Security audit

Huawei Cloud Cce Root Cause Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill presents itself as read-only root-cause analysis, but the package exposes undeclared actions that can read Kubernetes Secrets and modify or delete cloud and cluster resources.

Review this package carefully before installing. Use only tightly scoped read-only Huawei IAM and Kubernetes RBAC credentials if testing it, and do not provide credentials capable of deleting or modifying clusters, workloads, nodes, alarms, or reading Secret contents unless the package is split or constrained by an enforced dispatcher allowlist.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/cce.py:3403
Finding: Public Dispatcher Allows Raw Kubernetes Secret Extraction
Content: View full analysis
Dict[str, Any]: return cce.list_cce_secrets(params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id")) ``` ```python # scripts/huawei_cloud/dispatcher.py:1514 "huawei_list_cce_secrets": (("region", "cluster_id"), _list_cce_secrets), ``` ```python # scripts/huawei_cloud/cce.py:3403-3423 core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secret.data.keys()) if secret.data else [] } if include_data and secret.data: secret_info["data"] = secret.data secret_list.append(secret_info) ``` ### Technical Analysis The package exposes `huawei_list_cce_secrets` through the same public dispatcher used by the diagnostic Skill. The action accepts a caller-controlled `include_data` parameter. When it is set to `true`, complete Kubernetes Secret values are returned in the action result. If the namespace is omitted, `list_secret_for_all_namespaces()` is used, potentially exposing every Secre ...[truncated 1481 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce_k8s.py:43
Finding: Kubernetes API Server Certificate Verification Is Disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce_k8s.py:63
Finding: Kubernetes Client Private Keys Are Written to Unsafe Temporary Paths
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/huawei_cloud/dispatcher.py:1470
Finding: Read-Only Diagnostic Dispatcher Exposes Destructive Cloud Operations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (404)

Description-Behavior Mismatch

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This code performs live create/replace operations on Kubernetes HorizontalPodAutoscalers, directly modifying cluster behavior despite the skill being advertised as root-cause analysis and report generation. The mismatch makes the capability especially risky because operators and higher-level agent policy may trust the skill as read-only when it is actually mutating production resources.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL-CN.md (reported line 1)May include surrounding context.
md
--- name: root-cause-analyzer description: Use this skill when a Huawei Cloud CCE incident spans alarms, workload rollout, Pod events/logs, recent changes, service topology, nodes, network, or metrics, and the user needs a complete Markdown root-cause report with investigation steps, evidence chain, impact scope, Top3 causes, confidence, and remediation handoff. ---

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a read-only CCE root-cause-analysis/reporting tool, but the findings indicate the broader package likely exposes generic cloud administration, cluster access, and destructive mutation capabilities well outside that purpose. A description-behavior mismatch of this kind is dangerous because users and orchestrators may trust and invoke the skill under a low-risk mental model while it can actually perform privileged operations against clusters, nodes, alarms, workloads, or credentials.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416