Huawei Cloud Cce Kubernetes Event Analyzer

• Outcome: Review
• Latest audit: Jun 16, 2026 · 8:22 PM UTC
• Version: 0.1.1

Overview

The published skill presents itself as a read-only Kubernetes event analyzer, but the bundled callable scripts expose broad Huawei Cloud and Kubernetes administration actions beyond that purpose.

Review this skill before installing. Treat it as a broad Huawei Cloud CCE administration toolkit, not just an event analyzer. Only use it with tightly scoped IAM/RBAC credentials, avoid enabling secret or raw-log output unless necessary, inspect local report paths, and require manual approval before any scaling, deletion, node, addon, ECS, HPA, or public EIP action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (99)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file declares a hard security requirement that credentials and certificates must never be written to disk, yet `_configure_k8s_client_certificate_files` decodes kubeconfig certificate and private key material and writes both to filesystem paths. Even if intended as temporary files, this creates a real exposure window via local compromise, insecure temp directory permissions, crash paths, or incomplete cleanup, and directly violates the stated control boundary.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The auto-remediation path enables `include_logs` by default, causing workload logs to be collected during diagnosis before the user has explicitly consented. Logs commonly contain secrets, tokens, internal URLs, stack traces, or customer data, so default collection expands data exposure beyond what is necessary for deciding whether a rollback is appropriate.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill exposes a direct capability to enumerate Kubernetes Secrets and, when include_data is enabled, return their contents to the caller. Secrets routinely contain credentials, tokens, certificates, and API keys; exposing them without a narrowly scoped operational purpose or extra authorization/confirmation materially increases credential-theft risk.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The tool claims it only aggregates EIP metrics associated with ELB and NAT gateways, but `_get_eip_metrics` enumerates all EIPs in the project and fetches metrics for each. In a cloud-monitoring skill, this scope mismatch can expose unrelated network asset metadata and telemetry beyond the user's likely cluster-focused intent, creating an over-collection and information disclosure risk.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The docstring states ELB metrics are associated with LoadBalancer services, but `_get_elb_metrics` first lists all ELBs in the region and retrieves metrics for each before optionally correlating them to Kubernetes services. This broad regional enumeration can disclose information about unrelated load balancers and expands access beyond the expected cluster-specific monitoring boundary.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The module is presented as a diagnosis utility, but it also contains state-changing operations such as scaling workloads and expanding node pools. This mismatch is dangerous because users or higher-level agents may grant it diagnostic permissions or invoke it expecting read-only behavior, while it can actually alter production cluster capacity and availability.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file includes workload scaling despite being framed as a diagnosis tool. In an agentic or automation context, this expands the tool from observation to modification, creating risk of unintended service disruption, cost changes, or abuse if the skill is invoked under weaker trust assumptions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Node-pool expansion is a privileged infrastructure mutation that is not consistent with the documented diagnostic purpose of the skill. This can directly increase cloud spend and alter cluster behavior, making the mismatch particularly risky in automated environments where operators expect read-only diagnostics.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The `list_cce_secrets` function enables enumeration of Kubernetes Secrets across all namespaces and, when `include_data=True`, returns the secret contents directly. In a broadly callable agent skill, this creates a clear data-exfiltration path for credentials, tokens, certificates, and other sensitive material with no evident access scoping or purpose limitation in the module itself.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The `list_cce_configmaps` function can return arbitrary ConfigMap contents when `include_data=True`, including cluster-wide if no namespace is specified. While ConfigMaps are not always secrets, they often contain internal configuration, service endpoints, feature flags, and sometimes mistakenly stored credentials, making this an unnecessary exfiltration surface in a generic skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill writes report content to a caller-controlled local path via `Path(output_file).write_text(...)` with no path restriction, sandboxing, or explicit confirmation. In an agent environment, that expands a read/analysis capability into arbitrary filesystem write access, which can overwrite user files, poison configs, or drop content in sensitive locations if an attacker can influence `output_file`.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The stop function creates a stop request with the intended target server, then overwrites body.os_stop with a new BatchStopServersOption containing only the stop type and no server list. This can cause the request to behave unpredictably or fail open/incorrectly, creating a dangerous mismatch between the user's selected instance and the actual API payload for a state-changing operation.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: This file is presented as an LTS log-query utility, but it also provisions Kubernetes cluster client access and enumerates custom resources from CCE. Expanding from log reads into cluster credential retrieval and API enumeration increases privilege scope and attack surface, making accidental misuse or abuse more likely in an agent skill context.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The function claims to retrieve LogConfig CRs, but the implementation disables TLS verification for the Kubernetes API connection. That creates a hidden trust downgrade: callers expecting routine read-only metadata access may unknowingly connect insecurely and expose cluster credentials or responses to interception.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The function claims an SDK-style implementation but instead performs a custom-signed raw HTTPS request and disables TLS certificate verification. This is dangerous because custom auth/signing logic is easier to get wrong than vetted SDK behavior, and the disabled certificate validation enables man-in-the-middle interception of cloud API traffic, including metadata and responses about network infrastructure.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The code performs a signed HTTPS request with TLS certificate verification explicitly disabled via verify=False. This allows a man-in-the-middle attacker to intercept or modify the response and observe credential-derived authorization material in transit, defeating the security assumptions of HTTPS.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The script advertises AK/SK authentication but does not implement a real Huawei Cloud AK/SK signing flow. Instead, it assigns the access key to a local token variable and later performs the ECS lookup with a hardcoded "test" token, so authentication behavior is broken and misleading. This is dangerous because operators may believe they are using a secure supported auth path when the script is actually unauthenticated or malfunctioning, leading to bad security assumptions and potential credential misuse.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The script claims to obtain IAM tokens via password authentication, but the main ECS query ignores the acquired token and always calls get_ecs_by_ip with the hardcoded value "test". That means the primary security-sensitive operation does not use the authenticated context at all, creating a deceptive and unsafe implementation. In a cloud administration script, misleading auth behavior is especially dangerous because users may trust the output or operational model despite the script not enforcing real authentication.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function can collect sensitive cluster diagnostics, including pod logs, events, workload details, and optionally raw collected data, and then write a generated report to an arbitrary filesystem path without any warning, consent gate, redaction step, or output restriction. In this skill context, the data is operationally sensitive rather than inherently public, so silent persistence increases the risk of credential leakage, internal topology disclosure, and long-term exposure through local files, backups, or shared workspaces.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: get_cce_kubeconfig returns the full kubeconfig and client certificate material directly to the caller, effectively handing out cluster access credentials. Anyone receiving this output can authenticate to the cluster for the certificate lifetime, so accidental disclosure, logging, or prompt leakage becomes credential compromise.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: When include_data is enabled, the skill returns Kubernetes Secret contents without any user-facing warning about the sensitivity of the response. This can expose passwords, tokens, private keys, and service credentials through normal tool output channels that may be logged or shared.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Binding a public EIP to the cluster control plane exposes the Kubernetes API server to the public internet, but the function performs this action without an explicit confirmation gate or warning. This increases the attack surface significantly and can turn a previously internal management plane into an internet-reachable target.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code decodes client certificate and private key material from the cluster kubeconfig and writes them to temporary files on disk. Even though cleanup is attempted, using tempfile.mktemp and persisting sensitive key material unencrypted on the filesystem creates exposure to local disclosure, race conditions, and recovery from leftover temp files if deletion fails.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The audit log query returns parsed events including raw audit records, usernames, source IPs, request URIs, user agents, and other sensitive metadata directly to the caller. In an agent skill context, this broad data exposure is risky because downstream users or tools may retrieve sensitive operational and identity information without any minimization, warning, or access-control check in this layer.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When include_raw is enabled, the function writes unredacted raw API responses for clusters, nodes, node pools, deployments, HPAs, metrics, and AOM discovery directly to disk. Those payloads can contain sensitive infrastructure metadata and operational details, and the code provides no sanitization, redaction, or safety gating beyond the caller-supplied flag, increasing the risk of unintended local disclosure if the output directory is shared, backed up, or exposed.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416