broad imports in `scripts/huawei-cloud.py` also reference additional SDK packages not included in this installation command, increasing the chance that users resolve dependencies ad hoc. ### Attack Path 1. A user follows the documented `pip3 install` command. 2. Pip resolves the newest available package versions from the configured index. 3. A compromised release, package-index account, mirror, or transitive dependency supplies malicious code. 4. The malicious dependency executes during installation, import, or SDK use. 5. Because the Skill runs with Huawei credentials and Kubernetes access, the dependency can read those credentials and access cloud resources. ### Impact Assessment A compromised SDK dependency executes with the same local privileges, environment variables, filesystem access, and network access as the Skill. It may obtain Huawei AK/SK values, temporary tokens, Kubernetes certificates, logs, and report data. The ultimate cloud impact depen ...[truncated 59 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (429)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: autoscaling-diagnoser description: Use this skill for Huawei Cloud CCE autoscaling failures, including HPA not increasing Pod replicas, Cluster Autoscaler or CCE elastic engine not adding or removing nodes, missing metrics, missing CPU or memory requests, maxReplicas or max_nodes limits, Pending Pods, scheduling constraints, subnet IP exhaustion, ECS quota, IAM agency permission issues, and HPA-to-CA cascade diagnosis. The skill must output a complete Markdown diagnosis report with process, evidence, conclusion, confidence, and recommendations. ---
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic inspection/report-formatting skill mislabeled as autoscaling diagnosis is a lesser but real security issue because it encourages unnecessary permissions and data access. The danger comes from broad inspection outputs, including alarms and ELB monitoring, being reachable under a more trusted diagnostic description.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/huawei_cloud/cce_nodepool.py:456
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/network.py:781
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/storage.py:416