T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/dispatcher.py:1469- Finding
Read-Only Skill Exposes Reachable Destructive Cloud Administration Actions
- Content
View full analysis
- Remediation
View remediation
Security audit
Huawei Cloud Cce Daily Cluster Inspector
Security checks for vulnerabilities and agentic risk
Overview
The skill says it is read-only cluster inspection, but its packaged dispatcher exposes powerful cloud and Kubernetes administration actions.
Review this before installing as an admin-capable Huawei Cloud tool, not a read-only inspection skill. Use a tightly scoped read-only IAM/RBAC identity, do not pass AK/SK on command lines, avoid Secret/kubeconfig actions, and prefer a package that separates inspection from remediation or enforces a read-only action allowlist.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/cce.py:3313- Finding
Dispatcher Can Return Kubernetes Secret Payloads Across All Namespaces
- Content
View full analysis
Dict[str, Any]: return cce.list_cce_secrets( params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_da ...[truncated 2103 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/huawei_cloud/cce.py:3369- Finding
Temporary Kubernetes Private Keys Use Predictable Paths While TLS Verification Is Disabled
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/huawei_cloud/chart_generator.py:343- Finding
Generated HTML Reports Execute Third-Party CDN JavaScript Without Integrity Verification
- Content
View full analysis
' adapter_tag = '' ``` A separate report generator also loads Chart.js remotely: ```html ``` ### Technical Analysis The generated HTML is not self-contained. When an operator opens a report, the browser retrieves and executes JavaScript controlled by a third-party CDN and its upstream package distribution. The URLs pin package versions, which reduces accidental version drift, but the report does not use Subresource Integrity hashes. Consequently, the browser has no cryptographic assurance that the downloaded script is the exact artifact reviewed by the Skill author. A compromised CDN, account, package release, DNS path, or delivery infrastructure could replace the script after the Skill itself has been audited. This is particularly sensitive because operational reports can contain cluster names, resource identifiers, event messages, topology, metrics, and vulnerability information. ### Attack Path 1. An attacker compromises the CDN delivery path, the upstream package artifact, or associated publishing credentials. 2. The operator generates an inspection report using this Skill. 3. The operator opens the generated HTML while network access is available. 4. The browser downloads and executes the altered third-party JavaScript. 5. The malicious script reads report contents from the document. 6. Subje ...[truncated 714 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (434)
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file contains multiple remote state-changing operations such as creating, updating, enabling, disabling, and deleting AOM alarm and action rules, even though the skill is described as a read-only daily cluster inspection tool. The confirm=true guard reduces accidental execution, but it does not remove the dangerous capability mismatch: any caller that can invoke the skill can still mutate monitoring configuration and suppress or alter alerting.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is described as a read-only, low-risk daily inspection tool, but this file exposes numerous mutation and destructive operations including deleting clusters/nodes/workloads, scaling workloads, draining nodes, hibernating clusters, and binding/unbinding control-plane EIPs. This is dangerous because an agent or user selecting the skill based on its manifest could be socially engineered into invoking powerful write operations that cause outage, data loss, or public exposure.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill manifest says this skill is for daily inspection and explicitly read-only, but the module exposes destructive and state-changing operations including cluster deletion, hibernation/awakening, EIP binding/unbinding, and cluster creation. This violates the declared trust boundary of the skill and could let a user or downstream agent invoke powerful infrastructure mutations under the guise of a low-risk inspection tool.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file materially violates the declared skill boundary of 'read-only' daily inspection by exposing destructive node-management operations including delete, cordon, uncordon, drain, and create. In an agent setting, this capability mismatch is dangerous because a caller expecting a safe inspection skill could be induced to perform production-impacting actions, leading to outage, workload eviction, or unauthorized infrastructure changes.
- Content
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The dispatcher registers a very large set of state-changing actions including cluster/node deletion, workload scaling, hibernation, addon install/uninstall, alarm-rule mutation, remediation, reboot/start/stop, and infrastructure binding operations. That directly contradicts the skill’s stated purpose of low-risk, read-only daily inspection, so a caller expecting safe inspection could instead invoke destructive or privilege-expanding operations through the same skill surface.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: daily-cluster-inspector description: Use this skill for daily Huawei Cloud CCE health checks, quick checks, cluster inspections, heartbeat summaries, and continuous operations reports. ---
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a low-risk, read-only inspection tool, yet the analyzed behavior indicates access to destructive and mutating operations across CCE, Kubernetes, alarms, addons, node pools, workloads, and surrounding cloud infrastructure. This mismatch is dangerous because operators and higher-level agents may grant trust or invoke the skill under the assumption that it cannot change state, when in fact it may delete resources, scale workloads, expose control planes, or return access material.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/huawei_cloud/cce_nodepool.py:456
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/network.py:781
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/storage.py:416