Huawei Cloud Cce Network Failure Diagnoser

• Outcome: Review
• Latest audit: Jun 16, 2026 · 10:12 AM UTC
• Version: 0.1.1

Overview

This appears to be a Huawei Cloud CCE diagnosis skill, but its bundled dispatcher exposes powerful cluster administration and sensitive-data actions beyond the advertised read-only network troubleshooting purpose.

Install only if you are comfortable reviewing and restricting the bundled dispatcher, not just the documented diagnosis actions. Use least-privilege read-only Huawei Cloud and Kubernetes credentials, avoid passing AK/SK on the command line, disable or tightly control log/secret/kubeconfig-returning actions, and do not run mutating actions unless you intentionally audited and approved them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (81)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger list includes broad terms such as VPC, subnet, and security group that may activate the skill outside a clear network-failure diagnostic context. Because the skill can execute scripts, consume cloud credentials, and perform wide-scope read operations, overbroad invocation increases the chance of unintended data access, unnecessary credential use, or misrouting users into a higher-privilege workflow.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document explicitly states the skill can obtain kubeconfig and access cluster metadata and logs, but it frames the permissions as harmless 'read-only' access without warning that kubeconfig and logs may expose secrets, topology, service endpoints, and sensitive operational details. In a diagnostic skill, this omission can lead users to grant broader access than they realize, increasing the chance of unintended data exposure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code decodes client_certificate_data and client_key_data from kubeconfig and writes them to filesystem paths before attaching them to the Kubernetes client. Even though the file includes cleanup helpers, writing private key material to disk increases exposure through race conditions, permissive temp-directory access, crashes before cleanup, backup/forensics capture, or reuse of caller-controlled paths.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The remediation entry point enables log collection by default via `include_logs=_to_bool(params.get("include_logs"), True)`, and the resulting diagnosis object is returned to the caller and embedded in reports. Logs frequently contain secrets, tokens, internal endpoints, customer data, or stack traces, so collecting them without explicit user opt-in creates a real data-exposure risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code collects potentially sensitive operational data including pod logs, events, metrics, deployment details, and node information, and can optionally return the full raw dataset to callers. In a diagnostic skill context this may expose cluster internals, workload names, error messages, and log content without any explicit consent, minimization, or redaction controls, increasing the risk of unintended data disclosure.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: When output_file is provided, the generated markdown report is written to disk without any warning, classification, or protection, and the report can contain sensitive cluster evidence and diagnostic conclusions. This creates a local persistence channel for operationally sensitive data that may later be read by unauthorized users or included in backups/log shipping.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The get_cce_kubeconfig function returns full kubeconfig material, including client certificate/key data and generated YAML, directly to the caller with no additional sensitivity warning, masking, or access control. Because kubeconfig grants authenticated cluster access, exposing it through a diagnostic skill materially increases the chance of credential leakage via chat history, logs, downstream tooling, or unintended users.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The list_cce_secrets function can return secret.data verbatim when include_data=true, with no warning, approval gate, or redaction. Kubernetes Secret objects commonly contain passwords, tokens, API keys, and certificates, so this creates a direct secret-exfiltration path through the skill interface.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function performs a live remote cluster-changing operation by calling create_addon_instance without any in-function safety interlock, dry-run mode, or explicit user confirmation. In an agent skill context, this is dangerous because a natural-language request or misrouting could cause unintended installation of software into a production cluster, changing runtime behavior and potentially affecting availability or security posture.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This function updates an existing addon in a live cluster via update_addon_instance with no confirmation gate, despite modifying active configuration and possibly changing addon version and values. In this skill's infrastructure-management context, unintended updates can disrupt networking, observability, or cluster services, making accidental or prompt-induced execution materially risky.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The bursting addon reconfiguration path reads current state, derives network parameters, and then pushes a live addon update that alters subnet, network, VPC-related, and scheduling settings without any confirmation barrier. Because this skill is specifically for diagnosing network failures, the surrounding context makes this more dangerous: a troubleshooting workflow could silently become a production network reconfiguration, potentially causing outages, traffic misrouting, or policy violations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code decodes client certificate and private key material from the generated kubeconfig and writes both to temporary files on disk. Because it uses tempfile.mktemp() and disables TLS verification elsewhere in the same flow, this increases exposure of sensitive cluster-access credentials to local users, races/symlink attacks, or accidental leakage via filesystem inspection and diagnostics.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The scanner can persist detailed cluster assessment results to an arbitrary output directory, and when include_raw is enabled it writes full raw Kubernetes inventory including nodes, pods, labels, annotations, services, ingresses, and cluster metadata. In a diagnostic skill context this data is operationally sensitive, and writing it to disk without explicit consent, minimization, or protective controls increases the risk of unintended disclosure to other users, processes, backups, or logs on the host.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When include_raw is enabled, the function writes raw cloud service responses for clusters, nodes, nodepools, deployments, HPAs, metrics, and AOM discovery directly to disk. These responses can contain sensitive infrastructure metadata and operational details, and the file provides no consent gate, sanitization, redaction, or storage protection guidance, creating a data exposure risk if the output directory is shared, backed up, or readable by other users/processes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill records history to disk by default via record_history=True and automatically derives a history directory from output_dir, causing diagnostic and capacity data to persist without an explicit approval step. Persistent records can reveal cluster identifiers, utilization trends, autoscaling settings, and recommendation history over time, increasing exposure if the host is multi-tenant or logs/artifacts are later exfiltrated.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function retrieves and returns full kubeconfig material, including cluster access credentials/certificates, directly in the response without any confirmation gate, warning, or output minimization. In an agent skill context, this is dangerous because the agent may surface or log the kubeconfig, enabling unauthorized cluster access if exposed to users, transcripts, telemetry, or downstream tools.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Binding an EIP exposes the Kubernetes API server publicly, but this operation has no explicit confirmation step or security warning. In a diagnostic skill, making the control plane internet-reachable can materially increase attack surface and may be triggered too casually by an agent or user without understanding the exposure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The optional raw-output path writes detailed cluster inventory and metric responses to disk, which can include sensitive operational data such as node IPs, pod names, namespaces, utilization patterns, and possibly API error details. In an agent skill context, persisting this data without an explicit warning, redaction, or restrictive file-permission handling increases the risk of unintended local disclosure or later exfiltration from shared workspaces.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The `scale_workload` function performs a live state-changing operation against the Kubernetes API by patching a deployment's replica count. In a diagnostic skill, this is dangerous because it mixes observation with mutation and has no built-in confirmation, safety gate, dry-run mode, authorization check, or prominent user-facing warning, so an agent or caller could trigger production changes unintentionally.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `huawei_expand_nodepool` helper directly exposes node pool resizing, which can provision or deprovision infrastructure and incur cost or availability impact. Although it forwards a `confirm` parameter, this file itself presents the action as part of the same diagnosis toolchain and CLI surface, making accidental or agent-driven infrastructure mutation more likely without strong disclosure or workflow separation.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code constructs subagent task command strings that inline the Huawei Cloud AK/SK directly into shell commands. This exposes long-lived secrets to logs, UI surfaces, process listings, task serialization, and any downstream agent that receives the generated task, creating a clear credential disclosure risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The prompt formatter includes AK/SK both in natural-language prompt text and in the example execution command. Any caller, subagent, transcript logger, or model output consumer can read and retain these credentials, turning prompt generation itself into a secret exfiltration path.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code writes a client certificate and private key to predictable paths under /tmp, which is a shared location on multi-user systems and often accessible to other local processes if file permissions or cleanup are imperfect. Because these files grant Kubernetes API access to the cluster, temporary exposure or failure to delete them can leak live cluster credentials.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The list_cce_secrets function can return Kubernetes Secret contents when include_data=True, exposing base64-encoded secret material such as tokens, passwords, and certificates directly to callers. In a diagnostic skill, this significantly increases the chance of unintended credential disclosure because the function is framed as operational troubleshooting rather than secret-access tooling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code decodes cluster CA, client certificate, and client key material from a generated kubeconfig and writes them to temporary files on disk. Although the files are later deleted in a finally block, writing live cluster credentials to the filesystem increases exposure to local compromise, crash/interruption before cleanup, insecure temp directory access, and forensic recovery from disk. In this skill context, the risk is elevated because the function is explicitly for remote cluster administration and obtains short-lived Kubernetes client credentials automatically.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416