Security audit

Huawei Cloud Cce Cci Bursting Deployer

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate bursting-deployment purpose, but its shipped command wrapper exposes much broader cloud and cluster powers, including credential and Kubernetes Secret disclosure plus some under-confirmed mutations.

Review before installing. Use only tightly scoped Huawei IAM credentials, avoid broad AK/SK or root-level cloud access, and do not invoke off-profile dispatcher actions unless you have separately reviewed them. The publisher should narrow the shipped dispatcher surface to the skill-profile actions, enforce confirm=true on node-pool creation, remove or gate kubeconfig and Secret-data export, and avoid persisting general cloud credentials in Kubernetes Secrets.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/cce.py:662
Finding: Complete Kubernetes kubeconfig and private key returned through standard output
Content: View full analysis
Dict[str, Any]: """Get kubeconfig for a CCE cluster""" access_key, secret_key, proj_id = get_credentials_with_region( region, ak, sk, project_id ) if not access_key or not secret_key: return { "success": False, "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters." } try: from huaweicloudsdkcce.v3 import ( CreateKubernetesClusterCertRequest, ClusterCertDuration, ) client = create_cce_client(region, access_key, secret_key, proj_id) cert_duration = ClusterCertDuration(duration=duration) request = CreateKubernetesClusterCertRequest(cluster_id=cluster_id) request.body = cert_duration response = client.create_kubernetes_cluster_cert(request) result = { "success": True, "region": region, "cluster_id": cluster_id, "action": "get_cce_kubeconfig", "duration_days": duration, } if hasattr(response, 'to_dict'): resp_dict = response.to_dict() # The complete kubeconfig includes embedded authentication material. result["kubeconfig"] = resp_dict if 'clusters' in resp_dict: result["cluster_endpoints"] = [] for cluster in resp_dict['clusters']: endpoint_info = { "name": cluster.get('name'), "server": cluster. ...[truncated 2552 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/cce.py:3313
Finding: Kubernetes Secret contents can be extracted across all namespaces
Content: View full analysis
Dict[str, Any]: """List Secrets in a CCE Kubernetes cluster""" access_key, secret_key, proj_id = get_credentials(ak, sk, project_id) # Obtain a cluster certificate and configure the Kubernetes client. cce_client = create_cce_client(region, access_key, secret_key, proj_id) cert_request = CreateKubernetesClusterCertRequest() cert_request.cluster_id = cluster_id body = ClusterCertDuration() body.duration = 1 cert_request.body = body cert_response = cce_client.create_kubernetes_cluster_cert(cert_request) kubeconfig_data = cert_response.to_dict() # ... core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secret.data.keys()) if secret.data else [] } if include_data and secret.data: secret_info["data"] = secret.data secret_list.append(secret_info) ...[truncated 2204 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce_apm.py:138
Finding: General Huawei Cloud AK/SK credentials are persistently stored in Kubernetes
Content: View full analysis
None: body = { "apiVersion": "v1", "kind": "Secret", "metadata": { "name": secret_name, "namespace": namespace, }, "type": "Opaque", "data": { "access-key": base64.b64encode( access_key.encode("utf-8") ).decode("ascii"), "secret-key": base64.b64encode( secret_key.encode("utf-8") ).decode("ascii"), }, } try: core_v1.read_namespaced_secret(secret_name, namespace) core_v1.patch_namespaced_secret(secret_name, namespace, body) except Exception as exc: if getattr(exc, "status", None) != 404: raise core_v1.create_namespaced_secret(namespace, body) ``` The general Huawei credentials are used as the default APM credentials: ```python access_key, secret_key, proj_id = get_credentials_with_region( region, ak, sk, project_id ) if not access_key or not secret_key: return _error("Huawei Cloud credentials are required") effective_apm_ak = apm_access_key or access_key effective_apm_sk = apm_secret_key or secret_key # ... _upsert_secret( core_v1, namespace, managed_secret, effective_apm_ak, effective_apm_sk, ) response = patch_workload(workload_name, namespace, patch) ``` ### Technical Analysis The APM injection action accepts dedicated APM credentials, but if they are omitted it falls back to the general Huawei Cloud AK/SK used to operate the Skill. Those credentials are then base64-encoded a ...[truncated 1715 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce.py:3368
Finding: Predictable temporary private-key files are combined with disabled Kubernetes TLS verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (459)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill can start, stop, and reboot arbitrary ECS instances using supplied credentials and instance IDs, which is a powerful destructive control plane capability unrelated to the advertised bursting-deployer scope. If invoked by mistake, coerced through prompt abuse, or used by an overprivileged agent, it can cause outages, workload interruption, data loss from forced reboot/stop operations, and broad operational impact across cloud environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP and retrieving node security-group configuration indicates cross-service infrastructure inspection outside the advertised burst workflow. This can reveal sensitive network posture and host mapping that users would not expect to expose during a simple bursting setup.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416