T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/dispatcher.py:1469- Finding
Read-only migration Skill exposes destructive cloud operations
- Content
View full analysis
- Remediation
View remediation
Security audit
Huawei Cloud Cce Container Migration Planner
Security checks for vulnerabilities and agentic risk
Overview
The skill presents itself as read-only migration planning, but its packaged dispatcher can run live cloud and Kubernetes changes and can expose sensitive cluster data.
Install only after reviewing and removing or isolating the mutation actions, and run it with a least-privilege read-only Huawei IAM user and read-only Kubernetes RBAC. Do not use production credentials with write permissions, do not request Secret data, and prefer pinned dependencies with normal TLS verification enabled.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/huawei_cloud/network.py:765- Finding
TLS certificate verification disabled for signed NAT inventory requests
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/huawei_cloud/storage.py:400- Finding
TLS certificate verification disabled for signed SFS inventory requests
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:67- Finding
Unpinned third-party dependencies installed at runtime
- Content
View full analysis
= 3.6 installed - Required packages: `huaweicloudsdkcore`, `huaweicloudsdkcce`, `huaweicloudsdkvpc`, `huaweicloudsdkecs`, `huaweicloudsdkevs`, `huaweicloudsdkeip`, `huaweicloudsdkelb`, `huaweicloudsdkiam`, `kubernetes` - Verify: `python3 --version` - Install packages: `pip3 install huaweicloudsdkcore huaweicloudsdkcce huaweicloudsdkvpc huaweicloudsdkecs huaweicloudsdkevs huaweicloudsdkeip huaweicloudsdkelb huaweicloudsdkiam kubernetes` ``` ### Technical Analysis The documented mandatory installation command retrieves multiple packages without exact versions, lock-file resolution, or integrity hashes. As a result, the code installed and imported can vary over time. Python packages may execute code during installation and are subsequently imported into the same process that handles Huawei access keys, secret keys, project identifiers, Kubernetes client credentials, and cloud-resource data. A compromised upstream release, dependency takeover, dependency confusion caused by index configuration, or incompatible update could therefore affect the Skill without any change to the reviewed package. No specific malicious dependency was identified during this static audit. The finding concerns the unsafe installation process and lack of reproducible dependency verification. ### Attack Path 1. An operator follows the prerequisite command from `SKILL.md`. 2. `pip` resolves the latest package versions from its configured indexes. 3. An upstream package, transitive dependency, or higher-priority index serves a compromised release. 4. The package executes installation-time code or malicious code when imported by the dispatcher. 5. The malicious dependency runs with the local user’s privileges and can access credentials and network connectivity available to ...[truncated 676 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (463)
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is described as a read-only migration planning tool, but the file implements numerous state-changing operations including cluster deletion, node deletion, workload scaling/resizing/deletion, hibernation, EIP binding, and node cordon/drain actions. This capability mismatch is dangerous because an orchestrator or user may invoke the skill under the assumption that it is inventory-only, enabling destructive actions that can disrupt or destroy production environments.
- Content
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill enumerates Kubernetes Secrets and can optionally return secret data contents, which is not justified for migration planning and directly exposes credentials, tokens, keys, and other sensitive application material. This turns a planning/inventory skill into a credential-access mechanism and can enable lateral movement, data theft, and cluster or application compromise.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
configure_cce_hpa performs live cluster mutation by creating or replacing HorizontalPodAutoscaler resources, directly contradicting the skill's stated read-only migration-planning purpose. In a delegated agent environment this is a serious trust-boundary violation, because a caller selecting a planning skill could unknowingly trigger production autoscaling changes that affect availability, cost, and workload behavior.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The skill description promises read-only inventory and planning, but this code can execute remote state-changing operations such as immediate repair, manual repair, ignore, not_ignore, verify, and whitelist changes against HSS-managed vulnerabilities. This violates the user's expected safety boundary and can directly alter host security state or trigger remediation on production systems.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: container-migration-planner description: Use this skill for Huawei Cloud CCE migration planning, resource inventory, delivery方案, dependency mapping, and migration risk assessment without executing changes. ---
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Direct IAM authentication, ECS lookup by node IP, and per-node security-group inspection are more invasive and lower-level than a migration planner should imply. This expands credential handling and cloud-account visibility beyond the stated task, increasing both confidentiality and abuse risk.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/huawei_cloud/cce_nodepool.py:456
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/network.py:781
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/storage.py:416