Security audit

Huawei Cloud Cce Node Failure Diagnoser

Security checks across malware telemetry and agentic risk

Overview

The skill mostly fits Huawei Cloud CCE diagnosis, but it ships broad live cluster administration and credential-revealing capabilities under a read-only node-diagnosis description.

Install only if you intend to give this skill broad Huawei Cloud and Kubernetes operational access, not just read-only node diagnosis. Use least-privilege read-only credentials where possible, avoid passing AK/SK as command parameters, do not invoke raw kubeconfig/secret/log actions unless explicitly needed, and review any action involving confirm=true or cluster changes before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (54)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The verification workflow explicitly instructs operators to invoke security correlation and host inspection actions that can enumerate security groups, ACLs, hosts, and vulnerability data, but it does not include any warning, consent boundary, or least-privilege guidance for handling sensitive infrastructure and security information. In an agent skill context, this increases the chance that routine verification will over-collect sensitive data or expose it to users who did not intend to authorize broad security introspection.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The function writes report content to a caller-controlled filesystem path via Path(output_file).write_text(...) with no path restriction, validation, or explicit safety controls. In an agent skill context, this can overwrite arbitrary files accessible to the process, making it more dangerous than a normal local utility because untrusted user input may be routed directly into this parameter.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The function returns full kubeconfig material, including client certificate/key data and generated YAML, directly to the caller without any explicit safety gate, redaction, or confirmation. In this skill context, that exposes reusable cluster access credentials that can be used outside the skill to authenticate to the Kubernetes API, turning a diagnostic capability into credential export.

Missing User Warnings

High

Confidence: 97% confidence
Finding: list_cce_secrets can return Kubernetes Secret data when include_data=true, and it returns that data verbatim with no warning, redaction, or approval step. Secrets frequently contain passwords, tokens, private keys, and cloud credentials, so exposing them through a diagnostic skill materially increases the risk of credential theft and lateral movement.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: get_pod_logs returns arbitrary pod logs directly to the caller without warning or filtering. Application logs commonly contain API keys, bearer tokens, personal data, stack traces, and internal topology details, so unrestricted retrieval can disclose sensitive operational data.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The install function issues a live remote create_addon_instance call that changes cluster state, but it has no explicit confirmation gate, dry-run mode, or user-facing warning in the function itself. In an agent skill context, this is risky because a natural-language request could be misinterpreted and immediately trigger an irreversible or high-impact infrastructure change.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The update function performs a remote update_addon_instance operation against a live cluster without any confirmation or secondary approval. In this skill's diagnostic/operations context, that increases the chance that a troubleshooting request or ambiguous prompt causes unintended production changes, including service disruption from addon reconfiguration or version changes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This function rewrites live bursting addon network-related settings and then calls update_addon_instance without any explicit confirmation step. Because it modifies subnet, network, project, and scheduling-related parameters on a production cluster addon, accidental invocation could break scheduling, networking, or workload placement more severely than a routine metadata update.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code decodes client certificate and private key material from the generated kubeconfig and writes them to temporary files on disk. Although cleanup is attempted in a finally block, using disk-backed temp files for credential material increases exposure through local file disclosure, crash/interruption before deletion, insecure temp file creation, or permissive filesystem access, especially on shared hosts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The quick-check path automatically loads cloud credentials via get_credentials_with_region and immediately queries alarms, pod metrics, services, pods, and deployments without any explicit user-facing notice that privileged cloud access and broad cluster inspection will occur. In an agent skill context, this is dangerous because a simple diagnostic trigger can cause silent access to sensitive operational metadata across the user's cloud environment, expanding data exposure beyond what the user may reasonably expect.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The deep-diagnosis flow also retrieves credentials and performs substantially broader collection, including alarms, AOM instances, memory metrics, deployments, nodes, and cluster events, again without an explicit warning or consent gate. This increases the risk in an agent setting because an anomaly detected during a lightweight check can automatically escalate into much deeper reconnaissance of cloud resources and operational state without the user's informed approval.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: When include_raw is enabled, the skill writes a full cluster inventory JSON to disk, including detailed node, pod, workload, labels, annotations, and infrastructure metadata. In a diagnostic skill operating on Kubernetes/CCE environments, this can expose sensitive operational details to other local users, log collectors, backups, or downstream tooling without any explicit warning, minimization, or access-control safeguard.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill writes reports and history to attacker-/user-controlled filesystem paths and can optionally dump raw API responses to disk. Those artifacts may contain sensitive operational metadata, cluster inventory, autoscaling settings, node details, and possibly tokens or other secrets from upstream responses, creating a local data exposure risk if written to shared, world-readable, or untrusted locations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The function retrieves full Kubernetes kubeconfig material and returns it directly in structured output, including a YAML serialization that is easy to log, display, or persist unintentionally. In an agent skill context, this is dangerous because kubeconfig commonly contains cluster endpoints, client certificates, tokens, or other access material that can grant administrative access to the cluster if exposed.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The action handler accepts credentials and invokes multiple cloud/Kubernetes enumeration functions that collect pod, node, ELB, NAT, EIP, and service metadata, but this file provides no consent gate, scope restriction, or user-facing warning about the breadth of data access. In an agent-skill context, that creates a real data-exposure risk because a user may trigger broad infrastructure discovery and monitoring collection without understanding that sensitive operational metadata and resource relationships will be queried and returned.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The function can persist detailed cluster summaries and, when include_raw is enabled, raw node, pod, deployment, HPA, and metrics responses to an arbitrary output directory without any built-in warning, consent gate, redaction, or file-permission controls. In a diagnostic cloud skill, these artifacts can contain sensitive infrastructure metadata and workload information, so silent local persistence increases the risk of unintended data exposure on shared hosts, CI runners, or agent workspaces.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The action accepts AK/SK/project credentials and uses them to perform multiple remote inventory and metrics collection calls, but this file provides no user-facing disclosure that external cloud APIs will be contacted or what scope of data will be retrieved. In an agent skill, that matters because users may invoke what sounds like local analysis while actually authorizing broad live access to cluster state and telemetry, increasing the risk of surprise data access and overcollection.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code retrieves a cluster kubeconfig and writes it to a predictable file in /tmp, then loads it from disk without guaranteed cleanup or restrictive permissions. Kubeconfig commonly contains client certificates, bearer tokens, or endpoint details, so any local user or co-tenant process that can read the file could gain cluster access or harvest credentials.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This function performs a live patch_namespaced_deployment_scale operation directly against the cluster and has no built-in confirmation, dry-run, authorization gate, or safety interlock. In an agent skill context, a mistaken invocation, prompt injection, or overly broad automation could change production capacity and cause outage, cost increase, or destabilization.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The function writes an inventory of abnormal node IPs to a report file under /root/.openclaw/workspace/report without disclosure, retention control, or explicit permissions handling. While less sensitive than kubeconfig, node inventories reveal internal infrastructure topology and can aid follow-on targeting or reconnaissance if the workspace is exposed to other tools, users, or logs.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The code explicitly disables TLS certificate verification for Kubernetes API connections by setting `configuration.verify_ssl = False`. This allows a man-in-the-middle attacker on the network path to impersonate the Kubernetes API server, intercept client-certificate authentication, and tamper with HPA read/write operations against the cluster.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The subagent task generator builds command strings that inline `ak` and `sk` directly into shell commands. Those secrets can be exposed in logs, process listings, telemetry, agent transcripts, or copied into downstream tools, turning routine diagnostics into credential disclosure.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The generated natural-language prompt explicitly includes `ak` and `sk` values and instructs execution using a command containing those secrets. This broadens exposure beyond code paths into plain-text prompt history, model context, chat transcripts, and any copied task instructions.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill exposes Kubernetes Secret contents when include_data=True, returning the secret.data field directly to the caller. In a diagnostic skill, this materially increases the risk of credential, token, and certificate disclosure because cluster secrets commonly contain highly sensitive authentication material.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The functions perform live Huawei Cloud CCE/AOM API queries using provided or ambient cloud credentials and return cluster metadata, pod details, node details, labels, and time-series metrics, but there is no visible consent, warning, or disclosure boundary in this skill layer. In an agent setting, this can cause users to unknowingly trigger access to sensitive operational data or incur network activity against production infrastructure, especially because optional custom PromQL inputs can broaden what data is queried.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416