Security audit
Security checks for vulnerabilities and agentic risk
The skill is described as read-only storage diagnosis, but its shipped dispatcher exposes broad cloud and Kubernetes administration actions plus secret-reading paths that users would not reasonably expect.
Review before installing. Only use this skill with tightly read-only Huawei IAM and Kubernetes RBAC credentials, and preferably after removing or hard-blocking non-storage actions, Secret data return, kubeconfig export, and all mutation handlers from the dispatcher. Do not provide credentials that can delete clusters, drain nodes, mutate workloads, read Secret values, or manage ECS/EIP/AOM resources.
scripts/huawei_cloud/dispatcher.py:1469Read-only storage Skill exposes destructive and unrelated cloud administration actions
scripts/huawei_cloud/cce.py:3313Dispatcher can return Kubernetes Secret values across namespaces
scripts/huawei_cloud/storage.py:410Authenticated Huawei Cloud and Kubernetes requests disable TLS certificate verification
scripts/huawei_cloud/cce.py:3379Kubernetes client private keys are written to predictable temporary files
The compatibility alias map includes destructive and mutating operations such as delete_cce_cluster, delete_cce_node, delete_cce_workload, resize_node_pool, and scale_cce_workload, which are unjustified for a diagnosis skill. Even if some operations use confirmation logic elsewhere, exposing them through this wrapper enables accidental or malicious destructive changes under the guise of troubleshooting.
The skill can enumerate Kubernetes Secrets and, when include_data=true, return secret contents directly to the caller. For a storage diagnosis skill this is unjustified credential exposure that can leak database passwords, API keys, tokens, and certificates, enabling lateral movement or full cluster/application compromise.
The skill can stop, start, and reboot ECS instances even though its manifest presents it as a storage failure diagnoser. These actions can directly disrupt workloads, cause downtime, and potentially lead to data loss, and their presence in a diagnostic skill makes accidental or adversarial invocation much more dangerous because users and orchestrators may not expect destructive compute actions.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
name: storage-failure-diagnoser
description: Use this skill for CCE Kubernetes storage failures such as PVC Pending, provisioning failures, PV/PVC binding issues, EVS topology conflicts, VolumeAttachment attach failures, FailedMount, SFS/SFS Turbo NFS timeout, OBS 403 or credential errors, runtime IO errors, read-only filesystem, capacity or inode exhaustion, subPath mount deadlocks, and PVC Terminating protection. The skill must produce a complete Markdown diagnosis report with process, evidence, conclusion, confidence, and remediation guidance.
---
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
The skill is presented as a read-only storage diagnoser, but the analysis indicates the underlying package may expose broad cloud administration, Kubernetes mutation, secret access, report writing, and arbitrary infrastructure operations well beyond the declared purpose. That mismatch is a serious trust-boundary violation: users or orchestrators may invoke the skill expecting narrow diagnostic behavior while actually granting a general-purpose privileged cloud operator with access to sensitive resources and destructive actions.
Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification