Security audit

Huawei Cloud Cce Capacity Trend Forecaster

Security checks across malware telemetry and agentic risk

Overview

The skill is advertised as a CCE capacity forecaster, but its shipped dispatcher exposes much broader cloud and Kubernetes control actions, credential-bearing outputs, and sensitive data access than the description discloses.

Install only after reviewing the full dispatcher surface and granting least-privilege Huawei credentials. Treat this as a broad cloud/Kubernetes operations skill, not only a capacity forecaster; avoid production credentials unless you are comfortable with secret access, kubeconfig export, log/audit retrieval, and live infrastructure changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (68)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The remediation flow enables diagnostic log collection by default via include_logs=_to_bool(params.get("include_logs"), True), which means sensitive application or infrastructure logs may be gathered unless the caller explicitly disables it. In an ops/remediation skill, logs can contain secrets, tokens, internal endpoints, or customer data, so collecting them without clear opt-in increases privacy and data-exposure risk.

Missing User Warnings

Medium

Confidence: 75% confidence
Finding: The code writes a generated diagnostic report to an arbitrary caller-supplied path without any safety checks, consent gate, or restriction to a controlled output directory. In this skill context, reports may contain cluster topology, pod names, autoscaling status, log snippets, and failure evidence, so unintended local disclosure or overwrite of sensitive files is possible if an attacker can influence output_file.

Missing User Warnings

High

Confidence: 99% confidence
Finding: get_cce_kubeconfig returns the full kubeconfig structure and a YAML rendering, which can include client certificate and client key material granting direct cluster access. In an agent skill context, returning this to the caller or downstream logs materially increases the chance of credential exfiltration and unauthorized Kubernetes administration.

Missing User Warnings

High

Confidence: 98% confidence
Finding: list_cce_secrets can return secret.data when include_data=True, exposing Kubernetes secret contents directly to the agent output path. Secrets often contain passwords, tokens, certificates, and API keys, so this creates a straightforward credential disclosure primitive.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The install_cce_addon function performs a live remote cluster modification immediately after parameter validation, with no explicit confirmation gate, dry-run mode, or higher-level safety interlock. In an agent skill context, this is dangerous because natural-language prompts or chained tool use could trigger unintended addon installation on production clusters, changing cluster behavior and availability.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The update_cce_addon function can change addon versions and arbitrary values on an existing cluster addon without any confirmation or safety prompt. Because addon updates can alter networking, monitoring, scheduling, or core cluster services, accidental or prompt-induced execution could disrupt workloads or introduce configuration drift in production.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: configure_cce_bursting_addon patches a live addon configuration, including networking-related fields such as subnet and VPC-associated values, without explicit confirmation. In this skill's cloud-capacity and autoscaling context, such a change is especially sensitive because it can directly affect burst scheduling behavior, connectivity, and cluster elasticity in a running environment.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code obtains short-lived Kubernetes client certificate/key material from the CCE API, writes both to temporary files on disk, and never informs the caller that highly sensitive cluster credentials are being materialized locally. This is dangerous because those files can be recovered by local attackers, backup agents, crash dumps, or other processes, and the risk is amplified by the code also disabling TLS verification for subsequent cluster API access.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The audit-log query path returns parsed events containing usernames, request URIs, source IPs, user agents, status data, and raw audit content, which may expose operationally sensitive or privacy-sensitive information to the caller without any warning, minimization, or redaction. In a multi-tenant or agent-mediated environment, this can leak admin activity, resource names, and access patterns beyond what the user intended to retrieve.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: When include_raw is enabled, the code writes a full Kubernetes inventory snapshot to disk, including node labels, workload metadata, services, ingresses, and likely cluster topology details, without any in-file guardrails, masking, or explicit warning. In an infrastructure analysis skill, these artifacts can materially increase exposure if written to shared workspaces, CI runners, support bundles, or improperly permissioned directories, because they provide attackers with sensitive environment reconnaissance.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: When include_raw is enabled, the code writes full raw API responses from clusters, nodes, nodepools, deployments, HPAs, metrics, and AOM discovery directly to disk. In a cloud operations skill, those responses can contain sensitive infrastructure metadata and operational details, so persisting them without explicit consent, minimization, or protection increases the risk of local data exposure.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The history feature automatically persists capacity-analysis results and appends them to a JSONL history file, creating ongoing local retention of cluster metadata, recommendations, elasticity settings, and file locations. While less sensitive than full raw responses, this still stores operational intelligence that may be exposed to other local users, backups, or unintended consumers if the host is shared or compromised.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The function retrieves cluster kubeconfig and returns the full credential material, including a YAML-serialized kubeconfig, without any explicit confirmation gate, warning, masking, or least-privilege control. In an agent skill context, this materially increases the risk of unauthorized cluster access, credential exfiltration through logs/tool outputs, and downstream compromise of the Kubernetes control plane.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Binding an EIP to the cluster control plane exposes the Kubernetes API externally, but the function performs the action immediately with no confirmation or warning about the increased attack surface. In this skill, enabling public API access can weaken a previously private cluster posture and facilitate brute-force, credential abuse, or misconfiguration-based compromise.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The action handler accepts credentials and then queries Kubernetes and multiple Huawei Cloud services (CCE, ELB, NAT, EIP) without any user-facing notice, consent checkpoint, or scope disclosure. In an agent/skill context, this can cause unintended sensitive infrastructure enumeration and metadata exposure because a user may trigger broad cloud inspection without realizing the breadth of access or the data returned.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: When include_raw is enabled, the function writes full raw API responses for nodes, pods, deployments, HPAs, and metrics to disk. In this skill context, those artifacts can contain sensitive operational metadata such as cluster inventory, namespace layout, pod names, internal IPs, utilization patterns, and autoscaling state, and the file provides no inline warning, minimization, or protection around that persistence.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code writes a live kubeconfig obtained from Huawei CCE to a predictable file under /tmp and then loads it from disk. Kubeconfigs commonly contain cluster endpoints, tokens, or client certificates, so storing them in a world-accessible temporary location without strict permissions or guaranteed deletion can expose cluster-admin access to other local users or processes on the host.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This function performs a real deployment scale operation against the target cluster without any confirmation gate, dry-run mode, authorization check, or safety interlock. In an agent skill context, exposing a direct mutation primitive increases the chance of accidental or unauthorized changes that can cause outages, cost increases, or disruption of production workloads.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The batch diagnosis flow writes a list of abnormal node IPs to disk under a persistent report directory without disclosure, encryption, or access control handling. While this is not as severe as credential leakage, it unnecessarily persists infrastructure inventory that could aid reconnaissance if the host or workspace is shared or later exposed.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The generated subagent task list builds shell command strings that inline raw AK/SK credentials and returns them in task metadata. This exposes secrets to logs, UIs, process lists, transcript/history storage, and any downstream agent that receives the task definition, creating a high likelihood of credential disclosure and reuse.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The subagent prompt explicitly includes raw access credentials in natural-language task text and in the execution command. This unnecessarily propagates secrets into prompt history and model-visible context, where they may be retained, echoed, leaked to other tools, or exposed to operators.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill includes a function that can enumerate Kubernetes Secrets and, when include_data=True, return the secret data contents directly to the caller without any guardrails, warning, masking, or least-privilege restriction. In the context of an agent skill, this materially increases the risk of credential/token exfiltration because cluster secrets commonly contain passwords, API keys, certificates, and service-account material.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The create_node_pool function performs an immediate state-changing infrastructure operation that can provision new compute resources and incur cost without any confirm/preview gate. In an agent skill context, this is dangerous because natural-language workflows or prompt confusion can trigger real cloud changes unintentionally, especially since similar destructive operations in this same file do require explicit confirmation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The function writes report_markdown to Path(output_file) using a user-supplied path with no validation, restriction, or warning. In an agent/skill context, this can enable arbitrary file write within the executing user's permissions, potentially overwriting sensitive files or planting data in unexpected locations if an attacker can influence output_file.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The function writes the generated report to `output_file` directly from input parameters with no path validation, sandboxing, or explicit safety controls. In an agent context, this can enable arbitrary file write behavior to attacker-chosen locations, which may overwrite user files, poison other workflows, or drop content into sensitive paths if the process has sufficient filesystem permissions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416