Huawei Cloud Cce Container Migration Planner

• Outcome: Review
• Latest audit: Jun 16, 2026 · 8:18 PM UTC
• Version: 0.1.1

Overview

This skill is presented as a read-only Huawei Cloud CCE migration planner, but its packaged dispatcher exposes broad administrative actions and sensitive credential-return paths that are not proportionate to that purpose.

Review carefully before installing. Use only tightly scoped read-only Huawei Cloud credentials, avoid passing AK/SK as command parameters, and do not enable include_data, include_raw, output_file, kubeconfig export, or any mutating action unless you have independently audited and constrained the dispatcher.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (36)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function writes a generated report to `output_file` exactly as supplied, creating parent directories and overwriting file contents without any path validation, confinement, or user-facing disclosure. In an agent setting, a user-controlled path can cause arbitrary file write within the agent's filesystem scope, which is dangerous even though the content is markdown because it can clobber existing files, place data in sensitive locations, or assist follow-on attacks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill collects Kubernetes events and cluster-autoscaler pod logs, and can also return raw collected data, all of which may include sensitive operational details such as pod names, namespaces, error messages, internal topology, and possibly secrets accidentally emitted to logs. In a migration-planning skill, this data access is adjacent to legitimate diagnostics, but the absence of explicit disclosure, minimization, or redaction increases the risk of unintended data exposure through agent responses, stored artifacts, or downstream consumers.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The function explicitly returns full kubeconfig material, including client certificate and key data, to the caller. That data grants cluster API access and can be reused outside the intended workflow, so exposing it in a generic skill greatly increases the chance of credential leakage, replay, or unauthorized cluster administration.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The secret-listing helper can disclose Kubernetes Secret contents when include_data=true, yet there is no additional warning, approval gate, or masking. Since Kubernetes Secrets commonly contain tokens, passwords, and certificates, this creates a direct credential and sensitive-data exfiltration path.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code decodes client certificate and private key material from the generated kubeconfig and writes them to temporary files on disk. Even though cleanup is attempted in a finally block, writing credentials to the filesystem increases exposure through race conditions, insecure temp-file creation, crash scenarios, backup/EDR collection, or other local users/processes reading the files before deletion.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When include_raw is enabled, the function writes a full raw Kubernetes inventory to disk, including cluster topology, workload metadata, labels, annotations, and related infrastructure details. In a migration-planning skill, that data can be sensitive operational metadata, and this file provides no warning, redaction, permission check, or safer default for persistent storage, increasing the chance of unintended disclosure through local filesystem access, backups, or artifact collection.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code supports persisting full raw API responses to disk when include_raw is enabled, and those responses can contain cluster, node, deployment, and HPA inventory data. In a migration-planning skill, that data is operationally sensitive and writing it unredacted to local storage increases exposure through accidental disclosure, overly broad filesystem access, backups, or later collection by other processes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function retrieves cluster kubeconfig material and returns the full credential-bearing content, including a YAML serialization, without any explicit warning, confirmation gate, or redaction. In a migration-planning skill that is described as read-only inventory and assessment oriented, exposing live cluster access credentials materially exceeds expected scope and can enable unauthorized administrative access if the output is logged, displayed, or reused by another tool.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Binding an EIP to the cluster control plane enables public API exposure, but this function performs the action immediately with no confirmation prompt, no warning about Internet exposure, and no guardrails such as allowlisting or policy checks. That creates a meaningful risk of accidentally exposing the Kubernetes API server to a broader attack surface than intended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code can persist raw cluster inventory and metrics responses to disk when include_raw is enabled, including potentially sensitive operational metadata such as node details, pod names, namespaces, and scaling information. Writing this data without guardrails, minimization, or an explicit warning increases the risk of unintended local exposure, leakage through shared workspaces, backups, or artifact collection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file contains a function that scales a Kubernetes deployment by patching its replica count, which changes live cluster state. Although the overall skill is described as planning/diagnostic, this function performs an operational write without an in-function confirmation gate, dry-run mode, or prominent user-facing warning, increasing the risk of accidental production changes if exposed through the skill or CLI.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The wrapper for node pool expansion invokes infrastructure resizing, which can incur cost, alter capacity, and affect scheduling behavior. In the context of a migration planning/diagnosis skill, including a write-capable infrastructure action is dangerous because it breaks the expected read-only trust boundary and may be triggered unintentionally.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The subagent task generator constructs executable command strings that inline raw AK/SK credentials, which exposes secrets to logs, process listings, shell history, task UIs, and any downstream agent that can view or replay the command. In this skill's context, that is especially dangerous because the whole feature is explicitly designed to distribute tasks to subagents, multiplying the number of components and operators that may gain access to cloud credentials.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The generated subagent prompt explicitly includes the raw access key and secret key values in plain text, causing direct secret disclosure to any subagent, transcript, logger, or operator that can inspect the prompt. Because this skill coordinates multiple subagents and asks them to execute tasks, prompt-level credential leakage significantly expands the blast radius and makes credential exfiltration much easier.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The `list_cce_secrets` function can return Kubernetes Secret contents when `include_data=True`, exposing base64-encoded secret material directly to callers. In a migration-planning skill, this exceeds read-only inventory needs and can leak credentials, tokens, and keys into agent outputs, logs, transcripts, or downstream tools.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The create_node_pool function directly submits a remote infrastructure-modifying API request via client.create_node_pool(request) without any confirmation gate, dry-run mode, or explicit destructive-action warning in the interface. In an agent skill context, this increases the risk of unintended cloud resource creation, cost impact, configuration drift, and privilege misuse if a user prompt, tool chain, or upstream planner invokes the function accidentally or under prompt injection influence.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The function writes to a path taken directly from params["output_file"] with no validation, restriction, or explicit consent guard at the write site. In an agent/skill context, a user or upstream prompt can influence this path and cause arbitrary file creation or overwrite on the host filesystem, which can damage local state, clobber important files, or plant content in sensitive locations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The function writes report content to a caller-controlled output_file path with no path validation, sandboxing, or explicit consent boundary. In an agent setting, this can overwrite arbitrary files accessible to the process, including config, logs, or other workspace artifacts, turning a read-only planning skill into one with unintended filesystem side effects.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The dispatcher exposes bind/unbind operations for a cluster EIP without any confirmation gate, dry-run behavior, or user-facing warning at this layer. Because these are network-affecting changes that can immediately alter cluster reachability or public exposure, an upstream agent or caller could trigger disruptive state changes too easily.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Addon install and update are mutating cluster operations, yet the dispatcher forwards requests directly without any confirmation control in this file. In a skill advertised as migration planning and read-only inventory, this increases the risk of unintended remote changes, addon drift, outages, or privilege expansion via addon configuration.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: `start_ecs_instance` performs a real state-changing cloud action without any confirmation gate, dry-run mode, or explicit warning to the caller. In an agent skill intended primarily for migration planning and inventory, this expands the blast radius from read-only assessment into unintended operational control; a prompt injection, user misunderstanding, or tool misuse could start stopped instances and trigger service activation, cost, or change-management violations.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code explicitly disables TLS certificate verification for Kubernetes API access with configuration.verify_ssl = False. That allows man-in-the-middle interception or endpoint spoofing when retrieving cluster custom resources, which is especially dangerous because this function also acquires short-lived cluster client credentials and connects to administrative endpoints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The client certificate and private key are decoded and written to temporary files on disk. Although cleanup is attempted, secrets may remain exposed if the process crashes, files are readable by other local users, backups capture them, or deletion fails, making this a credential-handling weakness.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code performs an HTTPS request with certificate verification explicitly disabled via verify=False. This permits man-in-the-middle interception or tampering of the signed API request and response, undermining confidentiality and integrity even though the request uses AK/SK-based authentication.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function accepts cloud AK/SK credentials, enumerates broad Kubernetes and cloud resources, and can collect pod logs, events, ELB, security group, NAT, and ACL data into a returned snapshot/report without any built-in consent prompt, scope minimization, or redaction of most sensitive metadata. In a diagnostic skill, this creates a real risk of over-collection and unintended disclosure because callers may receive far more cluster and cloud context than necessary, including logs that can still contain secrets not matched by the limited masking patterns.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416