T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/dispatcher.py:1469- Finding
Read-only scanner exposes destructive and mutating cloud operations
- Content
View full analysis
- Remediation
View remediation
Security audit
Huawei Cloud Cce Availability Risk Scanner
Security checks for vulnerabilities and agentic risk
Overview
This package is advertised as a read-only availability scanner, but it also exposes reachable actions that can change or disclose sensitive Huawei CCE infrastructure.
Treat this as a Review item, not a low-risk read-only scanner. Before installing, require a narrowed dispatcher or package that exposes only the documented read-only scan actions, and run it only with tightly scoped read-only Huawei IAM and Kubernetes RBAC that denies writes, Secret data access, and kubeconfig/certificate generation unless explicitly needed and separately approved.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/cce.py:3374- Finding
Dispatcher permits cluster-wide Kubernetes Secret extraction
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/huawei_cloud/cce_hpa.py:84- Finding
Kubernetes and Huawei API clients disable TLS certificate verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/huawei_cloud/cce.py:3385- Finding
Predictable shared temporary files expose Kubernetes client private keys
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/huawei_cloud/cce.py:719- Finding
Callable kubeconfig action prints embedded Kubernetes private-key material
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:68- Finding
Runtime dependencies are installed without version or integrity pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (455)
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is described as a read-only availability risk scanner, but this file includes many state-changing and destructive capabilities such as deleting clusters/nodes/workloads, scaling workloads/nodepools, hibernating clusters, draining nodes, and binding public EIPs. This is a dangerous capability mismatch because users, orchestrators, or downstream policy engines may trust the skill as low-risk when it can actually disrupt or destroy infrastructure.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The presence of create_cce_logconfig_action and delete_cce_logconfig_action directly contradicts the declared read-only risk-assessment purpose. Even with a confirm flag, the code enables persistent configuration changes that can reroute, start, or stop log collection, creating opportunities for concealment, operational disruption, or unauthorized expansion of access.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This module implements destructive and state-changing cluster management capabilities such as create, delete, hibernate, awake, and public EIP binding, which materially exceed the declared read-only availability-scanning purpose of the skill. In an agent/tooling context, this mismatch is dangerous because a user or upstream prompt expecting a harmless scanner could unintentionally trigger infrastructure modification, outage, or exposure operations.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
This function performs live cluster mutations by creating or replacing HorizontalPodAutoscaler resources, directly contradicting the skill’s stated read-only scanner role. In an agent environment, hidden write capability is especially dangerous because users or orchestrators may invoke the skill expecting inspection only, leading to unauthorized availability, performance, or cost-impacting changes in production clusters.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The dispatcher registers a very large set of mutating actions including deleting clusters/nodes/workloads, scaling workloads, creating infrastructure, alarm-rule changes, draining/cordoning nodes, rollback, and auto-remediation, while the skill is described as a read-only availability risk scanner. This is a dangerous capability mismatch: any caller that can invoke dispatcher actions can pivot from assessment into impactful infrastructure modification or disruption, violating least privilege and dramatically increasing blast radius.
- Content
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Rollback and auto-remediation are directly mutating operational capabilities that can change workloads and cluster behavior, contradicting the skill’s read-only description. In a scanner context this is especially dangerous because users may grant access expecting passive assessment while the skill can trigger production changes and outages.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: availability-risk-scanner description: Use this skill for Huawei Cloud CCE availability risk scanning, including master HA and utilization, node and workload AZ balance, single replicas, missing PodDisruptionBudgets, health probes, unreasonable affinity or nodepool pinning, core addon anti-affinity, gateway workload distribution, and request/limit overcommit. ---
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Querying ECS instances by IP and inspecting security groups is more aligned with node/network security review than availability posture scanning. It extends access into additional infrastructure domains without clear declaration.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/huawei_cloud/cce_nodepool.py:456
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/network.py:781
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/storage.py:416