Huawei Cloud Cce Autoscaling Diagnoser

• Outcome: Review
• Latest audit: Jun 16, 2026 · 8:17 PM UTC
• Version: 0.1.3

Overview

The skill is advertised as read-only autoscaling diagnosis, but its bundled dispatcher exposes broader cloud administration, credential-return, secret-reading, and state-changing actions.

Install only after reviewing the dispatcher surface and limiting credentials to a least-privilege, preferably read-only Huawei Cloud/IAM role. Do not use broad production AK/SK with this package unless you accept that it contains tools beyond diagnosis, including secret access, kubeconfig export, report persistence, and infrastructure mutation actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (71)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill writes a generated diagnosis report to an arbitrary output path, and that report can contain sensitive cluster operational data such as HPA state, nodepool details, events, pending pods, and snippets of autoscaler logs. Because this happens without any explicit user-facing warning, redaction, or confirmation, users may unintentionally persist sensitive infrastructure information to local disk or shared storage where it can later be accessed by unauthorized parties.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill actively retrieves Cluster Autoscaler pod logs and incorporates matched lines and snippets into the diagnostic result and Markdown report. Pod logs often contain sensitive operational details, internal topology, error messages, resource identifiers, and occasionally secrets or tokens; surfacing them without disclosure, minimization, or sanitization increases the risk of inadvertent sensitive-data exposure.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The function returns full kubeconfig material, including client certificate and private key data, directly to the caller and even serializes it to YAML. That grants bearer-like administrative access to the cluster API, so any downstream logging, display, reuse, or interception can immediately compromise the cluster.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The secret-listing function can optionally return secret.data contents to the caller when include_data=true, exposing Kubernetes secrets such as tokens, passwords, API keys, and certificates. In an agent skill context, this is especially dangerous because returned values may be surfaced to users, stored in traces, or forwarded to other tools.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code decodes client certificate and private key material from the generated kubeconfig and writes them to local temporary files. Although cleanup is attempted, using tempfile.mktemp creates a race-prone insecure temp path and sensitive key material may remain exposed to other local processes or persist if the process crashes before deletion.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This skill accesses cloud credentials and performs broad cluster, workload, pod, event, alarm, metrics, node, and ELB enumeration without any visible user-facing notice, consent gate, or scope-limiting control in this file. In an agent setting, that creates a privacy and over-collection risk because a user may trigger diagnosis expecting narrow autoscaling checks while the skill silently retrieves substantially more operational data than strictly necessary.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When include_raw is enabled, the function writes raw API responses for clusters, nodes, node pools, deployments, HPAs, metrics, and AOM discovery directly to disk. In this skill context, those payloads can contain sensitive infrastructure metadata and operational details, and the code provides no sanitization, redaction, encryption, or explicit consent guard before persistence.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Historical records are persisted by default because record_history=True and history_dir is auto-derived from output_dir, causing ongoing storage of cluster scope, capacity stats, elasticity details, recommendations, and file paths. In a cloud-diagnostics skill, this expands the lifetime of potentially sensitive environment metadata and creates avoidable retention risk if the host is shared, backed up, or insufficiently protected.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The function retrieves and returns full kubeconfig material, including client credentials and cluster endpoints, with no explicit confirmation step, redaction, or least-privilege safeguard. In an agent skill context, this can silently turn a diagnostic workflow into credential extraction, enabling administrative access to the cluster if the output is logged, displayed, or forwarded.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Binding a public EIP to the cluster control plane exposes the Kubernetes API server to external networks, materially increasing attack surface. Although this may be a legitimate administrative action, the function performs it without an explicit warning, confirmation gate, or guidance about firewall restrictions, which is risky in an agent-driven environment.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function can persist raw cluster inventory and metrics to disk when include_raw is enabled, including potentially sensitive operational data such as node, pod, deployment, HPA, and metrics responses. In an agent/skill context, writing these artifacts without explicit user consent, redaction, or visibility increases the risk of unintended local data exposure, later retrieval by other processes, or leakage through shared workspaces.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function `scale_workload` performs a state-changing Kubernetes operation by patching a deployment's replica count immediately after loading cluster credentials, with no in-function confirmation gate, dry-run mode, or explicit user-warning mechanism. In an agent skill context, exposing mutation of production workloads as a callable utility materially increases the risk of accidental or unauthorized service disruption, especially if higher-level orchestration invokes it automatically during diagnosis or remediation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The `huawei_expand_nodepool` helper exposes node-pool resizing as a directly callable wrapper around `resize_node_pool`, which is a cluster-modifying infrastructure action. Although it forwards a `confirm` flag, this file presents the operation through the CLI and skill surface without a mandatory user-facing warning or enforced interactive confirmation at the entrypoint, making unintended infrastructure changes more likely.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The subagent task generator constructs shell command strings that embed raw AK/SK credentials directly into command arguments. This is dangerous because secrets can be exposed through logs, process listings, agent transcripts, crash reports, and downstream tool outputs, enabling credential theft and unauthorized cloud access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The prompt formatter includes raw access credentials in natural-language task text and in the example execution command returned to callers. This creates direct secret disclosure risk because the prompt itself may be shown to users, stored in chat history, indexed in telemetry, or forwarded to other agents.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The `list_cce_secrets` function can return Kubernetes Secret contents when `include_data=True`, exposing secret material such as tokens, credentials, or certificates directly to the caller. In a diagnostic skill, this is especially risky because broad cluster-inspection tooling may be invoked in routine troubleshooting contexts where users do not expect raw secrets to be disclosed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code decodes the client certificate and private key from the generated kubeconfig and writes them to predictable files under `/tmp`. Even though cleanup is attempted later, writing sensitive key material to disk increases exposure through local file access, crashes before cleanup, race conditions, or leftover artifacts on shared systems.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This function automatically retrieves cloud credentials and performs multiple authenticated Huawei Cloud/CCE/AOM API calls without any explicit user-facing notice, confirmation, or disclosure at the point of use. In an agent-skill context, that can cause unintended access to sensitive infrastructure metadata and monitoring data when a user may not realize the skill will use privileged credentials and contact external cloud services.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code path again resolves credentials and uses them to enumerate cluster and pod information and query AOM metrics, but provides no user-visible warning that sensitive credential-backed operations are occurring. In a diagnostic skill, silent use of stored AK/SK increases the risk of surprise data access, over-collection, and misuse in multi-tenant or delegated-agent environments.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The node-monitoring path performs authenticated calls to Kubernetes/CCE/AOM endpoints to retrieve node inventory, flavors, IDs, and utilization data without any user-facing disclosure. Because node-level telemetry and infrastructure metadata are sensitive operational data, undisclosed collection is more dangerous in this skill context, which is designed to perform broad autoscaling diagnosis across cluster layers.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code materializes short-lived Kubernetes client certificate, key, and CA data into named temporary files on disk in order to configure the Kubernetes client. Even though cleanup is attempted in a finally block, the sensitive material exists on the filesystem during execution and may remain if the process crashes, is killed, or if the host has weak temp-directory isolation, enabling local disclosure of cluster-access credentials.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The create_node_pool function issues a real cloud resource creation request immediately after parameter validation, but unlike resize_node_pool and delete_node_pool it has no confirm gate, warning, or dry-run response. In an agent skill context, this increases the chance of unintended infrastructure provisioning, cost impact, and environmental drift from ambiguous or misparsed user requests.

Missing User Warnings

Low

• Confidence: 75% confidence
• Finding: When ssh_key is not supplied, the function silently pulls a node login password from an environment-backed helper and uses it to configure new nodes. In an agent-executed skill, this can cause credential material to be used implicitly without clear user awareness, creating surprise authentication behavior and increasing the risk of accidental secret use or unintended node access configuration.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The code writes the generated Markdown report to an arbitrary path from params['output_file'] with no validation or user-visible warning. If an attacker can influence that parameter, this enables unintended file overwrite/path traversal within the agent's filesystem context, which can clobber local files or place sensitive analysis output in unsafe locations.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The code writes the generated Markdown report to a path taken directly from `params["output_file"]` with no validation, restriction, or confirmation. In an agent skill context, untrusted user input can steer writes to unintended filesystem locations, causing arbitrary file overwrite, clobbering local state, or writing sensitive cluster-derived data into exposed paths.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416