Huawei Cloud Cce Log Analyzer

• Outcome: Review
• Latest audit: Jun 16, 2026 · 8:17 PM UTC
• Version: 0.1.1

Overview

This appears to be a Huawei Cloud/Kubernetes operations skill, but it exposes cluster credentials, secrets, and state-changing cloud actions with insufficient guardrails.

Install only for controlled cloud-admin use. Use least-privilege Huawei Cloud and Kubernetes credentials, avoid enabling secret-data or kubeconfig export paths, review any file outputs before sharing logs or workspaces, and require explicit human approval before any action that changes cluster, network, node pool, workload, or ECS state.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (64)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function can return raw diagnostic content and write a generated report to an arbitrary caller-supplied path, and the report may include sensitive operational details such as pod names, namespaces, scheduling events, and snippets from Cluster Autoscaler logs. In a security-sensitive cloud/Kubernetes environment, exposing or persisting that data without explicit consent, redaction, or sensitivity labeling can leak internal infrastructure information and incident context to downstream users or systems.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The collection routine gathers broad cluster telemetry—including HPA objects, addons, node pools, pods, events, deployments, statefulsets, metrics, and Cluster Autoscaler pod logs—automatically when invoked. Even if the caller is authorized, collecting this scope without explicit disclosure or least-privilege scoping increases the risk of overcollection and unintended exposure of sensitive operational metadata.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: get_cce_kubeconfig returns a full kubeconfig object and YAML, which includes client certificate/key material or equivalent cluster access credentials. In an agent skill context, returning these credentials directly to the caller enables immediate cluster access, credential reuse, and lateral movement without any warning, masking, or explicit high-risk confirmation.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: list_cce_secrets can return Kubernetes Secret data when include_data=true, exposing sensitive application secrets, tokens, certificates, and credentials directly through the skill output. In a log/cluster-analysis skill, this materially increases the danger because users may invoke it for troubleshooting without realizing it can exfiltrate live secret material.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When include_raw is enabled, the function serializes the full Kubernetes inventory to availability-risk-raw-inventory.json, which can include cluster topology, workload metadata, labels, service mappings, ingress relationships, and pod placement details. Writing this sensitive operational data to disk without explicit runtime confirmation, sensitivity labeling, redaction, or restrictive file-permission handling increases the risk of unintended disclosure through shared workspaces, logs, backups, or later exfiltration.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This function writes summaries, HTML/Markdown reports, SVG charts, and optionally raw API responses to disk, including cluster identifiers, namespaces, autoscaling configuration, deployment/HPA details, and possibly raw service responses. In a log-analysis/cluster-operations skill, that data can be sensitive operational metadata, and persisting it without an explicit disclosure/consent gate increases the risk of unintended local data exposure, retention, or collection into other systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The history writer persistently stores capacity analysis records and appends them to a JSONL history file, creating an accumulating dataset of cluster state, recommendations, and file references over time. Even if intended for trend comparison, silent persistence increases exposure from local compromise, over-retention, multi-tenant hosts, or accidental exfiltration through backups and log collection.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This function returns full kubeconfig material, including client credentials or certificates that can grant direct administrative access to the cluster. In an agent skill context, returning such secrets as normal tool output is dangerous because they can be exposed to downstream model context, logs, transcripts, or other users without any explicit confirmation or sensitivity guard.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Binding a public EIP to the cluster control plane changes the attack surface by exposing the Kubernetes API server to the public internet. Because this action occurs without a confirmation gate or warning, an agent or user can unintentionally weaken network isolation and increase the chance of unauthorized access attempts against the control plane.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The action handler accepts raw access credentials and triggers broad cloud resource enumeration across pods, nodes, ELBs, NAT gateways, EIPs, and services without any user-facing disclosure, confirmation, or scoping guardrails. In an agent skill context, this can lead to unexpected collection and exposure of sensitive infrastructure metadata if invoked with high-privilege credentials, especially because the function aggregates and returns a large cross-resource inventory in one response.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The scale_workload function performs a state-changing Kubernetes operation by patching a Deployment's replica count, but the function itself has no built-in confirmation gate, dry-run mode, or user-facing warning. In an agent skill context, this is dangerous because a caller may invoke what appears to be a diagnostic tool and unexpectedly modify production capacity, causing outages, cost spikes, or incident escalation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code writes kubeconfig data, which can contain cluster API endpoints, certificates, and bearer credentials, to a predictable file under /tmp without setting restrictive permissions or deleting it afterward. In a multi-user or shared runtime, another local process could read or race on that file and gain cluster access.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The node diagnosis flow writes a list of abnormal node identifiers to a report file under /root/.openclaw/workspace/report without user disclosure or retention controls. While this is not direct credential leakage, it exposes internal infrastructure inventory and health information that could aid lateral movement or targeted attacks if the workspace is shared or later exfiltrated.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code decodes client certificate and private key material from the cluster credential response and writes them to temporary files on disk. Although cleanup is attempted in a finally block, secrets at rest on disk increase exposure through crash scenarios, other local processes, backups, forensic recovery, or insecure temp-directory handling, and there is no user-facing disclosure that credential material is being persisted.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The code constructs shell command strings that inline `ak` and `sk` directly into command text for subagent tasks. This exposes cloud credentials to logs, process lists, agent transcripts, shell history, and any downstream system that records or displays the generated command, creating a real secret disclosure risk rather than a purely cosmetic issue.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The function `list_cce_secrets` can return Kubernetes Secret `data` when `include_data=True`, exposing base64-encoded secret material directly to the caller with no warning, confirmation, masking, or scope restriction. In an agent skill context, this is especially dangerous because a prompt or tool invocation can exfiltrate credentials, tokens, certificates, or API keys from the cluster in a single call.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: `create_node_pool` directly performs a state-changing infrastructure operation after parameter validation, unlike the resize and delete functions which require an explicit `confirm` gate. In an agent skill context, this increases the risk of unintended or prompt-induced cloud resource creation, leading to billing impact, resource sprawl, and potentially expanded attack surface if node pools are created with weak or default operational settings.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The function writes report content to a caller-controlled output_file path without validation or restriction. If an attacker can influence params, this can overwrite arbitrary files accessible to the process, potentially clobbering configs, planting misleading artifacts, or writing sensitive analysis output into unsafe locations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The function writes report content to a caller-supplied filesystem path without any validation, restriction, or explicit safety guard. In an agent skill context, this can be abused to overwrite unintended files, write into sensitive locations, or persist cluster-derived metadata to disk without the operator realizing where it is being stored.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The dispatcher exposes bind/unbind cluster EIP operations without any dispatcher-level confirmation gate, warning, or dry-run behavior, unlike many other destructive or state-changing actions in this file that explicitly require a confirm flag. In an agent setting, this increases the chance of unintended public exposure or network disruption if the action is invoked automatically or from ambiguous user intent.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This action returns a CCE kubeconfig, which is sensitive access material that can grant cluster access and enable follow-on compromise depending on the permissions embedded in the generated config. The dispatcher applies no extra warning, confirmation, masking, or authorization checks, making credential exfiltration easier in an agent workflow.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The secret-listing action can include secret data when include_data=true, but the dispatcher provides no warning, confirmation, or restriction around returning highly sensitive Kubernetes secret contents. In an agent context, this is especially dangerous because secrets may be disclosed into logs, chat transcripts, downstream tools, or unauthorized outputs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The start_ecs_instance function triggers a real state-changing cloud action immediately and lacks the confirmation gate used by other dangerous operations in the same file, such as stop and reboot. In an agent skill context, this increases the chance of unintended VM power-on caused by prompt injection, ambiguous user requests, or tool misuse, leading to unexpected costs, operational changes, or activation of sensitive workloads.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code decodes Kubernetes client certificate and private key material from the cluster cert response and writes them to persistent temporary files on disk. Even though cleanup is attempted later, the files exist in plaintext during execution and may remain behind on crashes, abnormal termination, or be exposed to other local processes/users depending on filesystem permissions and environment.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Disabling Kubernetes TLS certificate verification allows man-in-the-middle interception of the connection to the cluster API server. An attacker positioned on the network could impersonate the API endpoint, capture client-authenticated requests, and manipulate or observe cluster resource data such as LogConfig objects.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416