Huawei Cloud Cce Cci Bursting Deployer

• Outcome: Review
• Latest audit: Jun 16, 2026 · 10:12 AM UTC
• Version: 0.1.1

Overview

The documented bursting workflow is coherent, but the package exposes broader cloud and Kubernetes powers than the skill description scopes or warns about.

Install only if you are comfortable giving this package broad Huawei Cloud and Kubernetes authority, not just CCE-CCI bursting authority. Use a least-privilege IAM user, avoid passing AK/SK as command parameters, do not use actions that export kubeconfig or include Secret data unless absolutely necessary, and review every confirm=true or infrastructure-changing command before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (65)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function writes a generated markdown report to any caller-supplied path via Path(output_file).write_text() without constraining the destination or surfacing a warning. In an agent skill context, an untrusted prompt or downstream tool input could steer this to overwrite arbitrary writable files, causing integrity issues or unintended data placement on the host.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This code collects Kubernetes events and Cluster Autoscaler pod logs, which can contain sensitive operational details such as pod names, namespaces, error messages, infrastructure identifiers, and possibly secrets accidentally emitted into logs. In an agent skill, silently gathering and then returning or persisting this telemetry increases the risk of over-collection and unintended exposure of cluster-sensitive data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: `get_cce_kubeconfig` returns full kubeconfig material, including client certificate/key data and endpoint details, directly to the caller and even serializes it to YAML. That gives the recipient reusable cluster credentials, so any caller with access to this function can obtain privileged Kubernetes API access beyond the immediate task.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: `list_cce_secrets` can return Kubernetes Secret data when `include_data=true`, exposing credential material, tokens, certificates, and application secrets to the caller. There is no confirmation step, warning, or redaction, so this function can be used as a direct secret exfiltration primitive.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: install_cce_addon issues a live CreateAddonInstance API call that changes remote cluster state immediately, but the function has no explicit confirmation, dry-run mode, or safety interlock. In an agent skill context, this increases the chance that ambiguous prompts, prompt injection, or tool misuse could cause unintended addon installation on production clusters.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: update_cce_addon performs a remote addon upgrade/reconfiguration through UpdateAddonInstanceRequest without any confirmation or execution guard. Because it accepts arbitrary values and version changes, an agent could silently alter cluster networking, monitoring, or scheduling behavior if invoked from an unsafe workflow.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: configure_cce_bursting_addon modifies live virtual-kubelet bursting configuration, including subnet, network, project, and optional scheduling/proxy/logging settings, then immediately pushes the update to the cluster. In this skill's context, that is especially sensitive because it controls CCE-to-CCI bursting behavior and network placement, so unintended execution can disrupt scheduling, expose workloads to incorrect network paths, or break image-pull/runtime behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When include_raw is enabled, the function writes a full raw cluster inventory JSON to disk, which can contain sensitive operational metadata such as node names, workload names, labels, annotations, ingress/service mappings, and potentially security-relevant topology details. In an agent skill context, persisting this data without explicit disclosure, minimization, or protections increases the risk of unintended local exposure through shared workspaces, logs, artifact collection, or later exfiltration by other processes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When include_raw is enabled, the function writes full raw API responses to disk under the output directory. In this skill context, those responses can contain sensitive operational metadata, cluster inventory, and potentially credential-adjacent or internal infrastructure details, and the code provides no consent gate, masking, or warning before persisting them.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The history feature persistently stores capacity analysis records and appends them to a JSONL history file without any explicit warning to the caller. Although this appears intended for observability, it creates a silent data-retention channel for cluster operational state, recommendations, and file locations, which may violate least-retention expectations in automation environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function retrieves and returns full kubeconfig material, including client credentials and cluster endpoints, without any explicit confirmation, redaction, or safe-handling guardrails. In an agent skill context, this can silently exfiltrate privileged cluster access into logs, chat transcripts, downstream tools, or other agent steps, enabling full Kubernetes API access to the target cluster.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Binding an EIP exposes the Kubernetes control plane to public network access, materially changing the cluster's attack surface, yet the function performs the action immediately without a confirmation gate or risk warning. In an automation/agent environment, a simple instruction could unintentionally publish the API endpoint externally and increase exposure to brute force, scanning, or misconfiguration-based compromise.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The action handler accepts user-supplied credentials and then invokes multiple Huawei Cloud and Kubernetes-related API calls that enumerate cluster, node, pod, ELB, NAT gateway, and EIP monitoring data. In an agent skill context, this is a real data-access risk because the code provides no explicit consent gate, scope restriction, or user-facing disclosure that sensitive cloud inventory and telemetry will be fetched from external services.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The function serializes a live kubeconfig containing cluster credentials to a predictable file in /tmp, which is typically world-accessible to other local users/processes and prone to leakage through backups, debugging, or symlink/race issues. In this skill, the kubeconfig grants Kubernetes API access to a production CCE cluster, so disclosure could enable cluster enumeration or administrative actions depending on the embedded privileges.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This function directly patches deployment replica counts, changing live workload capacity without any in-function confirmation gate, approval workflow, or safety interlock. In an automation skill for cloud cluster operations, unintended or malformed inputs could trigger service disruption, excess cost, or scaling a sensitive workload at the wrong time.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: During scaling operations, the code again writes kubeconfig with cluster access credentials to a predictable path under /tmp before using it for API calls. Combining credential materialization on disk with a mutating operation increases risk because theft of that file could let another local actor perform the same or broader cluster changes.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The code constructs shell commands and natural-language prompts that directly interpolate AK/SK credentials, which exposes secrets to logs, transcripts, shell history, subagent outputs, and any downstream tooling that captures command strings. In this skill, the risk is amplified because the functions are specifically designed to distribute tasks to subagents, multiplying the number of places where long-lived cloud credentials may be disclosed.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The function can return Kubernetes Secret data verbatim when include_data=True, exposing base64-encoded secret contents to the caller without any guardrail, warning, or scope restriction. In an agent skill context, this is especially dangerous because the tool may be invoked during routine troubleshooting and can exfiltrate credentials, tokens, certificates, or registry auth from the cluster.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function writes a generated report to a path fully controlled by the caller via `output_file` with no validation, path restriction, or confirmation. In an agent/automation context, this can enable arbitrary file overwrite within the agent's filesystem permissions, which may corrupt files, clobber configs, or place data in sensitive locations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The start_ecs_instance function performs a real remote state-changing action against cloud infrastructure without any confirmation gate, warning, or secondary acknowledgment, unlike the stop and reboot paths in the same file. In an agent skill context, this increases the chance of unintended infrastructure changes from ambiguous prompts, prompt injection, or operator error, resulting in unplanned instance startup, cost impact, or operational side effects.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: TLS certificate verification is explicitly disabled when connecting to the Kubernetes API server. This permits man-in-the-middle interception or spoofing of the cluster control-plane endpoint, which is especially dangerous here because the code also loads short-lived client certificates and then queries privileged cluster resources.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code performs an HTTPS request with TLS certificate verification explicitly disabled via `verify=False`. This allows a man-in-the-middle attacker on the network path to intercept or modify responses from the Huawei Cloud NAT API, which is especially dangerous here because the function is handling cloud infrastructure metadata and authenticated API requests.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This function performs sensitive operations against Kubernetes and Huawei Cloud APIs using AK/SK credentials, collects pod logs, events, service metadata, and cloud inventory, yet the code itself provides no explicit user-facing disclosure or confirmation barrier before accessing those resources. In an agent skill context, that increases the risk of surprise data access, over-collection of operational metadata, and accidental exposure of sensitive cluster information in returned snapshots and Markdown reports.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When include_raw is enabled, the code writes raw collector outputs and detailed operational report artifacts to disk without sanitization, minimization, or any guardrails. In this skill context, those raw results can contain cluster topology, incidents, recommendations, file references, and potentially credential-adjacent or sensitive operational data returned by downstream collectors, creating a data exposure risk if the output directory is shared, persisted, or later exfiltrated.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This function automatically fetches pod logs and optional metrics and includes excerpts in the returned result, which can expose sensitive operational data such as tokens, credentials, internal endpoints, stack traces, environment-derived secrets, or workload behavior to any caller of the skill. Although there is partial masking for some secret patterns, the masking is incomplete and best-effort, and metrics/log retrieval is enabled by default for logs without an explicit consent, scope check, or strong redaction boundary.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416