Huawei Cloud Cce Observability Context Builder

• Outcome: Review
• Latest audit: Jun 16, 2026 · 10:12 AM UTC
• Version: 0.1.1

Overview

The skill is presented as read-only observability, but the package exposes broad cloud and Kubernetes admin actions plus sensitive credential-handling paths.

Install only after reviewing the dispatcher surface and restricting execution to the listed observability actions. Use least-privilege read-only IAM and Kubernetes credentials, avoid account-wide admin AK/SK, do not enable raw secret or kubeconfig outputs, and run it in an isolated workspace because it can write sensitive cluster material and reports to local files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (66)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The file's stated security constraints explicitly say certificates must not be saved to the filesystem, but `_configure_k8s_client_certificate_files` later base64-decodes and writes both client certificate and private key material to disk. This contradiction is dangerous because operators may trust the documented guarantees and deploy the skill in environments where temporary-file exposure, backup capture, or local-user access can leak cluster credentials.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill exposes Kubernetes Secret enumeration and, when include_data=true, returns raw secret contents directly to the caller. In this skill's cloud-admin context, that enables straightforward exfiltration of service account tokens, database passwords, API keys, and TLS material from the cluster with no additional guardrails, justification, or masking.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The get_pod_logs function returns arbitrary pod logs, which commonly contain credentials, tokens, PII, stack traces, and internal system details. In an agent skill, this creates a low-friction data exfiltration path from workloads without any warning, scoping restrictions, or content redaction.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The bind/unbind EIP functions can change the cluster control plane from private to publicly reachable or remove that protection, materially altering the attack surface. Exposing the Kubernetes API publicly without strong policy controls can enable reconnaissance, brute force, or exploitation against a highly privileged target.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The module docstring says only 'CCE Cluster management functions' while the file implements highly sensitive operations including cluster deletion, kubeconfig/certificate retrieval, and public API exposure via EIP binding. In an agent skill context, understated capability descriptions increase the chance that dangerous actions are invoked without the operator realizing the security and destructive scope.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The module is presented as a diagnosis tool, but it also includes operational functions that modify live cluster state, such as scaling workloads and expanding node pools. In an agent/automation context, this mismatch is dangerous because users or orchestrators may invoke the skill expecting read-only diagnostics while it can perform privileged changes with production impact.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The diagnostic script includes a workload scaling function that patches deployment replicas, directly changing cluster state. In a privileged cloud/Kubernetes environment, an agent or caller may trigger this unexpectedly, causing outages, cost changes, or masking root-cause evidence during an incident.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file includes node pool expansion capability despite being framed primarily as a diagnosis utility. Expanding node pools changes infrastructure size and cost and can be abused by a misled agent, compromised workflow, or mistaken operator to make expensive or disruptive production changes.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The default CPU PromQL in get_cce_node_metrics is malformed: it is missing a closing parenthesis, so the query may fail or behave unexpectedly instead of returning metrics for only the requested node. In a security-sensitive monitoring skill, incorrect node scoping undermines operator trust and can cause wrong-node analysis or blind spots during incident response.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The function writes report content to a user-controlled `output_file` path with `Path(output_file).write_text(...)` and performs no validation, sandboxing, or path restriction. In an agent/skill context this can overwrite arbitrary local files accessible to the process, which is an unnecessary filesystem side effect for analysis logic unless explicitly constrained and disclosed.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This file mixes read-only inventory/monitoring helpers with state-changing infrastructure control operations such as start, stop, and reboot. In an agent skill context, exposing destructive cloud actions without clear scoping, authorization boundaries, or manifest justification increases the chance that an LLM or user invokes power-control actions unexpectedly, causing service disruption or outages.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: This helper goes beyond passive LTS log querying by minting Kubernetes cluster access material, connecting to the cluster API, and enumerating custom resources. In a skill expected to query logs, that scope expansion materially increases privilege use and exposes sensitive cluster access paths, especially when combined with insecure transport and local key handling later in the function.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring describes an SDK-style implementation, but the function manually constructs and sends an HTTPS request with certificate verification disabled. This mismatch hides a materially weaker security posture from callers and reviewers, increasing the chance that an insecure network path is trusted in production while AK/SK-signed requests and cloud resource metadata transit over a channel vulnerable to man-in-the-middle interception.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The docstring claims an SDK-style implementation, but the function manually constructs signed HTTP requests and also disables TLS certificate verification. This mismatch is security-relevant because reviewers and users may trust the code as using safer, battle-tested SDK behavior when it actually relies on custom signing logic and insecure transport settings, increasing the chance of credential exposure or man-in-the-middle interception.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The script obtains credentials and may successfully retrieve an IAM token, but then ignores that token and calls get_ecs_by_ip with the hardcoded string "test". This breaks the documented authentication flow and can cause operators to believe authenticated cloud queries are being performed when they are not, leading to failed checks, misleading results, and unsafe operational decisions based on false assumptions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The AK/SK branch advertises authentication support, but generate_aksk_sign is unimplemented and the code substitutes the access key itself as a token placeholder. This is dangerous because it misrepresents security-sensitive behavior, may encourage users to expose long-lived credentials unnecessarily, and can result in unauthorized or invalid requests while users believe proper signed authentication is in place.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The skill actively collects alarms, metrics, events, AOM/LTS logs, and pod logs, but it does not prominently warn that these sources can contain sensitive data such as tokens, credentials, internal hostnames, request payloads, or personal data. Although later sections mention sanitizing output, the lack of an upfront user-facing sensitivity warning increases the chance of over-collection or unsafe disclosure during routine observability workflows.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code writes client certificate and private key data from kubeconfig into files on the local filesystem without any explicit disclosure at the interface level and without visible permission hardening in this file. Even if intended as temporary handling, private key material on disk can be exposed through weak temp-file permissions, forensic recovery, backups, or cleanup failures.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code actively fetches Cluster Autoscaler pod logs and stores them in the result structure, where they may later be exposed to callers or persisted. Pod logs often contain infrastructure details, error traces, identifiers, and occasionally secrets or tokens, so collecting and retaining them without redaction, minimization, or explicit disclosure creates a real data exposure risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When include_raw is enabled, the function can return the full collected cluster context, including pods, events, deployments, statefulsets, metrics, and CA logs. That materially broadens exposure of operational and potentially sensitive cluster metadata to any caller of this skill, especially because the code performs no sanitization, field filtering, or warning before returning it.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code writes the generated diagnostic report to an arbitrary caller-controlled file path, and that report is derived from cluster state, events, and logs. This creates a persistence risk because sensitive operational data may be written to insecure locations, overwrite unintended files, or remain on disk without lifecycle controls.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The function returns full kubeconfig content and renders it as YAML, which includes client certificate/key material granting cluster access. Returning these credentials directly to the caller is effectively credential export and can enable full cluster compromise if intercepted, logged, or misused.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The secret listing function can return secret contents without any warning or protective friction, despite the data being highly sensitive by design. In this operational cloud skill, that makes accidental or intentional disclosure of credentials and private keys very likely.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The audit log query path returns detailed user, source IP, request URI, user agent, and raw audit event data directly to callers. In a skill context, this can expose sensitive operational and identity metadata to users who may not need full audit visibility, especially because there is no built-in warning, minimization, or role check in this code path.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The function automatically retrieves and uses cloud credentials to inspect cluster and monitoring resources without any explicit user-facing disclosure, consent checkpoint, or scope summary. In an agent skill context, this increases the risk of opaque access to sensitive infrastructure metadata and can lead to unintended credential use, especially when the skill may be invoked indirectly or on a schedule.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416