Huawei Cloud Cce Pressure Test

• Outcome: Review
• Latest audit: Jun 17, 2026 · 1:34 AM UTC
• Version: 0.1.0

Overview

This Huawei Cloud/Kubernetes skill appears legitimate in purpose, but it gives agents broad cloud and cluster authority with weak guardrails around credentials, secrets, logs, public API exposure, and live mutations.

Install only in a controlled operator environment with least-privilege Huawei Cloud and Kubernetes credentials. Treat outputs as sensitive, avoid enabling raw exports unless needed, review any action that exposes cluster APIs or changes replicas, and do not use this against production clusters without human approval and audit logging.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (40)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad and likely to match ordinary requests about testing or performance, increasing the chance the skill activates in the wrong context. Because this skill can generate traffic and alter cloud or Kubernetes resources, accidental invocation could lead to unintended load, charges, or configuration changes.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Repeating ambiguous trigger keywords without guardrails reinforces opportunistic activation from common language. In a skill that can create ELBs, inject agents, scale workloads, and run traffic, overbroad activation materially raises operational risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function can collect Cluster Autoscaler pod logs and optionally persist the generated report to an arbitrary output path. Even though the current code writes only the markdown report by default, the diagnostic flow handles sensitive operational data and can also attach raw collected data when include_raw=True, creating a realistic risk of exposing cluster metadata, error messages, and potentially secrets present in logs without any masking, consent, or retention controls. In a cloud/Kubernetes diagnostics skill, this context makes the issue more dangerous because CA logs often contain infrastructure details, scheduling failures, API errors, and occasionally credential-adjacent values.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The function returns full kubeconfig material, including client certificate/key data and a YAML rendering of the credential, directly to the caller. That grants cluster API access and can be reused outside this tool, making it a credential-exposure primitive rather than a simple metadata lookup.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The secret-listing function can return Secret data content when include_data=true without any confirmation, redaction, or access narrowing. Kubernetes Secret objects often contain passwords, API keys, tokens, and certificates, so this enables straightforward credential disclosure.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Pod logs frequently contain credentials, tokens, PII, internal URLs, stack traces, and operational secrets. Returning logs without any warning, scope restriction, or redaction can leak sensitive application data to whoever can invoke the skill.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Binding an EIP to the cluster master exposes the Kubernetes API publicly, materially changing the attack surface of the control plane. Because the function performs this directly without a confirm gate or risk warning, an accidental or unauthorized invocation could expose administrative endpoints to the internet.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Unbinding the cluster EIP alters public API accessibility and can unexpectedly disrupt automation, operators, or incident response workflows relying on public control-plane access. Even though it reduces exposure, it is still a security-relevant configuration change that should require explicit confirmation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When include_raw is enabled, the code writes a full raw Kubernetes/CCE inventory JSON file to disk, including nodes, pods, workloads, services, ingresses, labels, annotations, and cluster topology details. In an agent skill context, this can expose sensitive infrastructure metadata to local storage, logs, shared workspaces, or downstream tooling without any explicit warning, redaction, or access control, increasing recon and lateral-movement value if the host or artifact store is compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When include_raw is enabled, the code writes full raw API responses for clusters, nodes, nodepools, deployments, HPAs, metrics, and AOM discovery directly to disk. In an infrastructure-analysis skill, these payloads can contain sensitive operational metadata and potentially secrets or identifiers, so persisting them without sanitization, minimization, or an explicit safety gate creates a real data exposure risk if the filesystem, logs, artifacts, or downstream tooling are accessible.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The function automatically creates and appends historical capacity records on disk when record_history is enabled, and history_dir is implicitly derived from output_dir if not provided. Although the stored record is more filtered than raw output, it still contains cluster scope, elasticity configuration, recommendations, and file locations, which are sensitive operational details that can accumulate over time and broaden exposure through artifact retention.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function retrieves and returns full kubeconfig material, including client authentication data and cluster endpoint information, without any explicit user-facing warning, confirmation gate, or output minimization. In an agent skill context, returning this directly to the caller materially enables cluster access and credential exfiltration if the tool is invoked by mistake, through prompt injection, or by an unauthorized workflow.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Binding an EIP exposes the Kubernetes API server publicly, increasing attack surface and making the control plane reachable from the internet. Unlike the destructive operations in this file, this function lacks an explicit confirmation step or warning, so an agent could enable external access with a single call and no user acknowledgment.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The action handler accepts `ak`, `sk`, and `project_id` directly from params and passes them into cloud API helper functions, while the main analyzer also falls back to environment-derived credentials. In an agent skill context, this can cause sensitive cloud credentials to be silently collected and transmitted to external services without explicit user consent, masking, or any user-facing disclosure, which increases the risk of accidental secret exposure or misuse.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function can persist summary reports and, when include_raw is enabled, full raw API responses containing cluster inventory, pod/deployment details, node metadata, utilization metrics, and potentially operational identifiers to disk. In an infrastructure-testing skill, this creates a real confidentiality risk because the files are written without any built-in warning, redaction, encryption, or path restriction, so sensitive cloud/Kubernetes data may be left on shared hosts or CI runners.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The function writes a live cluster kubeconfig to a predictable path under /tmp, which commonly has broad local accessibility and is vulnerable to symlink, race, and residue exposure issues. Because kubeconfig typically contains cluster endpoint details, tokens, or client credentials, any local user or process that can read or replace that file may gain unauthorized cluster access or capture sensitive credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This function performs a live mutation against the Kubernetes API by changing deployment replica counts, but the function itself provides no built-in confirmation, dry-run default, or explicit safety barrier. In an agent skill context, that increases the risk of accidental or unauthorized service disruption, cost increase, or production impact if invoked with attacker-controlled or mistaken parameters.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code constructs subagent shell commands that inline raw access key and secret key values (`ak={ak} sk={sk}`). Embedding credentials directly in command strings exposes them to logs, shell history, process listings, downstream agents, and accidental reporting, which is especially dangerous in a multi-agent automation context.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The generated subagent prompt explicitly includes raw AK/SK values in human-readable text. This creates a direct secret disclosure channel to any model, agent, transcript, log sink, or operator that sees the prompt, greatly increasing the blast radius of credential compromise.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The `list_cce_secrets` function enumerates Kubernetes Secrets and, when `include_data=True`, returns the secret contents directly without any guardrail, warning, confirmation step, or scope restriction. In an agent skill context, this materially increases the risk of credential/token exfiltration because a user prompt or downstream tool flow can cause raw secret material to be disclosed from the cluster.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function writes the generated report to `output_file` directly from user-supplied parameters with no path validation, sandboxing, or overwrite protection. In an agent/automation context, this can be abused to overwrite arbitrary files writable by the process, potentially clobbering configuration, logs, or other application data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function performs a state-changing cloud operation that powers on an ECS instance immediately, without any explicit confirmation gate, warning, or dry-run safeguard. In an agent skill triggered by natural-language requests, this increases the risk of accidental or prompt-induced activation of infrastructure, which can cause cost, operational, or security consequences.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: TLS certificate verification is explicitly disabled for Kubernetes API access, which permits man-in-the-middle interception or impersonation of the cluster API endpoint. In this skill, the code fetches cluster certificates and then queries custom resources, so a spoofed endpoint could expose sensitive cluster metadata or return attacker-controlled responses.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code performs an HTTPS request with certificate verification explicitly disabled via `verify=False`. This allows a man-in-the-middle attacker on the network path to intercept or tamper with responses from the Huawei Cloud NAT API, which is especially dangerous here because the skill handles cloud inventory and authenticated API requests in an infrastructure-management context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function can collect pod log excerpts from application, CoreDNS, ingress-controller, and backend pods, then returns them in the API response snapshot/report. Although some secret-masking is attempted, regex-based masking is incomplete and logs commonly contain sensitive data such as tokens, session IDs, internal URLs, customer data, and stack traces, so this creates a real data-exposure risk without explicit consent or minimization.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416