Security audit

Huawei Cloud Cce Capacity Trend Forecaster

Security checks for vulnerabilities and agentic risk

Overview

This capacity-forecasting skill bundles extra tools that can expose Kubernetes credentials or secrets and delete or modify cluster resources beyond its stated purpose.

Install only after narrowing the dispatcher to the documented capacity actions or running it with a tightly scoped read-only Huawei role that cannot generate kubeconfigs, list Secrets, or delete/mutate cluster resources. Do not use production AK/SK credentials with the current package surface.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce.py:662
Finding: Kubernetes Client Credentials and Kubeconfig Are Returned in Dispatcher Output
Content: View full analysis
Dict[str, Any]: access_key, secret_key, proj_id = get_credentials_with_region( region, ak, sk, project_id ) # ... cert_duration = ClusterCertDuration(duration=duration) request = CreateKubernetesClusterCertRequest(cluster_id=cluster_id) request.body = cert_duration response = client.create_kubernetes_cluster_cert(request) result = { "success": True, "region": region, "cluster_id": cluster_id, "action": "get_cce_kubeconfig", "duration_days": duration, } if hasattr(response, 'to_dict'): resp_dict = response.to_dict() # Returns the complete kubeconfig, including embedded client # certificate and private-key data. result["kubeconfig"] = resp_dict # ... result["kubeconfig_yaml"] = yaml.dump( resp_dict, default_flow_style=False, allow_unicode=True ) return result ``` The function is registered as an externally invokable dispatcher action: ```python def _get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]: return cce.get_cce_kubeconfig( params["region"], params["cluster_id"], params.get("ak"), params.get("sk"), params.get("project_id"), _to_int(params.get("duration"), 30) ) # ... "huawei_get_cce_kubeconfig": ( ("region", "cluster_id"), _get_cce_kubeconfig ), ``` The ...[truncated 2700 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/cce.py:3315
Finding: Dispatcher Can Enumerate and Return Kubernetes Secret Data
Content: View full analysis
Dict[str, Any]: return cce.list_cce_secrets( params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id") ) ``` The action is publicly registered: ```python "huawei_list_cce_secrets": ( ("region", "cluster_id"), _list_cce_secrets ), ``` The implementation permits cluster-wide enumeration and optional disclosure of complete Secret data: ```python core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secret.data.keys()) if secret.data else [] } if include_data and secret.data: secret_info["data"] = secret.data secret_list.append(secret_info) return { "success": True, "region": region, "cluster_id": cluster_id, "action": "list_cce_secrets", "namespace": namespace or "all", "count": len(secret_list), "secrets": secret_list } ``` ### Technical Analysis The dispatcher accepts `include_data=true` d ...[truncated 1952 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce.py:3360
Finding: Kubernetes TLS Verification Is Disabled and Private Keys Use Predictable Temporary Paths
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/dispatcher.py:1470
Finding: Capacity-Forecasting Skill Exposes Unrelated Cluster-Destructive Operations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (459)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The secret-listing function can enumerate Kubernetes Secrets across namespaces and optionally return secret.data verbatim when include_data=True. For a capacity forecasting skill, this is unjustified access to highly sensitive material and could directly expose credentials, tokens, certificates, and application secrets to the caller.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL-CN.md (reported line 1)May include surrounding context.
md
--- name: capacity-trend-forecaster description: Use this skill for Huawei Cloud CCE periodic capacity trend analysis, resource bottleneck forecasting, node and workload elasticity simulation, capacity curve charts, recurring history comparison, HPA tuning, and node autoscaler optimization advice across 1 hour to 1 month windows. ---

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by node IP, using broader IAM auth methods, and inspecting security groups shifts the skill toward node/network security investigation rather than capacity analysis. That broadens credential use and exposes infrastructure metadata outside the declared purpose.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416