ClawHub
Back to skill

Security audit

Huawei Cloud Cce Kubernetes Event Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is advertised as read-only event analysis, but its packaged command dispatcher exposes broader cloud, Kubernetes secret, credential, and mutation capabilities.

Treat this as a review-required skill. Install only after narrowing the dispatcher to the documented event actions or running it with tightly scoped read-only Huawei IAM and Kubernetes RBAC that cannot mutate resources or read Secret payloads; avoid broad AK/SK credentials and avoid using the shared huawei-cloud.py entry point for unreviewed actions.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/huawei_cloud/dispatcher.py:1443
Finding

Read-Only Event Skill Exposes Destructive Cloud and Kubernetes Operations

Content
View full analysis
Optional[Dict[str, Any]]: """Attempt modular dispatch first and fall back to legacy dispatch when needed.""" try: script_dir = os.path.dirname(os.path.abspath(__file__)) if script_dir not in sys.path: sys.path.insert(0, script_dir) from huawei_cloud.dispatcher import dispatch_action, is_registered_action except Exception as exc: return { "success": False, "error": "Modular dispatcher unavailable", "error_type": type(exc).__name__, } if not is_registered_action(action): return None return dispatch_action(action, params) ``` The same dispatcher registers destructive and unrelated actions: ```python ACTION_SPECS: Dict[str, tuple[tuple[str, ...], Handler]] = { "huawei_list_ecs": (("region",), _list_ecs), "huawei_get_ecs_metrics": (("region", "instance_id"), _get_ecs_metrics), "huawei_list_flavors": (("region",), _list_flavors), "huawei_stop_ecs_instance": (("region", "instance_id"), _stop_ecs_instance_action), "huawei_start_ecs_instance": (("region", "instance_id"), _start_ecs_instance_action), "huawei_list_cce_clusters": (("region",), _list_cce_clusters), "huawei_create_cce_cluster": ( ("region", "cluster_name", "vpc_id", "subnet_id"), _create_cce_cluster ), "huawei_delete_cce_cluster": ( ("region", "cluster_id"), _delete_cce_cluster ), "huawei_delete_cce_node": ( ("region", "clust ...[truncated 4102 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/huawei_cloud/dispatcher.py:307
Finding

Shared Dispatcher Allows Raw Kubernetes Secret Data Retrieval

Content
View full analysis
Dict[str, Any]: return cce.list_cce_secrets( params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id") ) ``` The corresponding implementation performs cluster-wide enumeration when no namespace is supplied and returns Secret data when requested: ```python core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secret.data.keys()) if secret.data else [] } if include_data and secret.data: secret_info["data"] = secret.data secret_list.append(secret_info) ``` The action is registered in the global action map: ```python "huawei_list_cce_secrets": ( ("region", "cluster_id"), _list_cce_secrets ), ``` ### Technical Analysis Kubernetes Secret values are Base64-encoded representations, not encrypted or safely redacted values ...[truncated 1625 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/huawei_cloud/cce.py:2395
Finding

Kubernetes API Server Certificate Verification Is Disabled

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/huawei_cloud/cce.py:2409
Finding

Predictable Temporary Client-Key Files May Leak or Survive Failed Requests

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (315)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL-CN.md (reported line 1)May include surrounding context.

md
---
name: kubernetes-event-analyzer
description: |
  华为云 CCE 集群 Kubernetes 事件查询与分析技能，覆盖 Warning 事件查询、重复事件模式识别、Pod/Node/Workload 异常检测、LTS 日志流事件历史查询，并自动移交至对应诊断技能。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
python3 scripts/huawei-cloud.py huawei_get_cce_events \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
python3 scripts/huawei-cloud.py huawei_get_cce_events \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
python3 scripts/huawei-cloud.py huawei_get_cce_events \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
python3 scripts/huawei-cloud.py huawei_get_cce_events \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md
python3 scripts/huawei-cloud.py huawei_get_cce_events \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

md
python3 scripts/huawei-cloud.py huawei_get_cce_events \

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module header claims the tool only queries Huawei Cloud resources and monitoring data, but the exported action aliases include destructive operations such as delete_cce_cluster, delete_cce_node, delete_cce_workload, resize_node_pool, and scale_cce_workload. This mismatch can mislead users, reviewers, or higher-level agents into invoking a skill with write/delete capability under the assumption it is read-only, increasing the chance of unauthorized or accidental destructive changes.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The selection logic explicitly prefers an 'external' cluster endpoint when present, which increases exposure by using a public-access path over an internal endpoint. In the context of a cloud administration skill, defaulting to externally reachable Kubernetes control planes broadens the attack surface and raises the likelihood that sensitive cluster access occurs over less restricted network paths.

Content

Scanner excerpt · scripts/huawei-cloud.py (reported line 131)May include surrounding context.

python
def _select_external_cluster(kubeconfig_data: Dict[str, Any]) -> Optional[Dict[str, Any]]:
    """Select the public cluster endpoint first, then fall back to the first cluster entry."""
    for cluster in kubeconfig_data.get('clusters', []):
        cluster_name = cluster.get('name', '')
        if 'external' in cluster_name and 'TLS' not in cluster_name:
            return cluster

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

Returning the full user object from kubeconfig can include client certificate data, client key data, or tokens, making sensitive credential material broadly available to downstream code. In an agent skill context, widening access to raw credential-bearing structures increases the chance of accidental disclosure, misuse, or insecure persistence elsewhere in the codebase.

Content

Scanner excerpt · scripts/huawei-cloud.py (reported line 142)May include surrounding context.

python
def _get_kubeconfig_user_data(kubeconfig_data: Dict[str, Any]) -> Dict[str, Any]:
    """Return the default kubeconfig user payload when present."""
    for user_entry in kubeconfig_data.get('users', []):
        if user_entry.get('name') == 'user':
            return user_entry.get('user', {})
    return {}

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The function explicitly writes client certificate and private key material derived from kubeconfig data to filesystem paths. Even though the comments claim temporary cleanup, persisting authentication material to disk creates a window for local disclosure through other processes, backups, crash artifacts, or improper permissions, especially in shared agent/runtime environments.

Content

Scanner excerpt · scripts/huawei-cloud.py (reported line 154)May include surrounding context.

python
cert_file_path: str,
    key_file_path: str,
) -> tuple[Optional[str], Optional[str]]:
    """Write client cert/key files from kubeconfig data and attach them to the Kubernetes config."""
    user_data = _get_kubeconfig_user_data(kubeconfig_data)
    cert_file = None
    key_file = None

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Exposing get_cce_kubeconfig through the skill's action compatibility layer makes retrieval of Kubernetes configuration—and potentially embedded access credentials—a first-class callable capability. In an agent skill, surfacing kubeconfig acquisition materially increases the sensitivity of the interface because callers may obtain cluster access material beyond simple monitoring data.

Content

Scanner excerpt · scripts/huawei-cloud.py (reported line 400)May include surrounding context.

python
"generate_inspection_html_report": _inspection_mod.generate_inspection_html_report,
        "generate_monitoring_chart": _common_mod.generate_monitoring_chart,
        "get_aom_prom_metrics_http": _aom_mod.get_aom_prom_metrics_http,
        "get_cce_kubeconfig": _cce_mod.get_cce_kubeconfig,
        "get_cce_addon_detail": _cce_mod.get_cce_addon_detail,
        "get_cce_node_metrics": _metrics_mod.get_cce_node_metrics,
        "get_cce_node_metrics_topN": _metrics_mod.get_cce_node_metrics_topN,

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

This location begins a function explicitly designed to retrieve kubeconfig credentials for a CCE cluster. Returning authentication material enables direct credential access and bypasses the intended mediation boundary of the skill.

Content

Scanner excerpt · scripts/huawei_cloud/cce.py (reported line 662)May include surrounding context.

python
"error_type": type(e).__name__
        }

def get_cce_kubeconfig(region: str, cluster_id: str, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None, duration: int = 30) -> Dict[str, Any]:
    """Get kubeconfig for a CCE cluster

    Args:

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The get_cce_kubeconfig function returns full kubeconfig material, including client credentials and cluster connection details, enabling direct out-of-band Kubernetes API access beyond the skill's mediated operations. That turns the skill into a credential-extraction mechanism rather than a bounded administration interface.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Sensitive kubeconfig content is returned directly with no explicit warning that it contains credentials granting cluster access. This increases the likelihood that callers mishandle, persist, or exfiltrate powerful authentication material.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill exposes a capability to enumerate Kubernetes Secrets and, when include_data=true, return their contents directly. Even if intended for administration, this materially expands access into highly sensitive credentials and tokens without any purpose limitation, redaction, confirmation gate, or warning to the caller.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The secret-listing function can optionally return secret data without any explicit warning to the user that the output may contain passwords, keys, or tokens. This creates a straightforward path to accidental or intentional credential exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Binding an EIP to the cluster control plane exposes the Kubernetes API publicly, significantly enlarging the attack surface. The function performs this network exposure change without any explicit confirmation or danger warning, unlike other destructive operations in the file.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The function actively requests Kubernetes cluster certificate material via create_kubernetes_cluster_cert, which is privileged credential acquisition logic. In this skill context, obtaining kubeconfig credentials is more sensitive because the same module can then enumerate and modify cluster logging resources; if abused or over-permitted, this expands access to cluster control-plane operations.

Content

Scanner excerpt · scripts/huawei_cloud/cce_app_logs.py (reported line 310)May include surrounding context.

python
body.duration = 1
    cert_request.body = body
    cert_response = cce_client.create_kubernetes_cluster_cert(cert_request)
    kubeconfig_data = cert_response.to_dict()

    external_cluster = None
    for cluster in kubeconfig_data.get("clusters", []):

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The function is explicitly designed to retrieve kubeconfig, which is sensitive access material for a Kubernetes cluster. In this skill context, returning that data through a general-purpose tool interface without additional safeguards can enable credential theft, unauthorized cluster administration, and follow-on compromise.

Content

Scanner excerpt · scripts/huawei_cloud/cce_cluster.py (reported line 246)May include surrounding context.

python
}


def get_cce_kubeconfig(region: str, cluster_id: str, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None, duration: int = 30) -> Dict[str, Any]:
    """Get kubeconfig for a CCE cluster

    Args:

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The docstring and function purpose indicate credential retrieval for cluster access. Even though documentation alone is not code execution, the surrounding implementation shows an intent to surface sensitive authentication material, which is dangerous in an automation skill if not tightly controlled.

Content

Scanner excerpt · scripts/huawei_cloud/cce_cluster.py (reported line 247)May include surrounding context.

python
def get_cce_kubeconfig(region: str, cluster_id: str, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None, duration: int = 30) -> Dict[str, Any]:
    """Get kubeconfig for a CCE cluster

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The function return contract states it provides kubeconfig content, signaling direct exposure of cluster credentials to the caller. In a skill ecosystem, that increases risk because tool outputs may be relayed, stored, or consumed by downstream components not intended to handle secrets.

Content

Scanner excerpt · scripts/huawei_cloud/cce_cluster.py (reported line 258)May include surrounding context.

python
duration: Certificate validity duration in days (default: 30)

    Returns:
        Dictionary with kubeconfig content
    """
    access_key, secret_key, proj_id = get_credentials_with_region(region, ak, sk, project_id)

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The successful result object is built specifically around the get_cce_kubeconfig action, indicating sensitive credential retrieval is a first-class tool capability. That capability is security-relevant because kubeconfig can provide direct administrative or operational access to the cluster.

Content

Scanner excerpt · scripts/huawei_cloud/cce_cluster.py (reported line 299)May include surrounding context.

python
"success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "get_cce_kubeconfig",
            "duration_days": duration,
        }

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The code stores the full response dictionary in result["kubeconfig"], directly embedding potentially sensitive authentication material in the returned object. This is dangerous because secrets may then propagate to logs, agent transcripts, caches, or other consumers beyond the intended operator.

Content

Scanner excerpt · scripts/huawei_cloud/cce_cluster.py (reported line 306)May include surrounding context.

python
if hasattr(response, 'to_dict'):
            resp_dict = response.to_dict()
            
            result["kubeconfig"] = resp_dict
            
            if 'clusters' in resp_dict:
                result["cluster_endpoints"] = []

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

Serializing the kubeconfig into YAML (result["kubeconfig_yaml"]) further amplifies exposure by creating an easily copyable secret blob. That makes accidental leakage through output display, transcript retention, or downstream processing even more likely.

Content

Scanner excerpt · scripts/huawei_cloud/cce_cluster.py (reported line 321)May include surrounding context.

python
result["current_context"] = resp_dict['current_context']
            
            import yaml
            result["kubeconfig_yaml"] = yaml.dump(resp_dict, default_flow_style=False, allow_unicode=True)
        
        return result

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/huawei_cloud/storage.py:416