Security audit

Huawei Cloud Cce Root Cause Analyzer

Security checks across malware telemetry and agentic risk

Overview

The skill is advertised as a CCE root-cause reporter, but its bundled dispatcher also exposes high-impact cloud and Kubernetes administration actions beyond that purpose.

Install only if you intend to grant an agent broad Huawei Cloud and Kubernetes operational authority, not just diagnostic access. Use least-privilege read-only IAM/RBAC credentials where possible, avoid calling undocumented mutation actions, do not request kubeconfig or Secret values unless explicitly needed, and review any confirm=true operation carefully before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (101)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The wrapper for a root-cause-analysis skill rebinds destructive operations such as cluster, node, and workload deletion, plus scaling and resize functions, making them reachable through the same dispatcher surface as read-only diagnostics. This violates least privilege and creates a dangerous capability mismatch: a user invoking an RCA skill could trigger state-changing cloud actions if downstream dispatch registration exposes them.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The alias table exposes delete_cce_cluster, delete_cce_node, and delete_cce_workload in a skill described as investigation-only. Even if not immediately called in this file, exporting these functions into the action surface materially increases the risk of accidental or malicious destructive use through dispatcher registration or future code paths.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The wrapper also exposes workload scaling and node-pool resizing, which are state-changing operations unrelated to passive RCA. In an incident-analysis context, mixing investigative and remediation/mutation actions can worsen outages or allow unauthorized operational changes through a trusted read-only skill path.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file exposes broad state-changing AOM administration capabilities, including creating, updating, enabling, disabling, and deleting alarm and notification rules, even though the skill is described as a root-cause analysis/reporting tool. In an agent setting, these functions materially expand privilege and create a path for accidental or induced security-impacting actions that suppress monitoring or alter operational safeguards.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The module can delete or disable alarm rules and action/notification rules, which can blind operators to outages or attacks and is not justified by the stated RCA purpose. The built-in confirm=true check is only a soft application guard and does not provide real authorization or policy separation, so an agent prompted into destructive actions could silence critical controls.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This file does more than diagnosis: it can perform a live Deployment rollback and can also write a remediation report to an arbitrary path. In the context of a skill explicitly described as a root-cause analyzer, embedding state-changing remediation increases the chance of accidental or unauthorized operational changes, especially because diagnosis and action are coupled in one flow.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The 'Preview-first' docstring understates the fact that the module will execute a real rollback when confirm=true. That mismatch can mislead operators, reviewers, or calling code into treating the module as read-only, increasing the risk of unintended production changes.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This file implements many destructive and state-changing operations such as deleting clusters, deleting nodes, scaling workloads, draining nodes, and binding public EIPs, even though the declared skill purpose is root-cause analysis and reporting. That capability mismatch is dangerous because an analysis-oriented skill can be invoked in higher-trust investigative workflows, turning it into an unexpected operations surface that can disrupt production or expand exposure.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The function returns full kubeconfig material, including client credentials and rendered YAML, which grants cluster API access outside the intended RCA scope. Exposing reusable cluster credentials enables privilege escalation, lateral movement, offline reuse, and persistence if the output is logged, cached, or shown to an untrusted requester.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The secrets-listing function can optionally return full Secret data, which is highly sensitive and not justified for a root-cause analysis skill. Secret disclosure can expose database passwords, API tokens, cloud credentials, and TLS private keys, leading directly to compromise of the cluster and connected systems.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file provides install, update, uninstall, and reconfiguration functions for CCE addons, which materially exceeds the declared purpose of a root-cause-analysis skill. In an RCA context, unexpected write capabilities are dangerous because an agent or user invoking the skill for diagnosis could unintentionally mutate production infrastructure, changing evidence during an incident or causing service disruption.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill includes unjustified cluster-change capabilities such as addon installation/uninstallation and bursting network configuration, despite being presented as a cross-resource diagnosis tool. This mismatch increases the likelihood of privilege misuse, accidental destructive actions, and covert persistence or lateral impact under the guise of troubleshooting.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This file includes write-capable operations that create and delete CCE LogConfig custom resources, which changes cluster logging behavior rather than merely performing root-cause analysis. In an RCA-oriented skill, this expands the blast radius from observation to administration and could let a caller redirect, disable, or alter log collection in ways that hide evidence or affect production telemetry.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code requests temporary Kubernetes cluster certificates, constructs a kubeconfig-equivalent client configuration, and uses it to access CustomObjectsApi. For a diagnostic skill, minting cluster-admin style access materially increases risk because compromise or misuse enables broader cluster reconnaissance and resource modification beyond log analysis.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The function writes analysis outputs to arbitrary local paths when output_dir is provided, which expands the skill from read-only/API analysis into local persistence of potentially sensitive cluster information. In an agent setting, silent filesystem writes can create unintended data retention, expose reports to other local users/processes, or place sensitive artifacts in insecure locations.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: When include_raw is enabled, the code writes raw cluster inventory to disk, including nodes, pods, workloads, services, ingresses, labels, annotations, and topology details. In the RCA skill context, that is broader than necessary and increases the chance of leaking sensitive infrastructure metadata, internal naming, and configuration details through local artifacts.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The module is presented as a read-only scanner, but the implementation performs filesystem writes for reports and optional raw inventory. In security-sensitive automation, misleading read-only framing is dangerous because operators may authorize execution assuming no local side effects, leading to unreviewed storage of sensitive operational data.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The analyzer writes markdown/HTML/JSON reports and historical records to arbitrary local paths, which can persist cluster identifiers, capacity trends, recommendations, and potentially operational context beyond the immediate diagnostic task. In an agent setting, silent local persistence expands the data exposure surface and can violate least-privilege or user expectations, especially on shared hosts or multi-tenant runners.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file implements provisioning and mutation workflows—creating VPCEP endpoints, installing/configuring the virtual-kubelet addon, and deploying smoke-test workloads—instead of limiting itself to root-cause analysis and report generation promised by the manifest. This creates a dangerous scope mismatch: a user or orchestrator invoking an RCA skill could unintentionally trigger infrastructure changes and incur service disruption or cloud cost.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This section plans and performs creation of cloud network endpoints (including SWR/OBS VPCEP dependencies), which is unrelated to investigation-only RCA behavior. In the context of a root-cause analyzer, hidden network mutations are especially risky because they can alter routing/access paths, introduce charges, and change the very environment being investigated.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This code installs and configures the virtual-kubelet addon, modifying cluster runtime behavior well beyond diagnostic collection. Because the manifest frames the skill as cross-resource RCA, this hidden remediation capability is more dangerous: an operator may grant the skill investigative access while not expecting it to change cluster scheduling, networking, or workload placement.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This section creates or patches namespaces and Deployments for smoke testing, introducing new workloads into a production cluster under the guise of diagnosis. In an RCA context, such actions can consume resources, affect scheduling, mask symptoms, or create confusion in incident timelines, making both security and operational risk materially higher.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file contains multiple state-changing administrative operations such as cluster creation, deletion, hibernation, wake-up, and public endpoint changes, which materially exceed the stated root-cause-analysis purpose of the skill. In an RCA-oriented agent context, these capabilities increase the blast radius from read-only diagnosis to infrastructure mutation, enabling accidental or prompt-induced destructive actions.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code can generate and return kubeconfig material, which is effectively cluster access credential issuance. For a skill whose described purpose is cross-resource root-cause analysis, returning kubeconfig is unnecessary and dangerous because it can grant direct API access to the Kubernetes cluster and facilitate lateral movement or full cluster compromise if exposed.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Binding an EIP to the cluster control plane exposes the Kubernetes API publicly, changing the attack surface of the environment. In an RCA skill this is especially dangerous because a diagnostic workflow could be manipulated into making a security-relevant network change that enables external probing, credential attacks, or follow-on compromise.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416