ClawHub
Back to skill

Security audit

Huawei Cloud Cce Metric Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is advertised as read-only metric analysis, but the packaged dispatcher also exposes undisclosed cloud and Kubernetes administration, deletion, remediation, and secret-reading capabilities.

Treat this as a review-required package, not a read-only metrics skill. Install or run it only with tightly scoped test credentials, and do not grant production cloud or Kubernetes write permissions unless the publisher removes or separates the admin, remediation, Secret-reading, and unsafe credential-handling code and updates the documentation to match the true callable surface.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/huawei_cloud/dispatcher.py:1470
Finding

Undeclared destructive and remediation actions exposed by a read-only metric Skill

Content
View full analysis

Vulnerability Details

File Location: scripts/huawei_cloud/dispatcher.py:183-269, 1470-1500, 1532-1535, 1601-1602; mutation sinks in scripts/huawei_cloud/cce.py:165-225, 431-495, 834-973, 1512-2143, 4230-4489
Vulnerability Type: Least-privilege violation and undeclared cloud-resource mutation
Risk Level: High

The Skill declares itself strictly read-only in SKILL.md:293-301, but its advertised dispatcher exposes operations that delete, resize, scale, drain, roll back, and otherwise modify Huawei Cloud and Kubernetes resources.

Vulnerable Code

scripts/huawei_cloud/dispatcher.py:183-219:

python
def _delete_cce_cluster(params: Dict[str, str]) -> Dict[str, Any]:
    return cce.delete_cce_cluster(params["region"], params["cluster_id"], params.get("confirm", "").lower() == "true", params.get("delete_evs", "").lower() == "true", params.get("delete_net", "").lower() == "true", params.get("delete_obs", "").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id"))


def _delete_cce_node(params: Dict[str, str]) -> Dict[str, Any]:
    return cce.delete_cce_node(params["region"], params["cluster_id"], params["node_id"], params.get("confirm", "").lower() == "true", params.get("scale_down", "true").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id"))


def _resize_cce_nodepool(params: Dict[str, str]) -> Dict[str, Any]:
    scale_group_names = None
    if params.get("scale_group_names"):
        scale_group_names = [name.strip() for name in params["scale_group_names"].split(",") if name.strip()]
    return cce.resize_node_pool(params["region"], params["cluster_id"], params["nodepool_id"], int(params["node_count"]), params.get("confirm", "").lower() == "true", scale_group_names, params.get("ak"), params.get("sk"), params.get("project_id"))

scripts/huawei_cloud/dispatcher.py:249-269:

python
def _scale_cce_workload(params: Dict[str, str]) -> Dict[st
...[truncated 5197 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove every mutation, deletion, remediation, rollback, scaling, drain, and alarm-management action from this Skill's dispatcher.
  2. Implement a dispatcher-level allowlist containing only the documented metric-query actions.
  3. Move remediation functionality into a separately named and separately distributed Skill.
  4. Give the metric Skill a dedicated IAM identity with read-only AOM, CES, and narrowly scoped CCE inventory permissions.
  5. Deny Kubernetes write verbs in the Skill's RBAC policy.
  6. For a separate write-capable Skill, require an out-of-band approval token bound to the exact action, resource, parameters, and expiration time.
  7. Update the documentation and permission table so they accurately describe the complete callable surface.
  8. Add automated tests that fail if any non-read-only handler is registered in the metric dispatcher.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/huawei_cloud/cce.py:3313
Finding

Dispatcher can return complete Kubernetes Secret contents across namespaces

Content
View full analysis

Vulnerability Details

File Location: scripts/huawei_cloud/dispatcher.py:307-308, 1514; scripts/huawei_cloud/cce.py:3313-3442
Vulnerability Type: Sensitive credential extraction beyond declared functionality
Risk Level: High

Vulnerable Code

scripts/huawei_cloud/dispatcher.py:307-308:

python
def _list_cce_secrets(params: Dict[str, str]) -> Dict[str, Any]:
    return cce.list_cce_secrets(params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id"))

scripts/huawei_cloud/dispatcher.py:1514:

python
"huawei_list_cce_secrets": (("region", "cluster_id"), _list_cce_secrets),

scripts/huawei_cloud/cce.py:3407-3423:

python
core_v1 = k8s_client.CoreV1Api()
if namespace:
    secrets = core_v1.list_namespaced_secret(namespace, limit=limit)
else:
    secrets = core_v1.list_secret_for_all_namespaces(limit=limit)

secret_list = []
for secret in secrets.items:
    secret_info = {
        "name": secret.metadata.name,
        "namespace": secret.metadata.namespace,
        "type": secret.type,
        "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None,
        "labels": secret.metadata.labels,
        "annotations": secret.metadata.annotations,
        "data_keys": list(secret.data.keys()) if secret.data else []
    }
    if include_data and secret.data:
        secret_info["data"] = secret.data
    secret_list.append(secret_info)

Technical Analysis

The dispatcher accepts include_data=true and forwards it directly to the Secret-listing implementation. When namespace is omitted, the code calls list_secret_for_all_namespaces, expanding the collection scope to the entire cluster.

Kubernetes Secret data is base64-encoded rather than encrypted. ...[truncated 1592 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove huawei_list_cce_secrets from the metric Skill's dispatcher.
  2. Deny Kubernetes get and list permissions for Secret resources in the Skill's RBAC policy.
  3. Never return secret.data from an Agent-facing action.
  4. If metadata inspection is operationally required, return only Secret names, types, and key names.
  5. Require an explicit namespace and enforce a configured namespace allowlist.
  6. Add centralized output redaction that blocks Secret values, private keys, tokens, and passwords.
  7. Ensure sensitive results cannot be written to reports, tracing systems, or model conversation history.
  8. Audit existing logs and retained Agent output for previously exposed Secret values, and rotate any affected credentials.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/huawei_cloud/cce.py:3358
Finding

Predictable temporary private-key files combined with disabled TLS verification

Content
View full analysis

Vulnerability Details

File Location: scripts/huawei_cloud/cce.py:3358-3402, 3426-3442
Vulnerability Type: Unsafe temporary credential storage and insecure TLS configuration
Risk Level: High

Similar race-prone tempfile.mktemp patterns also occur at scripts/huawei_cloud/cce.py:1161-1169 and scripts/huawei_cloud/cce_app_logs.py:334-344.

Vulnerable Code

scripts/huawei_cloud/cce.py:3358-3402:

python
# Configure Kubernetes client
configuration = k8s_client.Configuration()
configuration.host = external_cluster.get('cluster', {}).get('server')
configuration.verify_ssl = False

# Write certificates
user_data = None
for u in kubeconfig_data.get('users', []):
    if u.get('name') == 'user':
        user_data = u.get('user', {})
        break

if user_data and user_data.get('client_certificate_data'):
    cert_file = '/tmp/cce_secrets_client.crt'
    with open(cert_file, 'wb') as f:
        f.write(base64.b64decode(user_data['client_certificate_data']))
    configuration.cert_file = cert_file

if user_data and user_data.get('client_key_data'):
    key_file = '/tmp/cce_secrets_client.key'
    with open(key_file, 'wb') as f:
        f.write(base64.b64decode(user_data['client_key_data']))
    configuration.key_file = key_file

# Register temporary certificate files for later cleanup
_register_cert_file(cert_file)
_register_cert_file(key_file)

# Set default configuration
k8s_client.Configuration.set_default(configuration)

scripts/huawei_cloud/cce.py:3426-3442:

python
# Clean temporary certificate files
_safe_delete_file(cert_file)
_safe_delete_file(key_file)
return {
    "success": True,
    "region": region,
    "cluster_id": cluster_id,
    "action": "list_cce_secrets",
    "namespace": namespace or "all",
    "count": len(secret_list),
    "secrets": secret_list
}

except Exception as e:
    return {
        "success": False,
 
...[truncated 3157 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace fixed /tmp paths and every tempfile.mktemp call with atomic secure creation using tempfile.mkstemp or NamedTemporaryFile.
  2. Set private-key permissions explicitly to 0600.
  3. Use a unique temporary directory owned by the current process, with mode 0700.
  4. Initialize credential-file variables to None and remove them in a finally block on both success and failure.
  5. Avoid setting a process-global default Kubernetes configuration; instantiate an isolated ApiClient per request.
  6. Enable TLS verification and configure the cluster CA returned in the kubeconfig.
  7. Reject endpoints whose hostname or certificate does not match the expected CCE cluster endpoint.
  8. Prefer in-memory certificate handling where the Kubernetes client and TLS library support it.
  9. Apply the same remediation to cce.py, cce_app_logs.py, cce_k8s.py, lts.py, and all other duplicated certificate setup paths.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/huawei_get_node_security_groups.py:137
Finding

Out-of-scope helper accepts a Huawei Cloud account password through command-line arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/huawei_get_node_security_groups.py:5-11, 21-53, 137-169
Vulnerability Type: Plaintext credential exposure and defective authentication flow
Risk Level: Medium

Vulnerable Code

scripts/huawei_get_node_security_groups.py:5-11:

python
Usage:
    python3 huawei_get_node_security_groups.py --region cn-north-4 --node-ip 192.168.32.4 \
        --username YOUR_USERNAME --password YOUR_PASSWORD --domain-name YOUR_DOMAIN
        # Or
    python3 huawei_get_node_security_groups.py --region cn-north-4 --node-ip 192.168.32.4 \
        --ak YOUR_ACCESS_KEY --sk YOUR_SECRET_KEY --project-id YOUR_PROJECT_ID

scripts/huawei_get_node_security_groups.py:21-53:

python
def get_iam_token_by_password(region, username, password, domain_name):
    """Obtain an IAM token using username and password."""
    endpoint = f"iam.cn-north-4.myhuaweicloud.com"
    url = f"https://{endpoint}/v3/auth/tokens"

    body = {
        "auth": {
            "identity": {
                "methods": ["password"],
                "password": {
                    "user": {
                        "name": username,
                        "password": password,
                        "domain": {
                            "name": domain_name
                        }
                    }
                }
            },
            "scope": {
                "project": {
                    "name": region
                }
            }
        }
    }

    headers = {"Content-Type": "application/json"}

    try:
        response = requests.post(url, json=body, headers=headers, timeout=30)
        if response.status_code in [200, 201]:
            token = response.headers.get("X-Subject-Token")
            return token

scripts/huawei_get_node_security_groups.py:137-169:

python
parser.add_argument("--username", help
...[truncated 2932 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove this helper from the metric Skill because it is outside the declared execution path.
  2. Do not accept passwords, AKs, or SKs through command-line arguments.
  3. Use the official Huawei Cloud SDK with environment-based credentials, workload identity, or a dedicated secure credential provider.
  4. If password authentication is unavoidable, collect the password with getpass.getpass() and never log or echo it.
  5. Use the token returned by IAM rather than replacing it with "test".
  6. Remove the invalid behavior that treats an AK as an authentication token.
  7. Derive service endpoints from the validated region argument instead of hard-coding cn-north-4.
  8. Add tests that ensure credentials never appear in command examples, URLs, output, exception text, or request diagnostics.
  9. Advise users who executed this helper with plaintext command-line credentials to clear relevant history and rotate the exposed credentials.

T08 · Insecure Dependencies

Warning
Location
scripts/huawei_cloud/chart_generator.py:325
Finding

Generated HTML dashboards execute third-party CDN JavaScript without integrity protection

Content
View full analysis

Vulnerability Details

File Location: scripts/huawei_cloud/chart_generator.py:325-344; scripts/huawei_cloud/report_generator.py:353
Vulnerability Type: Unverified runtime dependency in generated reports
Risk Level: Medium

Vulnerable Code

scripts/huawei_cloud/chart_generator.py:338-344:

python
# Load JS
if inline_js:
    chart_js, adapter_js = _load_bundled_js()
    chart_tag = f'<script>{chart_js}</script>'
    adapter_tag = f'<script>{adapter_js}</script>'
else:
    chart_tag = '<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js"></script>'
    adapter_tag = '<script src="https://cdn.jsdelivr.net/npm/chartjs-adapter-date-fns@3.0.0/dist/chartjs-adapter-date-fns.bundle.min.js"></script>'

scripts/huawei_cloud/report_generator.py:353:

html
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.min.js"></script>

Technical Analysis

Although explicit package versions are used, the generated HTML loads executable JavaScript from a third-party CDN at report-viewing time. The tags do not include Subresource Integrity hashes or a restrictive Content Security Policy.

Operational metric data is embedded in the same HTML document. Any malicious code delivered through a compromised CDN response, compromised upstream package publication, or delivery-path failure can access the report DOM and embedded JavaScript values.

This finding concerns generated report execution, not Python-side remote payload execution. The audit did not find Python code that downloads these scripts and executes them locally.

Attack Path

  1. The Skill generates an HTML report using the non-inline JavaScript option or the affected report template.
  2. The report contains cluster metrics, workload identifiers, resource names, node addresses, or related operational data.
  3. A user opens the repo ...[truncated 828 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle reviewed JavaScript assets locally and make the offline, bundled mode mandatory.
  2. If CDN loading must remain available, add SHA-384 or SHA-512 Subresource Integrity hashes and crossorigin="anonymous".
  3. Add a restrictive Content Security Policy that permits scripts only from explicitly approved sources.
  4. Avoid embedding sensitive report data directly in executable JavaScript.
  5. Escape and serialize all chart labels and values safely before insertion into HTML or JavaScript.
  6. Document that generated reports can initiate network connections when remote assets are enabled.
  7. Add dependency review and hash-update procedures for every bundled or remotely referenced JavaScript release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (470)

Description-Behavior Mismatch

Critical
Category
Not specified by scanner
Confidence
99% confidence
Finding

This file massively exceeds the declared scope of a metric-analysis skill. In addition to read-only metrics or inventory, it implements destructive and administrative actions such as cluster deletion, node deletion, workload scaling/deletion, node drain/cordon, cluster hibernation, and control-plane EIP changes; this capability mismatch is dangerous because users or higher-level agents may invoke powerful operations under the false assumption that the skill is only for analytics.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file includes many state-changing operations—scaling, deletion, draining, hibernation, and public endpoint changes—despite being presented as an analytics capability. This mismatch is especially dangerous in agent settings because orchestration layers may auto-select the skill based on innocuous metric-related prompts and unknowingly expose powerful mutation primitives.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical
Category
Not specified by scanner
Confidence
100% confidence
Finding

The skill enumerates Kubernetes Secrets and can optionally return secret data, which is unrelated to metric analysis and directly exposes sensitive material such as API keys, tokens, passwords, and certificates. Because this is embedded in an analytics-branded skill, it creates a covert credential-access channel with low user suspicion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical
Category
Not specified by scanner
Confidence
99% confidence
Finding

The secret-listing function enumerates Kubernetes Secrets and can return secret contents when include_data=True, which directly exposes sensitive credentials, tokens, certificates, and application secrets. In a metric-analysis skill, this capability is unjustified and especially dangerous because users may invoke the skill expecting observability features, not credential access.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL-CN.md (reported line 1)May include surrounding context.

md
---
name: metric-analyzer
description: Use this skill to query and analyze metrics for CCE clusters and cloud resources, including Pod, Node, ECS, ELB, EIP, and NAT usage, plus threshold-based anomaly detection and status classification.
---

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Retrieving ECS instance details by IP and enumerating security groups/rules is security and network inspection, not metric analysis. The main danger is unintended exposure of infrastructure and security configuration under a misleadingly benign skill identity.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/huawei_cloud/storage.py:416