Huawei Cloud Cce Availability Risk Scanner

• Outcome: Review
• Latest audit: Jun 16, 2026 · 8:14 PM UTC
• Version: 0.1.3

Overview

The skill is advertised as a read-only CCE availability scanner, but the packaged dispatcher exposes many live cloud and Kubernetes mutation actions that users would not expect from that purpose.

Install only after reviewing and restricting the exposed actions. Use least-privilege Huawei Cloud/IAM and Kubernetes RBAC credentials that cannot create, delete, scale, update addons, read secret data, bind EIPs, or administer alarms if you intend to use this as a read-only scanner. Treat the package as an administrative cloud toolkit unless the dispatcher is reduced to the read-only actions listed in skill-profile.yaml.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (152)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is described as a read-only availability risk scanner, but the compatibility alias table exposes destructive and mutating operations such as cluster deletion, node deletion, workload deletion, scaling, and node-pool resizing. Even if these are not directly invoked in this file, publishing them through the same entrypoint materially expands the attack surface and enables callers or downstream dispatcher logic to perform unauthorized state-changing actions under the guise of a read-only inspection skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The alias map binds delete_cce_cluster, delete_cce_node, and delete_cce_workload into the global command surface, which is incompatible with the stated purpose of availability scanning. In skill ecosystems, capability mismatch is dangerous because users, orchestrators, or prompt-injection paths may invoke these functions unexpectedly, leading to destructive cloud changes and outages.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Exposing scale_cce_workload and resize_node_pool goes beyond passive assessment and permits live modification of cluster capacity and workloads. In the context of a risk scanner, this is dangerous because an unintended or coerced invocation could destabilize services, change cost, or create/resolve incidents without proper change control.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file exposes multiple state-changing operations such as creating, updating, enabling, disabling, and deleting AOM alarm and action rules, even though the skill is described as a read-only availability risk scanner. In an agent setting, this capability mismatch is dangerous because a user or prompt injection can pivot a supposedly diagnostic tool into modifying or removing monitoring controls, reducing visibility and weakening production safeguards.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Alarm-rule and notification-rule administration is not necessary for availability risk assessment and materially expands the blast radius of the skill. These functions can disable alerting, delete rules, or alter notification behavior, allowing an attacker or mistaken operator to suppress incident detection and response while appearing to use a benign inspection tool.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This code performs live cluster mutation by replacing a Deployment template and initiating a rollback, which directly contradicts the skill's stated read-only risk-assessment purpose. In an agent setting, this scope mismatch is dangerous because a caller may invoke a supposedly safe scanner and unintentionally trigger production changes if confirmation gates are bypassed, misunderstood, or programmatically supplied.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The orchestration function goes beyond assessment by diagnosing, previewing/executing rollback, polling for recovery, and optionally writing reports, expanding the skill from read-only inspection into operational change management. This is risky because the broader workflow normalizes automated remediation inside a tool users would reasonably trust as non-mutating, increasing the chance of unauthorized or accidental production impact.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The output_file parameter allows arbitrary local file writes without any visible path restriction, which can be abused to overwrite files accessible to the agent runtime. In a cloud-scanning skill, this capability is unrelated to core functionality and broadens the attack surface from cluster inspection to local environment tampering or persistence.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module advertises remediation orchestration while the skill manifest describes read-only assessment, creating a deceptive contract mismatch. In security-sensitive agent ecosystems, this kind of hidden capability is dangerous because trust and permission decisions may be based on metadata rather than full code review.

Description-Behavior Mismatch

Critical

• Confidence: 99% confidence
• Finding: The skill metadata claims a read-only availability risk scanner, but the file includes numerous state-changing and destructive operations such as deleting clusters/nodes/workloads, scaling workloads/node pools, cordon/drain, hibernate/awake, and binding public EIPs. This is a dangerous capability mismatch because a user or orchestrator selecting the skill for safe inspection could instead be exposed to cluster takeover, service disruption, or data loss.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The function returns kubeconfig material and generated client certificates, which grant direct Kubernetes API access beyond passive risk assessment. In the context of an availability scanner, exposing admin-capable access artifacts materially expands privilege and enables lateral movement, persistence, or direct cluster manipulation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill can enumerate Kubernetes Secrets and optionally return secret data contents, which is unrelated to availability risk scanning and exposes highly sensitive credentials or tokens. This creates a direct credential-access path that could compromise workloads, cloud resources, and downstream systems.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file exposes install, update, uninstall, and configuration-changing operations against live CCE clusters even though the skill is advertised as a read-only availability risk scanner. That mismatch is dangerous because an orchestrator or user may trust the skill in contexts where only non-destructive inspection is expected, enabling unintended or unauthorized state changes to production cluster addons.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The module contains broad cluster addon management capability that is not justified by the stated purpose of availability risk assessment. In a security review, unnecessary write-capable cloud operations materially increase attack surface and create a confused-deputy risk where a supposedly diagnostic skill can alter cluster behavior, availability, or observability components.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The docstring and implementation framing this as addon 'management functions' conflicts with the manifest's claim that the skill is a read-only scanner. This kind of documentation/intent mismatch is security-relevant because operators, policy engines, or downstream agents may rely on the manifest and mistakenly grant or invoke capabilities that exceed expected risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file exposes application log querying, audit-log analysis, and especially LogConfig create/delete operations that exceed the declared purpose of a read-only availability-risk scanner. In this context, hidden or unjustified write-capable cluster features are dangerous because they expand operator trust and can be abused to alter log collection, disrupt observability, or access unrelated sensitive data under the guise of a benign scanner.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code includes cluster log collection configuration management capabilities, including creating and deleting LogConfig custom resources, which are not justified by an availability assessment tool. Because these operations can modify what logs are collected or stop collection entirely, they create an unnecessary attack surface and can facilitate stealth, surveillance, or operational disruption.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The module is presented as a log discovery/query helper, but it also performs mutating cluster operations. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the documented read-oriented purpose while the code can actually change cluster state.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill writes reports, summaries, and history files to local disk, which contradicts the 'read-only scanner' framing and creates a confidentiality risk because cluster metadata, recommendations, and optionally raw API responses can persist outside the expected execution boundary. In shared runners, developer workstations, or agent environments, this can expose sensitive operational data to other processes, users, or later sessions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements active infrastructure modification workflows—VPCEP creation, addon installation/configuration, and workload deployment—despite the skill being described as a read-only availability risk scanner. In an agent context, this is dangerous because users invoking a 'scanner' may grant trust expecting observation-only behavior, but the skill can change cloud networking and cluster state, creating unauthorized side effects and cost exposure.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code creates VPCEP endpoints and may auto-discover route tables, which modifies tenant networking and can incur charges. This is unjustified in a risk-assessment skill, and the mismatch between declared purpose and actual capability increases the chance of unintended or socially engineered infrastructure changes.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code installs and configures the virtual-kubelet addon, altering cluster scheduling behavior and expanding runtime capabilities. In the context of a supposed read-only scanner, this is dangerous because it enables persistent cluster changes under a misleading interface, risking outages, policy violations, and unauthorized configuration drift.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The smoke-workload function creates namespaces and creates or patches Deployments, directly modifying Kubernetes workloads. That exceeds scanning scope and is especially risky because an operator may invoke the skill expecting analysis only, while it can consume capacity, alter namespace state, and interfere with workload placement or policy controls.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring explicitly advertises setup, deployment, and verification actions that contradict the manifest's read-only scanner intent. This discrepancy is dangerous because it signals deceptive or careless packaging, making it easier for mutating code to bypass user expectations, review processes, or policy controls built around the declared skill purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The module materially exceeds the declared skill scope of a read-only availability risk scanner by exposing destructive and state-changing operations such as create, delete, hibernate, awake, and public EIP binding. In an agent/tooling context, this kind of scope mismatch is dangerous because users, orchestrators, or reviewers may grant trust and permissions suitable for read-only inspection while the code can actually modify or expose cluster infrastructure.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416