Security audit

Huawei Cloud Cce Node Failure Diagnoser

Security checks for vulnerabilities and agentic risk

Overview

The skill is presented as read-only node diagnosis, but the packaged dispatcher exposes cluster mutations and secret retrieval that exceed that purpose.

Install only after reviewing and constraining the packaged dispatcher. Use dedicated read-only Huawei IAM and Kubernetes RBAC that cannot delete, scale, drain, cordon, reboot, modify alarms, change vulnerability status, or read Secret values; do not rely on the skill's documentation alone for the effective permission boundary.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/dispatcher.py:1469
Finding: Read-Only Diagnostic Skill Exposes Destructive and Mutating Cloud Operations
Content: View full analysis
Dict[str, Any]: required, handler = ACTION_SPECS[action] error = _require(params, *required) if error: return {"success": False, "error": error} return handler(params) ``` This conflicts with the documented boundary in `SKILL.md`: ```markdown 1. This skill is **read-only diagnosis only** ...[truncated 2365 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/cce.py:3313
Finding: Cluster-Wide Kubernetes Secret Values Can Be Returned Through the Dispatcher
Content: View full analysis
Dict[str, Any]: return cce.list_cce_secrets( params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id") ) ``` ```python "huawei_list_cce_secrets": ( ("region", "cluster_id"), _list_cce_secrets ), ``` The implementation permits cluster-wide enumeration and returns Secret values: ```python core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secret.data.keys()) if secret.data else [] } if include_data and secret.data: secret_info["data"] = secret.data secret_list.append(secret_info) ``` ### Technical Analysis When `namespace` is omitted, the implementation calls `list_secret_for_all_namespaces()`. When `include_data=true`, the response includes the contents of `secret.data`. Kubernetes Secret values are generally base64-encoded by the API, but base64 provides no confidentiality. Returning th ...[truncated 1555 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce.py:3374
Finding: Kubernetes API Connections Disable TLS Certificate Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce.py:3385
Finding: Kubernetes Client Private Keys Are Written to Predictable Shared Temporary Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/network.py:747
Finding: Signed Huawei Cloud API Request Disables TLS Verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/huawei_cloud/chart_generator.py:343
Finding: Generated HTML Reports Execute Third-Party CDN JavaScript Without Integrity Protection
Content: View full analysis
' ) adapter_tag = ( '' ) ``` A second report generator includes: ```html ``` ### Technical Analysis Generated HTML reports load and execute JavaScript from a third-party CDN when the report is opened. The URLs pin package versions but do not use Subresource Integrity hashes, and no restrictive Content Security Policy was identified in the reviewed excerpts. If the CDN, package publication account, dependency artifact, or network delivery path is compromised, arbitrary JavaScript can execute in the report context. That script can access the report DOM, which may contain cloud topology, event details, logs, workload names, IP addresses, and diagnostic evidence. This is not evidence that the current pinned packages are malicious. It is a supply-chain and report-confidentiality weakness. ### Attack Path 1. An attacker compromises the CDN, package artifact, or package publisher for a referenced dependency. 2. A user generates an HTML diagnosis or monitoring report. 3. The user opens the report while connected to the network. 4. The browser downloads and executes the compromised remote JavaScript. 5. The script reads sensitive report contents from the DOM. 6. The script transmits the data to an attacker-controlled endpoint or modifies the displayed diagnosis. ### Impact Assessment Potential impact includes: - Exfiltration of cloud resource names, IDs, I ...[truncated 360 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (466)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This file exposes destructive and mutating operations such as deleting clusters, nodes, and workloads, resizing node pools, and scaling workloads, even though the advertised purpose is diagnosis. In a diagnostic skill, such capabilities are dangerous because prompt misuse, dispatcher abuse, or accidental invocation could cause service disruption or irreversible production changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This code can create, delete, hibernate, wake, and reconfigure CCE clusters even though the skill is presented as a node-failure diagnoser. That mismatch is dangerous because an agent or user invoking a seemingly diagnostic skill could trigger destructive or security-sensitive infrastructure changes, including cluster deletion or public control-plane exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A skill marketed for diagnosis contains workload scaling logic that changes live cluster state. In an automated agent setting, hidden remediation actions inside a diagnostic skill can cause unreviewed production impact, especially if the skill is selected based on troubleshooting-related prompts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The scale_workload function is not necessary for node-failure diagnosis and directly patches deployment replica counts through cluster credentials. This creates a strong privilege mismatch: a diagnostic tool can silently mutate production workloads, enabling accidental outages, cost increases, or disruption of service behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The node pool expansion function changes infrastructure capacity and spend, which is far beyond passive diagnosis. Because this capability is bundled into a troubleshooting skill, an agent or user invoking diagnosis-related functionality could gain unexpected infrastructure modification powers.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The secret-listing function can enumerate Secrets cluster-wide and optionally return secret.data contents, which is highly sensitive credential material and not justified by node-failure diagnosis. In an LLM-integrated skill, this creates a direct path for secret disclosure through prompt injection, operator error, or overly broad user requests.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL-CN.md (reported line 1)May include surrounding context.
md
--- name: node-failure-diagnoser description: Use this skill for CCE node failures including NotReady, Ready=Unknown, kube-node-lease timeout, DiskPressure, MemoryPressure, NetworkUnavailable, CNI sandbox failures, kubelet or container runtime abnormalities, NPD events, and node-level workload impact. The skill must produce a complete Markdown diagnosis report with process, evidence, conclusion, and runbook recommendations. ---

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Workload rollout failure diagnosis targets Deployments, ReplicaSets, and Pods rather than Nodes and therefore represents undeclared functionality with broader Kubernetes access. The security risk is misleading scope and unnecessary privilege, especially if logs and metrics are included.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416