Huawei Cloud Cce Metric Analyzer

• Outcome: Review
• Latest audit: Jun 16, 2026 · 8:25 PM UTC
• Version: 0.1.1

Overview

This skill presents itself as a read-only metrics analyzer, but its packaged dispatcher includes broad cluster administration, credential, secret, and mutation capabilities that are not disclosed in the skill description.

Install only after reviewing the bundled Python dispatcher, not just the metric-analyzer docs. Use a least-privilege Huawei IAM user limited to read-only metric APIs, avoid passing AK/SK as command parameters, do not invoke undeclared dispatcher actions, and treat any output files or kubeconfig/certificate material as sensitive credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (63)

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger phrases are broad enough to match ordinary monitoring or performance questions, which increases the chance that this skill is selected in contexts where it is not the safest or most appropriate tool. Given the documented access to cloud metrics, credentials, and a shared dispatcher with broader capabilities, over-broad triggering raises the risk of unnecessary data exposure or unintended tool execution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function writes a markdown report to `Path(output_file).write_text(...)` using a user-controlled path with no validation, path restriction, or additional confirmation. In an agent/tooling context, this can overwrite arbitrary files accessible to the process, including config, scripts, or sensitive workspace files, which creates integrity and potential follow-on execution risks.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill collects pod logs, events, deployments, and metrics, all of which can contain sensitive operational data such as service names, error details, internal topology, and occasionally secrets accidentally logged by workloads. In an agent setting, silently gathering this scope of cluster telemetry without explicit user disclosure or scope minimization increases the chance of over-collection and unintended exposure through downstream summaries, reports, or raw output.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The function returns a full kubeconfig, including client certificate/key material, directly to the caller and even serializes it to YAML. In this skill context, that grants cluster API access and can be reused outside the skill, so exposing it without a strong warning, scoping restriction, or safer alternative is a real credential-disclosure issue.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: When include_data=true, the function can return Kubernetes Secret contents to the caller without a clear danger prompt or additional authorization gate. In an agent skill, this materially increases the risk of credential exfiltration because secrets often contain tokens, passwords, and private keys.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: `install_cce_addon` performs a live remote modification of a CCE cluster by creating an addon instance, but it has no explicit confirmation gate, dry-run mode, or user-facing warning. In an agent skill context, this is dangerous because a prompt or orchestration mistake can cause unintended infrastructure changes, including deployment of monitoring/network components with cluster-wide effects.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: `update_cce_addon` updates an existing addon in place without any confirmation or safety interlock, which can alter cluster behavior, break compatibility, or disrupt workloads if the addon version or values are wrong. In a cloud agent setting, silent execution of remote updates materially increases the risk of accidental or prompt-induced infrastructure changes.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: `configure_cce_bursting_addon` patches live addon configuration for scheduling/network behavior and reuses existing values to submit an update, but it does so without requiring explicit approval. Because this can change subnet, network, proxy, and log-collection settings on a running cluster addon, an accidental or maliciously induced invocation could impact connectivity, scheduling, observability, and workload placement.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code writes client certificate and private key material derived from the cluster kubeconfig to temporary files on disk. Even though cleanup is attempted later, storing sensitive credentials in world-accessible or guessable temp paths increases exposure to local disclosure, race conditions, and forensic recovery if deletion fails.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When include_raw is enabled, the code writes full raw API responses for clusters, nodes, nodepools, deployments, HPAs, metrics, and AOM discovery directly to disk. In an infrastructure-monitoring skill, those responses can contain sensitive operational metadata and possibly identifiers or configuration details, so persisting them without minimization, redaction, or explicit consent increases the risk of unintended disclosure if the filesystem, logs, backups, or shared workspaces are accessible.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The history feature automatically writes analysis records and appends them to a JSONL history file whenever record_history is enabled, and history_dir may be derived from output_dir implicitly. Although less sensitive than full raw responses, these records still preserve cluster identifiers, capacity statistics, elasticity settings, recommendations, and file locations, creating a persistent operational trail that may be exposed to other users or retained longer than intended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: get_cce_kubeconfig returns full kubeconfig material, including cluster access details and likely client credentials/certificates, directly in the function result without any confirmation step, masking, or warning. In an agent skill context, this enables easy extraction and downstream misuse of administrative cluster access, making the impact greater than ordinary read-only metadata disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: bind_cce_cluster_eip changes the cluster control plane from private/internal access to public exposure without any explicit confirmation gate or risk warning. In an automation or agent setting, a single invocation can unintentionally expose the Kubernetes API server to the internet, increasing attack surface and the chance of brute-force, credential abuse, or misconfiguration-based compromise.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This action handler invokes credential-backed cloud and Kubernetes monitoring collection using AK/SK and project context, but the file provides no user-facing disclosure, consent check, or scope warning before querying cluster, ELB, NAT, and EIP data. In an agent skill context, that can lead to unintended sensitive inventory and operational metadata exposure when a user triggers the skill without understanding that broad cloud enumeration will occur.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When include_raw is enabled, the function writes full collected cluster API/metrics responses to disk under a caller-controlled output directory. Those raw responses can contain sensitive operational metadata about nodes, pods, namespaces, deployments, HPAs, and monitoring data, and this file provides no built-in warning, sanitization, permission hardening, or explicit consent gate before persisting them.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The file includes an operational function that scales a Kubernetes deployment and exposes it through the CLI without any in-function confirmation, dry-run default, or strong user-facing warning about cluster-state modification. In an agent skill context, this is dangerous because a diagnostic tool can unexpectedly perform write actions on production infrastructure, enabling accidental or unauthorized service disruption if invoked by automation or prompt confusion.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code writes kubeconfig material derived from cluster credentials to a predictable file in /tmp, which may be readable by other local users or processes depending on system configuration. Kubeconfig commonly contains bearer tokens, client certs, or endpoints that grant cluster access, so persisting it to disk without secure file permissions or cleanup materially increases credential exposure risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code builds subagent shell command strings that include raw `ak` and `sk` values directly on the command line. This exposes secrets to logs, process listings, agent transcripts, and any downstream tooling that records or echoes commands, making credential compromise highly likely in a multi-agent environment.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The prompt formatter injects plaintext access key and secret key material into human-readable instructions and the displayed execution command. Any user, subagent, logging layer, or prompt capture system can recover the secrets, which is especially dangerous because this skill is explicitly designed to fan out tasks to downstream agents.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function writes an HTML report to `/tmp` without explicit disclosure or permission gating. While report export is expected functionality, writing potentially sensitive infrastructure findings to a predictable local path can leak operational details to other local users or later processes on shared systems.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The function `list_cce_secrets` can return Kubernetes Secret contents when `include_data=True`, exposing base64-encoded secret material to callers without any safety guard, warning, or redaction. In an agent skill context, this is especially dangerous because secrets may be surfaced into logs, model context, downstream tools, or user-visible responses, causing credential and token disclosure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Client certificate and private key are decoded and written to predictable files under `/tmp`, which increases exposure to local file disclosure, race/symlink issues, and residual credential leakage if cleanup fails. These files represent live cluster access material, so temporary disk persistence meaningfully expands the attack surface.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The create_node_pool function performs a state-changing cloud operation immediately after parameter validation, unlike resize_node_pool and delete_node_pool which require an explicit confirm flag. In an agent skill context, this increases the risk of accidental or prompt-induced infrastructure creation, leading to unintended resource provisioning, billing impact, and environment drift.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function writes a detailed dependency-impact report to a caller-controlled path via `Path(output_file).write_text(...)` with no path restriction, consent prompt, or sanitization. Because the report contains cluster topology, pod names, service names, ingress hosts, node associations, and IP data, this can cause sensitive infrastructure data to be persisted to unintended locations or exfiltrated through writable shared paths.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This file exposes multiple destructive or state-changing infrastructure actions through the dispatcher, and some of them do not visibly enforce a confirmation gate at the dispatch layer before execution. In an agent skill context, that increases the risk of accidental or prompt-induced execution of disruptive operations such as creation, modification, rollback, cordon/drain, or other infrastructure changes with real production impact.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416