T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/dispatcher.py:1469- Finding
Read-Only Skill Dispatcher Exposes Destructive and Mutating Cloud Actions
- Content
View full analysis
- Remediation
View remediation
Security audit
Huawei Cloud Cce Observability Context Builder
Security checks for vulnerabilities and agentic risk
Overview
The skill claims to be read-only observability tooling, but the bundled dispatcher exposes unlisted cluster-changing actions and Kubernetes secret access.
Treat this as a Review item before installation. Only use it with a tightly scoped read-only Huawei Cloud IAM user and Kubernetes RBAC role, and do not grant permissions for secrets, create/update/delete, scaling, node operations, EIP changes, or remediation. The package should be remediated by enforcing a strict action allowlist, removing mutation and secret-data actions, using verified TLS, and storing temporary certificates securely.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/cce.py:3313- Finding
Dispatcher Can Return Kubernetes Secret Values Across All Namespaces
- Content
View full analysis
Dict[str, Any]: return cce.list_cce_secrets( params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id") ) ``` Registered action: ```python "huawei_list_cce_secrets": (("region", "cluster_id"), _list_cce_secrets), ``` Secret collection and output: ```python def list_cce_secrets(region: str, cluster_id: str, namespace: Optional[str] = None, limit: int = 100, include_data: bool = False, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None) -> Dict[str, Any]: # ... core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secret.data.keys()) if secret.data else [] } if include_data and secret.data: secret_info["data"] = secret.data secret_list.append(secret_info) return { "success": True, "region": reg ...[truncated 1881 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/huawei_cloud/cce.py:1134- Finding
Kubernetes API Server Certificate Verification Is Disabled
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/huawei_cloud/cce.py:1315- Finding
Predictable Temporary Files Are Used for Kubernetes Client Private Keys
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/huawei_get_node_security_groups.py:136- Finding
Standalone Helper Accepts Cloud Credentials Through Command-Line Arguments and Implements Broken Authentication
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (317)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: observability-context-builder description: Use this skill when a Huawei Cloud CCE issue needs observability context from AOM alarms, metrics, LTS logs, Pod logs, or Kubernetes events before diagnosis. ---
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md od (Must Read): This skill executes actions via local Python scripts using the `scripts/huawei-cloud.py` dispatcher. Using hcloud, kubectl, or other CLI tools o
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md od (Must Read): This skill executes actions via local Python scripts using the `scripts/huawei-cloud.py` dispatcher. Using hcloud, kubectl, or other CLI tools o
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md od (Must Read): This skill executes actions via local Python scripts using the `scripts/huawei-cloud.py` dispatcher. Using hcloud, kubectl, or other CLI tools o
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md od (Must Read): This skill executes actions via local Python scripts using the `scripts/huawei-cloud.py` dispatcher. Using hcloud, kubectl, or other CLI tools o
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md od (Must Read): This skill executes actions via local Python scripts using the `scripts/huawei-cloud.py` dispatcher. Using hcloud, kubectl, or other CLI tools o
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md od (Must Read): This skill executes actions via local Python scripts using the `scripts/huawei-cloud.py` dispatcher. Using hcloud, kubectl, or other CLI tools o
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md od (Must Read): This skill executes actions via local Python scripts using the `scripts/huawei-cloud.py` dispatcher. Using hcloud, kubectl, or other CLI tools o
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md od (Must Read): This skill executes actions via local Python scripts using the `scripts/huawei-cloud.py` dispatcher. Using hcloud, kubectl, or other CLI tools o
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Documenting permission to create cluster certificates for kubeconfig access introduces credential-access capability beyond the stated need. Even if intended for diagnostics, kubeconfig/cert material can enable broader cluster access and materially increases the blast radius if the script, logs, or execution environment are compromised.
- Content
md | API Action | Permission | Purpose | | --------------------------- | ------------------ | ------------------------------------- | | `cce:cluster:get` | Get cluster | View CCE cluster details | | `cce:cluster:createCert` | Create certificate | Obtain kubeconfig for kubectl access | | `aom:alarm:list` | List alarms | Query AOM active/history alarms | | `aom:alarm:analyze` | Analyze alarms | Deduplicate and group alarms | | `aom:metricsData:get` | Get metrics data | Query Pod/node CPU/memory metrics |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python - Allow automatic R1 read-only queries: alarms, metrics, logs, events, inventory, read-only report generation. - Prohibit any action requiring `confirm=true` — no mutations allowed. - Never persist AK/SK, tokens, certificates, or kubeconfig. - Log output must be sanitized. When suspected secrets are found, describe the hit location only — never copy the original text. - Charts and reports must only be generated from authorized query results.
Static analysis
Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/huawei_cloud/cce_nodepool.py:456
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/network.py:781
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/huawei_cloud/storage.py:416