Security audit

Huawei Cloud Cce Pod Failure Diagnoser

Security checks across malware telemetry and agentic risk

Overview

This pod-diagnosis skill has a coherent troubleshooting purpose, but it also ships and exposes many extra privileged cloud and Kubernetes actions that can reveal credentials/secrets or change infrastructure.

Install only after reviewing and constraining the dispatcher actions you are willing to expose. Use least-privilege Huawei IAM credentials, avoid passing AK/SK as command-line parameters, disable or remove kubeconfig/secret/export/mutation/subagent actions if you only need pod diagnosis, and treat logs, audit data, raw reports, and kubeconfig output as sensitive operational data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (64)

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger list contains broad phrases like 'Pod failure', 'Pod crash', and 'Pod 状态异常', which can cause accidental invocation in loosely related conversations. In a skill with powerful backend access, overbroad triggering increases the chance that sensitive cluster data, logs, events, or credentials-adjacent context are queried without sufficiently deliberate user intent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The verification workflow instructs operators to retrieve current and previous pod logs and to enable diagnosis with logs, but it does not warn that application logs commonly contain secrets, tokens, PII, stack traces, or internal endpoints. In this skill context, exposing logs is more dangerous because troubleshooting failing pods often targets production workloads, increasing the chance that sensitive operational data is viewed, copied, or shared during verification.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The function writes the generated markdown report to whatever path is supplied in output_file, creating parent directories and overwriting the target file without validation, confinement, or confirmation. If an untrusted caller can influence this argument, the skill can be abused for arbitrary file write within the agent's filesystem permissions, which can overwrite application files, user data, or sensitive locations.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: This code automatically fetches Cluster Autoscaler pod logs, including previous crash logs, and returns the raw log text in the result object. Operational logs commonly contain sensitive information such as internal hostnames, workload names, error details, tokens accidentally logged by components, or cloud/account metadata, so exposing them without scope minimization, redaction, or explicit disclosure creates an information exposure risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The collection routine gathers broad cluster data sets—HPAs, addons, node pools, pods, events, deployments, statefulsets, and optional metrics/logs—potentially across a namespace or cluster. Even though this is for diagnosis, the breadth of telemetry can reveal sensitive infrastructure metadata, workload topology, failure messages, and resource usage well beyond what may be necessary for a specific user request.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The get_cce_kubeconfig function returns full kubeconfig material, including client credentials and cluster access details, directly in its response. In this skill context, that is highly sensitive because it enables direct authenticated access to the Kubernetes API and can be exfiltrated or reused outside the intended workflow.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The secret-listing function can optionally include secret.data in the returned result without any guardrail, warning, redaction, or secondary confirmation. In a diagnostic skill, exposing Kubernetes Secret contents is dangerous because it can leak passwords, tokens, certificates, and cloud credentials unrelated to pod troubleshooting.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code decodes client certificate and private key material from the generated kubeconfig and writes them to temporary files on disk. Although cleanup is attempted in a finally block, using temporary on-disk storage for live credentials increases exposure through local file disclosure, backup/forensics artifacts, race conditions around temp file creation, or failed cleanup paths.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: Audit log query results expose potentially sensitive metadata including usernames, request URIs, source IPs, user agents, and raw audit event content directly in the returned response. In a diagnostic skill context, this can leak operator identities and cluster activity details to callers who may not need full audit visibility.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: When `include_raw` is enabled, the scanner writes a full Kubernetes inventory snapshot to disk, including nodes, pods, workloads, services, ingresses, labels, annotations, and cluster topology. In a diagnostic skill context, that raw export can expose sensitive infrastructure metadata and application details to other local users, later processes, logs, backups, or artifact collection systems, especially because this file provides no warning, redaction, permission hardening, or retention control.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: When include_raw is enabled, the code persists full raw API responses for clusters, nodes, node pools, deployments, HPAs, and AOM discovery directly to disk. In an infrastructure-diagnostics skill, those responses can contain sensitive operational metadata, resource names, topology details, scaling configuration, and potentially other environment information that should not be written unredacted without explicit user consent and minimization.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The function records capacity history to disk by default (record_history=True), including scope, elasticity data, recommendations, and file references, and appends it to a JSONL history log. Even if less sensitive than raw dumps, this creates silent persistent storage of cluster operational history, which increases exposure in shared runners, multi-tenant agents, or systems with weak filesystem hygiene.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The function retrieves and returns full kubeconfig material, including client credentials/certificates and API endpoints, with no explicit confirmation, sensitivity warning, or output minimization. In an agent skill context, this is dangerous because a routine diagnostic workflow could silently exfiltrate cluster-admin access material into agent outputs, logs, traces, or downstream tools.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Binding an EIP makes the Kubernetes API publicly reachable, materially expanding the attack surface, but the function performs the action immediately without explicit confirmation or a strong warning. In a troubleshooting skill, users may intend diagnosis rather than exposure of the control plane, so this operational change is more dangerous than in a dedicated network administration tool.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: When include_raw is enabled, the code writes raw cluster inventory and metric responses directly to disk, which can expose sensitive operational data such as pod names, namespaces, node details, utilization metrics, and possibly other metadata returned by upstream APIs. In a diagnostics/cluster-management skill, these artifacts may persist beyond the session and be readable by other local users, later processes, backups, or log collection systems if output_dir is not tightly controlled.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The file includes a callable scaling function that patches a live Kubernetes Deployment's replica count, changing production cluster state. There is no in-function confirmation gate, dry-run default, or explicit user-facing warning, so an agent or automation invoking this skill could unintentionally trigger service disruption, cost increase, or incident escalation.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code writes kubeconfig data containing cluster access material to a predictable file under /tmp without permission hardening or cleanup guarantees. On multi-user systems or compromised hosts, another process could read or race on that file and obtain credentials for cluster access.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The batch node diagnosis flow persists an inventory of abnormal node IPs to a report file under a fixed directory. While less sensitive than credentials, infrastructure inventory can aid reconnaissance and may be exposed to unintended readers if filesystem permissions are weak.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code constructs subagent shell commands that include AK/SK directly on the command line. Command-line arguments are commonly exposed via process listings, shell history, logs, orchestration traces, and downstream tooling, so cloud credentials may be disclosed to other local users or monitoring systems.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The auto-subagent task generator embeds access credentials into generated executable command text. In this skill context, commands are meant to be copied, executed, and possibly surfaced to other agents, which materially increases the chance of credential leakage across agent outputs, logs, and audit trails.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The formatted subagent prompt explicitly prints AK and SK values and includes them in an executable command. This exposes secrets in plain text to any recipient of the prompt, including users, agents, logs, transcripts, and prompt-capture systems, creating a direct credential disclosure path.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The `list_cce_secrets` function can return Kubernetes Secret payloads when `include_data=True`, exposing secret values directly to callers. In a diagnostic skill, this is especially risky because it turns a troubleshooting tool into a credential-exfiltration primitive without any approval gate, masking, or least-privilege control.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: create_cce_node performs a real infrastructure write action that provisions new cluster nodes, but unlike delete/cordon/drain operations in the same file it has no explicit confirmation gate or strong warning. In an agent setting, this increases the chance of accidental or prompt-induced resource creation, leading to unwanted cost, capacity changes, and environment drift.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The create_node_pool function provisions new cloud infrastructure immediately once invoked and does not require an explicit confirmation step, unlike the resize and delete operations in the same file. In an agent setting, that makes accidental or prompt-injected resource creation more likely, leading to unintended cost, quota consumption, and cluster changes.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The code writes the generated report to `output_file` directly from user-controlled input without constraining the destination path. In an agent setting, this can enable arbitrary file overwrite within the agent's filesystem permissions, which is especially risky if the skill runs with access to sensitive config, workspace, or prompt files.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416