T09 · Insecure Skill Coding Practices
Error
- Location
manifest.json:345- Finding
Dangerous CCE Operations Lack the Declared Confirmation Parameter
- Content
View full analysis
- Remediation
View remediation
Security audit
Huawei Cloud Cce Cluster Management
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Huawei Cloud CCE administration skill, but it exposes high-impact cluster controls with mismatched safety gating and ordinary secret-bearing parameters.
Install only for trusted Huawei Cloud CCE administrators, use least-privilege IAM credentials, prefer environment or secret-store based credentials over tool arguments, avoid returning or logging kubeconfig, and manually require confirmation before any operation that changes cluster state until the manifest and implementation are fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
manifest.json:24- Finding
Cloud Secret Keys and Root Passwords Are Exposed Through Ordinary Tool Parameters
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:80- Finding
Unpinned Third-Party Python Dependencies Create Supply-Chain and Reproducibility Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (31)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md description: | 华为云 CCE 集群生命周期管理技能，支持集群创建、删除、休眠/唤醒、节点池扩缩容、节点生命周期管理（cordon/uncordon/drain/delete）等操作。 触发场景：(1) 创建或删除 CCE 集群；(2) 集群休眠/唤醒操作；(3) 节点池扩缩容；(4) 节点调度管理（标记不可调度、驱逐Pod、删除节点）；(5) 绑定/解绑集群 EIP；(6) 查询集群和节点信息；(7) 管理集群插件。 关键词：CCE 集群管理、创建集群、删除集群、节点池、节点管理、集群休眠、集群唤醒、cordon、uncordon、drain、kubeconfig tags: [cce, kubernetes, 集群管理, 节点池, 插件] version: 1.0.0 ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md description: | 华为云 CCE 集群生命周期管理技能，支持集群创建、删除、休眠/唤醒、节点池扩缩容、节点生命周期管理（cordon/uncordon/drain/delete）等操作。 触发场景：(1) 创建或删除 CCE 集群；(2) 集群休眠/唤醒操作；(3) 节点池扩缩容；(4) 节点调度管理（标记不可调度、驱逐Pod、删除节点）；(5) 绑定/解绑集群 EIP；(6) 查询集群和节点信息；(7) 管理集群插件。 关键词：CCE 集群管理、创建集群、删除集群、节点池、节点管理、集群休眠、集群唤醒、cordon、uncordon、drain、kubeconfig tags: [cce, kubernetes, 集群管理, 节点池, 插件] version: 1.0.0 ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md description: | 华为云 CCE 集群生命周期管理技能，支持集群创建、删除、休眠/唤醒、节点池扩缩容、节点生命周期管理（cordon/uncordon/drain/delete）等操作。 触发场景：(1) 创建或删除 CCE 集群；(2) 集群休眠/唤醒操作；(3) 节点池扩缩容；(4) 节点调度管理（标记不可调度、驱逐Pod、删除节点）；(5) 绑定/解绑集群 EIP；(6) 查询集群和节点信息；(7) 管理集群插件。 关键词：CCE 集群管理、创建集群、删除集群、节点池、节点管理、集群休眠、集群唤醒、cordon、uncordon、drain、kubeconfig tags: [cce, kubernetes, 集群管理, 节点池, 插件] version: 1.0.0 ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md description: | 华为云 CCE 集群生命周期管理技能，支持集群创建、删除、休眠/唤醒、节点池扩缩容、节点生命周期管理（cordon/uncordon/drain/delete）等操作。 触发场景：(1) 创建或删除 CCE 集群；(2) 集群休眠/唤醒操作；(3) 节点池扩缩容；(4) 节点调度管理（标记不可调度、驱逐Pod、删除节点）；(5) 绑定/解绑集群 EIP；(6) 查询集群和节点信息；(7) 管理集群插件。 关键词：CCE 集群管理、创建集群、删除集群、节点池、节点管理、集群休眠、集群唤醒、cordon、uncordon、drain、kubeconfig tags: [cce, kubernetes, 集群管理, 节点池, 插件] version: 1.0.0 ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md description: | 华为云 CCE 集群生命周期管理技能，支持集群创建、删除、休眠/唤醒、节点池扩缩容、节点生命周期管理（cordon/uncordon/drain/delete）等操作。 触发场景：(1) 创建或删除 CCE 集群；(2) 集群休眠/唤醒操作；(3) 节点池扩缩容；(4) 节点调度管理（标记不可调度、驱逐Pod、删除节点）；(5) 绑定/解绑集群 EIP；(6) 查询集群和节点信息；(7) 管理集群插件。 关键词：CCE 集群管理、创建集群、删除集群、节点池、节点管理、集群休眠、集群唤醒、cordon、uncordon、drain、kubeconfig tags: [cce, kubernetes, 集群管理, 节点池, 插件] version: 1.0.0 ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
yaml description: | 华为云 CCE 集群生命周期管理技能，支持集群创建、删除、休眠/唤醒、节点池扩缩容、节点生命周期管理（cordon/uncordon/drain/delete）等操作。 触发场景：(1) 创建或删除 CCE 集群；(2) 集群休眠/唤醒操作；(3) 节点池扩缩容；(4) 节点调度管理（标记不可调度、驱逐Pod、删除节点）；(5) 绑定/解绑集群 EIP；(6) 查询集群和节点信息；(7) 管理集群插件。 关键词：CCE 集群管理、创建集群、删除集群、节点池、节点管理、集群休眠、集群唤醒、cordon、uncordon、drain、kubeconfig tags: [cce, kubernetes, 集群管理, 节点池, 插件] version: 1.0.0 ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
This skill explicitly supports retrieval of cluster kubeconfig, which is a sensitive access artifact that can grant authenticated access to Kubernetes clusters. Even though kubeconfig retrieval is part of legitimate cluster administration, exposing it through a broadly invocable skill increases the risk of credential disclosure, privilege misuse, or unintended transmission to unauthorized users or downstream systems.
- Content
md name: huawei-cloud-cce-cluster-management description: | Huawei Cloud CCE (Cloud Container Engine) cluster lifecycle management skill using Python SDK v3. Use this skill when the user wants to: (1) create, delete, hibernate, or awake CCE clusters, (2) list clusters and query cluster/node/nodepool/addon information, (3) manage node pools (create, delete, resize), (4) manage nodes (create, delete, cordon, uncordon, drain), (5) manage addons (install, uninstall, update), (6) bind/unbind cluster EIP for public access, (7) get cluster kubeconfig. Trigger: user mentions "CCE cluster", "create cluster", "delete cluster", "node pool", "node management", "hibernate cluster", "awake cluster", "addon", "kubeconfig", "EIP binding", "CCE 集群", "创建集群", "删除集群", "节点池", "节点管理", "休眠集群", "唤醒集群", "插件", "kubeconfig", "EIP 绑定" tags: [cce, kubernetes, cluster-management, nodepool, addon] ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
Including 'kubeconfig' directly in the trigger list makes it easier for casual or ambiguous user requests to invoke a capability that returns cluster access credentials. In the context of an agent skill, discoverability of credential-retrieval functionality materially increases the chance of unauthorized access, accidental disclosure, or prompt-driven abuse.
- Content
md description: | Huawei Cloud CCE (Cloud Container Engine) cluster lifecycle management skill using Python SDK v3. Use this skill when the user wants to: (1) create, delete, hibernate, or awake CCE clusters, (2) list clusters and query cluster/node/nodepool/addon information, (3) manage node pools (create, delete, resize), (4) manage nodes (create, delete, cordon, uncordon, drain), (5) manage addons (install, uninstall, update), (6) bind/unbind cluster EIP for public access, (7) get cluster kubeconfig. Trigger: user mentions "CCE cluster", "create cluster", "delete cluster", "node pool", "node management", "hibernate cluster", "awake cluster", "addon", "kubeconfig", "EIP binding", "CCE 集群", "创建集群", "删除集群", "节点池", "节点管理", "休眠集群", "唤醒集群", "插件", "kubeconfig", "EIP 绑定" tags: [cce, kubernetes, cluster-management, nodepool, addon] ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The documented tool
huawei_get_cce_kubeconfigis a credential-access function because kubeconfig commonly contains bearer tokens, client certificates, or other material sufficient to administer the cluster. In a skill that also manages destructive cluster operations, compromise or misuse of kubeconfig can enable broad lateral impact across workloads, secrets, and infrastructure.- Content
md |------|----------|------------| | `huawei_list_cce_clusters` | List all CCE clusters in region | `region` | | `huawei_get_cce_nodes` | Get detailed node information | `region`, `cluster_id`, `node_id` | | `huawei_get_cce_kubeconfig` | Get cluster kubeconfig | `region`, `cluster_id`, `duration` | ### Cluster Management
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This tool is explicitly designed to retrieve kubeconfig, which is credential/access material for Kubernetes cluster administration. In the context of a cluster-management skill, this is legitimate functionality, but it is still a real security-sensitive capability because misuse or disclosure can enable unauthorized cluster access.
- Content
json "script": "scripts/huawei-cloud.py" }, { "name": "huawei_get_cce_kubeconfig", "description": "Get kubeconfig for a CCE cluster. Returns kubeconfig in JSON and YAML format with cluster endpoints information. The kubeconfig can be used with kubectl to manage the cluster.", "parameters": { "type": "object",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The description states the kubeconfig can be used with kubectl to manage the cluster, confirming that the tool returns active access material rather than harmless metadata. That makes this a genuine credential-access capability whose danger depends on who can invoke it and how outputs are handled.
- Content
json }, { "name": "huawei_get_cce_kubeconfig", "description": "Get kubeconfig for a CCE cluster. Returns kubeconfig in JSON and YAML format with cluster endpoints information. The kubeconfig can be used with kubectl to manage the cluster.", "parameters": { "type": "object", "properties": {
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file’s user-facing instructions, warnings, and examples are presented only in Chinese, and there is no statement that the skill is region- or language-specific by design, nor any opt-in for language preference. This can violate a language/locale policy that requires user choice or explicit justification for a forced locale.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest-style trigger line includes generic phrases such as "create cluster," "delete cluster," and especially "addon," which are not sufficiently scoped to Huawei Cloud CCE and could overlap with unrelated user requests. Although some triggers are specific, the list does not provide exclusion conditions or clear scope constraints for when non-CCE uses of these phrases should not activate the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest exposes a tool that returns kubeconfig material, which can grant direct administrative or cluster-level access depending on the generated credentials. While this is expected functionality for a cluster-management skill, the lack of an explicit warning that the output is sensitive access material increases the risk of accidental disclosure, unsafe logging, or casual handling by downstream agents/users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Binding a public EIP to the cluster API server increases the cluster's external attack surface by making the control-plane endpoint reachable from the internet. In a cluster-management context this may be legitimate, but the absence of a user-facing warning can cause operators or agents to enable public exposure without appreciating the security consequences.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The text states as a fact that 'the script automatically performs SHA-512 salted encryption + base64 encoding,' which describes concrete runtime behavior. In this file, however, there is no implementation at all—only documentation and examples—so the wording actively attributes behavior to code not present here and can mislead readers about what this file actually does.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These lines describe specific script logic: conditional use of an environment variable, complexity validation, and error handling. Because the artifact under review is only a markdown reference file and contains no executable implementation, the documentation overstates what this file's code does and creates an intent/implementation mismatch.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document enumerates destructive permissions such as cluster and node deletion/update without warning about the operational impact of granting them. In a cluster-management skill, this can normalize overbroad access and lead users to assign permissions that allow irreversible disruption of production infrastructure if the credentials or workflow are misused.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Recommending the broad
CCE Administratorsystem policy as a default combination, without a least-privilege warning or narrower alternative, encourages excessive privilege assignment. Because this skill manages full CCE cluster lifecycle operations, overprivileged users or agents could create, modify, expose, hibernate, or delete clusters beyond the minimum required scope.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
ssh_key: SSH key pair name- Password: passed via
CCE_NODE_PASSWORDenvironment variable (8-26 characters, must contain at least three of: uppercase, lowercase, digits, special characters)
Important: The password is read from the
CCE_NODE_PASSWORDenvironment variable, and the script automatically performs SHA-512 salted encryption + base64 encoding, no manual processing required.bash export CCE_NODE_PASSWORD="your_password"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
ssh_key: SSH key pair name- Password: passed via
CCE_NODE_PASSWORDenvironment variable (8-26 characters, must contain at least three of: uppercase, lowercase, digits, special characters)
Important: The password is read from the
CCE_NODE_PASSWORDenvironment variable, and the script automatically performs SHA-512 salted encryption + base64 encoding, no manual processing required.bash export CCE_NODE_PASSWORD="your_password"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
ssh_key: SSH key pair name- Password: passed via
CCE_NODE_PASSWORDenvironment variable (8-26 characters, must contain at least three of: uppercase, lowercase, digits, special characters)
Important: The password is read from the
CCE_NODE_PASSWORDenvironment variable, and the script automatically performs SHA-512 salted encryption + base64 encoding, no manual processing required.bash export CCE_NODE_PASSWORD="your_password"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
ssh_key: SSH key pair name- Password: passed via
CCE_NODE_PASSWORDenvironment variable (8-26 characters, must contain at least three of: uppercase, lowercase, digits, special characters)
Important: The password is read from the
CCE_NODE_PASSWORDenvironment variable, and the script automatically performs SHA-512 salted encryption + base64 encoding, no manual processing required.bash export CCE_NODE_PASSWORD="your_password"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation gives a direct scale-down command for a node pool but does not warn that reducing node count can evict workloads, remove cluster capacity, and potentially cause service disruption if pods are not safely drained or replicated. In a cluster management skill, omission of these operational safety constraints can lead users to perform destructive actions that impact availability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation tells users to export a node password directly in the shell, which can leak credentials through shell history, process inspection, terminal logs, or shared session mechanisms. In this skill context, the password is used for creating CCE nodes/node pools, so exposure could enable unauthorized access to cluster nodes or reuse of the same credential elsewhere.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/cce-cluster-parameters.md:163