Huawei Cloud Cce Change Impact Analyzer

• Outcome: Review
• Latest audit: Jun 16, 2026 · 8:16 PM UTC
• Version: 0.1.1

Overview

The skill presents itself as read-only analysis, but its bundled dispatcher exposes many cloud and Kubernetes administration actions, so it should be reviewed carefully before installation.

Install only if you are comfortable reviewing and constraining the bundled dispatcher. Use least-privilege read-only Huawei Cloud credentials, avoid granting cluster-admin or write IAM permissions, and do not expose this skill to workflows that may call arbitrary huawei_* actions. Treat kubeconfig export, Secret data access, output_file paths, and any confirm=true invocation as high-risk operations requiring explicit human approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (122)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is described as an analysis-oriented wrapper that should query cloud and cluster state, yet it re-exports destructive and mutating capabilities such as cluster/node/workload deletion and scaling. In an agent skill context, this materially expands the action surface beyond user expectations and enables accidental or malicious infrastructure changes through the same interface used for incident analysis.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Exporting delete_cce_cluster, delete_cce_node, and delete_cce_workload is unjustified for a change-impact analysis tool and creates a direct path to destructive operations. Even if intended for maintenance reuse, exposing these through the same script used by an agent can cause catastrophic data-plane outages or irreversible resource loss if invoked unintentionally or by prompt manipulation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Node pool resize and workload scaling are mutating operations that can disrupt availability, alter costs, and confound forensic/change-correlation results. For an analysis-only skill, their presence broadens the blast radius and creates opportunities for misuse even if they are less severe than deletion.

Intent-Code Divergence

High

• Confidence: 93% confidence
• Finding: The module docstring states the wrapper queries resources and monitoring data, but the exported aliases include destructive and mutating operations. This mismatch is dangerous because downstream users, reviewers, or orchestration agents may trust the documented read-only purpose and grant broader access than intended.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This module exposes broad state-changing AOM capabilities including creating, updating, deleting, enabling, and disabling alarm and action rules, which materially exceeds the stated purpose of change-impact analysis. In an agent setting, these functions expand the blast radius from read-only investigation to monitoring-plane manipulation, allowing an attacker or prompt-injected workflow to suppress detection, alter alerts, or make persistent operational changes.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code administers AOM action/notification rules, including deletion, despite the skill being described as an analysis tool. Notification-rule administration can be abused to disrupt or remove alert delivery paths, reducing defenders' visibility during an incident and enabling stealthier follow-on activity.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The module can create, update, delete, enable, and disable AOM alarm rules, which is inconsistent with a tool meant to attribute incidents to prior changes. These capabilities permit tampering with monitoring and alerting, so compromise of the agent or misuse via prompt injection could silence alerts, create misleading alarms, or otherwise interfere with incident response.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements active remediation, including Kubernetes Deployment rollback and writing reports to disk, even though the skill metadata describes a change-impact analysis capability. In an agent setting, this capability expansion is dangerous because a user or upstream planner invoking an analysis skill could unexpectedly trigger state-changing operations against production infrastructure once confirm=true is supplied.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The function writes a generated Markdown report to a caller-supplied filesystem path with no path restriction, safety prompt, or sandboxing. In an agent environment, this can overwrite arbitrary writable files, persist sensitive cluster-derived data to disk, or be abused for unintended file placement outside the expected workspace.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is described as a change-impact analysis tool, but the file implements many active control-plane and workload mutation operations including cluster deletion, node deletion, workload deletion/scaling, node drain/cordon, hibernate/awake, and public EIP binding. That scope expansion creates an unnecessary destructive capability surface inside an analysis-oriented skill, increasing the chance of misuse, prompt-driven abuse, or operator error.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The code returns full kubeconfig content, including client certificate and key material, to the caller even though the stated purpose is causal change analysis. That gives callers reusable cluster credentials that can be used outside the tool for direct API access and privilege expansion.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The secret-listing function can optionally return Secret data contents via include_data, which enables direct exfiltration of Kubernetes secrets beyond the stated analysis use case. In a change-impact-analysis context, exposing secret values is unnecessary and materially increases confidentiality risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file goes beyond read-only change-impact analysis and includes live cluster mutation operations such as addon installation, update, uninstallation, and network-related reconfiguration. In an incident-analysis skill, those capabilities materially increase the chance of unauthorized or accidental production changes, especially if an agent invokes them under the assumption the skill is observational.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The functions from this range provide cluster modification capabilities that are not justified by the skill's declared purpose of incident change-impact analysis. Because the skill context implies forensic or diagnostic use, hidden write capabilities create a privilege/scope mismatch that could let an operator or agent alter cluster state while believing they are only investigating it.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The module docstring advertises addon management functions, which conflicts with the manifest's analysis-only framing and signals that the implementation scope is broader than the user-facing contract. This mismatch can mislead reviewers, users, and calling agents, making dangerous operations more likely to be exposed or invoked without proper scrutiny.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module is presented as log discovery/query functionality but includes create/delete operations for CCE LogConfig resources, which changes cluster logging behavior. In a change-impact-analysis skill, embedding write-capable infrastructure mutations increases the blast radius and can be abused to silently enable, redirect, or disable log collection during an investigation.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill’s stated purpose is analysis and causal attribution, yet it contains capability to alter cluster-wide log collection policy. That mismatch is dangerous because users invoking analysis may unknowingly grant or trigger configuration-changing behavior that affects observability, incident integrity, and potentially data exfiltration paths.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements provisioning, configuration, deployment, and verification workflows for CCE/CCI/VPC resources, which is materially different from the declared skill purpose of change-impact analysis and incident attribution. In an agent setting, this capability expansion is dangerous because a user invoking an analysis skill could trigger infrastructure mutation, spend money, alter networking, or change cluster state under false expectations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The endpoint creation logic and related setup functions create VPCEP endpoints and modify network routing dependencies, introducing direct infrastructure-changing capability unrelated to causal analysis. Because the skill metadata frames this as an analysis tool, this mismatch increases the chance of unintended execution, privilege misuse, and charge-incurring network changes in production environments.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The smoke workload function creates namespaces and deploys or patches Kubernetes workloads, which is outside the stated scope of change-risk or incident attribution analysis. Even with a confirmation flag, embedding deployment capability in an analysis skill can lead to accidental cluster modification, test artifacts in production, and interference with incident response or forensic integrity.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements privileged cluster lifecycle and exposure operations such as create, delete, hibernate, awake, and EIP binding, which materially exceed the stated purpose of a change-impact analysis skill. In an agent context, these capabilities enable destructive or environment-altering actions that could be invoked under the guise of analysis, increasing the risk of unauthorized modification, outage, or exposure.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The kubeconfig retrieval function generates and returns direct cluster access material, which is unrelated to change-impact analysis and grants downstream access to the Kubernetes API. In an agent workflow, exposing kubeconfig can enable credential theft, lateral movement, or unauthorized cluster administration far beyond the skill’s declared scope.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Binding an EIP to the cluster control plane can make the Kubernetes API publicly reachable, changing the attack surface of the cluster. That capability is unjustified for a change-impact analyzer and could expose administrative endpoints to internet-based attack or policy bypass if triggered improperly.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Provisioning kubeconfig creates direct access credentials to the cluster, a capability not needed for change-impact analysis. In this context, the mismatch between declared purpose and implemented privilege makes the feature especially dangerous because users or higher-level agents may trust the skill as observational when it can actually mint access material.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code enumerates region-wide ELB, NAT Gateway, and EIP resources instead of restricting collection to assets tied to the target cluster. In a multi-tenant or least-privilege-sensitive environment, this broadens data access and can expose unrelated infrastructure metadata and operational signals beyond the user's requested scope.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416