Security audit

Huawei Cloud Cce Log Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This log-analysis skill should be reviewed carefully because it includes reachable cloud and Kubernetes administration functions far beyond the documented logging purpose.

Install only in a tightly controlled environment after replacing the shared dispatcher with a skill-specific allowlist for the documented log tools. Use a dedicated least-privilege Huawei Cloud identity that cannot read Kubernetes Secrets or mutate infrastructure, and treat the TLS and temporary credential-file handling as issues to fix before production use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/dispatcher.py:1443
Finding: Shared Dispatcher Exposes Administrative Operations Beyond the Declared Log-Analysis Scope
Content: View full analysis
Optional[Dict[str, Any]]: """Attempt modular dispatch first and fall back to legacy dispatch when needed.""" try: script_dir = os.path.dirname(os.path.abspath(__file__)) if script_dir not in sys.path: sys.path.insert(0, script_dir) from huawei_cloud.dispatcher import dispatch_action, is_registered_action except Exception as exc: return { "success": False, "error": "Modular dispatcher unavailable", "error_type": type(exc).__name__, } if not is_registered_action(action): return None return dispatch_action(action, params) ``` ```python # scripts/huawei_cloud/dispatcher.py:1469-1500 "huawei_create_cce_cluster": ( ("region", "cluster_name", "vpc_id", "subnet_id"), _create_cce_cluster ), "huawei_delete_cce_cluster": ( ("region", "cluster_id"), _delete_cce_cluster ), "huawei_delete_cce_node": ( ("region", "cluster_id", "node_id"), _delete_cce_node ), "huawei_scale_cce_workload": ( ("region", "cluster_id", "workload_type", "name", "namespace", "replicas"), _scale_cce_workload ), "huawei_resize_cce_workload": ( ("region", "cluster_id", "workload_type", "name", "namespace"), _resize_cce_workload ), "huawei_delete_cce_workload": ( ("region", "cluster_id", "workload_type", "name", "namespace"), _delete_cce_workload ), ``` ```python # scripts/huawei_cloud/dispatcher.py:1595-1608 "huawei_cce_node_cordon": ( ("region", "cluster_id", "node_name"), _cce_node_cordon ), "huawei_cce_node_uncordon": ( ("region", "cluster ...[truncated 2404 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/dispatcher.py:1231
Finding: Infrastructure Creation and Add-On Mutation Actions Lack Confirmation Controls
Content: View full analysis
Dict[str, Any]: return cce_cluster.create_cce_cluster( region=params["region"], cluster_name=params["cluster_name"], vpc_id=params["vpc_id"], subnet_id=params["subnet_id"], cluster_version=params.get("cluster_version"), cluster_type=params.get("cluster_type", "VirtualMachine"), container_network_type=params.get("container_network_type", "overlay_l2"), container_network_cidr=params.get("container_network_cidr"), service_network_cidr=params.get("service_network_cidr"), flavor_id=params.get("flavor_id"), description=params.get("description"), ak=params.get("ak"), sk=params.get("sk"), project_id=params.get("project_id"), ) def _create_cce_nodepool(params: Dict[str, str]) -> Dict[str, Any]: data_volumes = _parse_json_param(params.get("data_volumes")) autoscaling_enabled = params.get("autoscaling_enabled", "false").lower() == "true" return cce_nodepool.create_node_pool( region=params["region"], cluster_id=params["cluster_id"], nodepool_name=params["nodepool_name"], flavor=params["flavor"], availability_zone=params["availability_zone"], root_volume_size=int(params["root_volume_size"]), root_volume_type=params["root_volume_type"], initial_node_count=_to_int(params.get("initial_node_count"), 1), os_type=params.get("os_type", "EulerOS"), ssh_key=params.get("ssh_key"), data_volumes=data_volumes, subnet_id=params.get("subnet_id"), autoscaling_enabled=autoscaling_enabled, min_node_count=_to_int(params.get("min_node_count"), 0) if autoscaling_enabled el ...[truncated 3032 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/cce.py:3313
Finding: Dispatcher Can Return Kubernetes Secret Payloads Across Namespaces
Content: View full analysis
Dict[str, Any]: return cce.list_cce_secrets( params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id") ) ``` ```python # scripts/huawei_cloud/cce.py:3313-3423 def list_cce_secrets( region: str, cluster_id: str, namespace: Optional[str] = None, limit: int = 100, include_data: bool = False, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None ) -> Dict[str, Any]: access_key, secret_key, proj_id = get_credentials(ak, sk, project_id) if not access_key or not secret_key: return { "success": False, "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK " "environment variables or pass as parameters." } try: cce_client = create_cce_client( region, access_key, secret_key, proj_id ) cert_request = CreateKubernetesClusterCertRequest() cert_request.cluster_id = cluster_id body = ClusterCertDuration() body.duration = 1 cert_request.body = body cert_response = cce_client.create_kubernetes_cluster_cert(cert_request) kubeconfig_data = cert_response.to_dict() # Kubernetes client configuration omitted here for clarity. core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret( nam ...[truncated 2939 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce.py:3387
Finding: Predictable Temporary Files Store Kubernetes Client Private Keys
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/network.py:650
Finding: TLS Certificate Verification Is Disabled for Authenticated Cloud and Kubernetes Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/huawei_get_node_security_groups.py:136
Finding: Standalone Utility Accepts Passwords and Access Keys Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (446)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The list_cce_secrets function enumerates Kubernetes Secrets and, when include_data=True, returns full secret contents. In a skill advertised for log analysis, this is unjustified credential/material access and can directly expose passwords, tokens, certificates, and other high-value secrets to callers or prompt-injected workflows.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The skill can enumerate Kubernetes Secrets and, when include_data is enabled, return secret contents directly. In the context of a log analyzer, this is unjustified high-risk credential and token access that could expose API keys, passwords, certificates, or service-account material to an untrusted prompt flow or over-privileged user.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code can stop, start, and reboot ECS virtual machines, which are high-impact state-changing actions unrelated to a log-analysis workflow. In the context of an agent skill advertised for logs, these operations create a hidden destructive capability that could be triggered by prompt injection, operator confusion, or misuse to cause outages and data loss.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL-CN.md (reported line 1)May include surrounding context.
md
--- name: log-analyzer description: Use this skill to query and analyze Kubernetes Pod stdout logs, CCE LogConfig-collected application logs, and Huawei Cloud LTS logs. ---

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated TP4 findings consistently indicate that the skill's declared purpose is narrow log analysis, while the underlying capability surface appears to include broad cloud administration, Kubernetes enumeration, credential access, infrastructure mutation, remediation, and reporting behaviors. This mismatch is dangerous because operators may invoke the skill under a low-risk mental model while it can actually access secrets, alter workloads, or modify cloud resources far outside expected scope.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416