Huawei Cloud Cce Daily Cluster Inspector

• Outcome: Review
• Latest audit: Jun 16, 2026 · 8:16 PM UTC
• Version: 0.1.1

Overview

The skill is presented as a read-only daily CCE inspector, but its bundled dispatcher exposes cluster credentials, secret data, and multiple cloud or Kubernetes mutation actions.

Install only if you are comfortable treating this as a broad Huawei Cloud CCE administration toolkit, not just a read-only inspector. Use least-privilege IAM credentials, avoid passing AK/SK as parameters, do not use the subagent mode with real secrets, and review/disable mutating actions and raw report outputs before running it in production.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (71)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The function writes a generated remediation report to an arbitrary path supplied by `params["output_file"]` without validation, restriction, or an explicit safety disclosure. Because the report includes cluster identifiers, namespace/workload names, diagnostic summaries, and action results, an attacker or unsafe caller could cause sensitive operational data to be written to unintended locations, overwrite existing files, or persist data on shared disks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function writes a generated markdown report to an arbitrary user-supplied path via `Path(output_file)` and `write_text(...)` without validation, sandboxing, or an explicit warning. In an agent setting, this can enable unintended file overwrite or writing outside an expected workspace, especially if the caller can influence the path.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The function explicitly returns full kubeconfig material, including client certificate/key data and a YAML-rendered kubeconfig, to the caller. That grants direct cluster access and effectively exports credentials; in an agent skill advertised as read-only daily inspection, exposing reusable admin access is especially dangerous and inconsistent with least privilege.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The secret-listing function can optionally return secret.data contents when include_data=true, which exposes Kubernetes secret material directly to the caller. Secrets commonly contain passwords, tokens, private keys, and cloud credentials, so this enables straightforward credential theft and lateral movement.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Pod logs frequently contain credentials, tokens, personal data, stack traces, and internal service details, and this function returns them without any safety warning, filtering, or approval workflow. In an operations skill, unrestricted log exfiltration can leak sensitive application and infrastructure data beyond intended read-only health checks.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When include_raw is enabled, the code writes unfiltered raw API responses for clusters, nodes, nodepools, deployments, HPAs, metrics, and AOM discovery directly to disk. These artifacts can contain sensitive infrastructure metadata and workload details, and the function provides no sanitization, sensitivity filtering, or explicit user warning before persistence.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function enables record_history by default and automatically derives a history directory from output_dir, causing ongoing persistence of cluster scope, capacity stats, elasticity data, recommendations, notes, and file locations. Long-lived operational records increase exposure of sensitive environment metadata and can create an audit trail of internal infrastructure state without explicit operator acknowledgment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: get_cce_kubeconfig returns full kubeconfig material and a YAML serialization directly to the caller, which can include client certificates, tokens, endpoints, and current context sufficient for cluster access. In a skill advertised as 'daily inspection' and 'read-only only', exposing reusable access credentials without an explicit danger warning, tighter authorization gating, masking, or just-in-time scoped delivery materially increases the chance of credential leakage and unauthorized cluster administration.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: bind_cce_cluster_eip enables public exposure of the Kubernetes API by attaching an external EIP, but unlike destructive operations elsewhere in the file it has no confirmation gate or prominent security warning. This can unintentionally expand the cluster attack surface, especially in an operational inspection skill where users may expect low-risk read-only behavior and not anticipate network exposure changes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The action handler accepts raw cloud credentials (ak, sk, project_id) and performs broad cloud inventory and network-observability queries across CCE, ELB, NAT Gateway, and EIP resources without any explicit consent boundary, disclosure, or scope restriction at the user-facing entrypoint. In an agent setting, this can silently expand a seemingly routine 'cluster inspection' into enumeration of surrounding cloud/network assets, increasing the risk of unauthorized data exposure and over-collection when invoked on behalf of a user.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: When include_raw is enabled, the function writes full raw API responses for nodes, pods, deployments, HPAs, and metrics to disk. In a cluster-inspection skill, these files can contain sensitive infrastructure metadata and workload details, and the code provides no inline warning, consent gate, redaction, or retention control before persisting them.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The function writes summary and Markdown report artifacts to disk whenever output_dir is provided, without any user-facing disclosure in this file. Although less severe than raw-response dumping, these reports still expose cluster identifiers, namespace names, pod names, utilization data, and optimization recommendations that may be sensitive in operational environments.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The file is advertised as a read-only daily inspection tool, but it contains a `scale_workload` function that patches Kubernetes deployment replicas and therefore mutates cluster state. There is no in-function confirmation gate, safety banner, dry-run default, or clear separation from diagnostic-only paths, so an operator or downstream agent can trigger state-changing behavior unexpectedly.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The `huawei_expand_nodepool` wrapper exposes infrastructure-changing node pool resize functionality inside a skill described as low-risk and read-only. Although it forwards a `confirm` flag, this file provides no guaranteed user disclosure or hard enforcement that expansion is only available in a separate, explicitly destructive workflow.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The subagent task generator builds executable command strings that inline AK/SK directly into shell commands. This exposes cloud credentials to logs, terminal history, telemetry, copied task payloads, and downstream agents, creating a real secret-handling vulnerability rather than a mere usability issue.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The formatted subagent prompt includes AK/SK in natural-language output and command examples, encouraging operators or agents to copy, paste, transmit, and persist secrets in plaintext. Because prompts are often logged and shared across orchestration layers, this materially increases the chance of credential disclosure.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The list_cce_secrets function can return Kubernetes Secret contents when include_data=True, with no confirmation, redaction, scope restriction, or warning. In a read-only inspection skill, exposing secret material is still credential disclosure and could leak tokens, passwords, or certificates from the cluster to downstream users, logs, or other agents.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The create_node_pool function issues a real cloud write immediately after parameter validation, but unlike resize_node_pool and delete_node_pool it has no confirm gate, warning flow, or dry-run style response. In a skill advertised as 'daily inspection', 'quick health check', and 'read-only only', exposing a mutation primitive without explicit confirmation materially increases the risk of accidental or prompt-induced infrastructure changes and added billing.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code writes generated monitoring dashboards and diagnosis reports containing cluster metadata, pod names, node IPs, pod IPs, alarms, and root-cause details to predictable local HTML files under /tmp or a caller-supplied path, with no access-control checks, permission hardening, or user warning. In a shared host or multi-user environment, this can expose sensitive operational cloud data to other local users or to unintended collection by backup, logging, or artifact systems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The helper silently pulls cloud credentials from environment variables without any explicit user-facing disclosure or confirmation. In an agent/skill context, this can cause the tool to access sensitive secrets and operate against the user's cloud account unexpectedly, especially when invoked for a seemingly low-risk inspection task.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code automatically uses supplied credentials to make IAM API calls to enumerate project IDs for a region, but this side effect is not clearly disclosed. In a read-only inspection skill, undisclosed outbound calls expand the operational scope and may surprise users by using privileged credentials beyond the immediately requested action.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The function writes a detailed markdown report to an arbitrary user-supplied path via `output_file`, and that report includes cluster topology, pod names, IPs, service selectors, ingress hosts, and health status. In a read-only inspection skill, exporting this sensitive operational metadata to disk without guardrails can create an unintended data exposure channel, especially on shared runners or multi-tenant agent hosts.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The dispatcher exposes cluster EIP bind/unbind actions without any local safety gate such as an explicit confirm flag, warning banner, or read-only restriction. In a skill marketed for daily inspection and low-risk health checks, allowing network-affecting operations through the same dispatch surface increases the chance of accidental or unauthorized service disruption.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Kubeconfig retrieval yields cluster access credentials that can enable broad Kubernetes API access outside the platform boundary. Exposing this through a generic dispatcher with no visible warning, approval, or least-privilege control is sensitive credential access and can lead to cluster compromise if misused or leaked.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The secret-listing path allows include_data=true, which can return Kubernetes secret contents through an inspection dispatcher. Because this skill is presented as read-only health checking, surfacing raw secret material materially increases the risk of credential disclosure, lateral movement, and data exfiltration.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416