Huawei Cloud Cce Storage Failure Diagnoser

• Outcome: Review
• Latest audit: Jun 17, 2026 · 1:36 AM UTC
• Version: 0.1.0

Overview

The skill is advertised as read-only storage diagnosis, but its shipped dispatcher exposes broad Huawei Cloud and Kubernetes administration actions, including destructive and credential-sensitive operations.

Install only if you intend to grant this package broad Huawei Cloud and Kubernetes administration authority, not just read-only storage diagnosis. Use tightly scoped read-only credentials where possible, avoid passing credentials with delete/write permissions, and treat unlisted dispatcher actions as available attack surface until the package is split or allowlisted to the documented storage-diagnosis actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (222)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The wrapper exposes a wide set of cloud administration functions through the dispatcher, including cluster, network, IAM, compute, and storage operations that exceed the stated purpose of a storage-failure diagnostic skill. This overbroad capability violates least privilege and creates a large attack surface if the skill is invoked unexpectedly or composed by another agent.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The file aliases destructive operations such as delete_cce_cluster, delete_cce_node, and delete_cce_workload into the active command surface of a skill advertised for diagnosis. In this context, exposing deletion primitives is highly dangerous because a user or upstream agent expecting diagnostics could instead trigger irreversible infrastructure loss.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The script exposes resize_node_pool and scale_cce_workload, which are state-changing operations not required for diagnosing PVC, PV, EVS, or CSI issues. Even without deletion, scaling and resizing can disrupt workloads, change spend, mask root causes, or be abused to alter cluster state under the guise of diagnostics.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The module documentation presents the script as a query/monitoring wrapper, while the actual exported interface includes destructive and mutating operations. This mismatch increases the risk of unsafe trust assumptions by reviewers, orchestrators, and users, enabling dangerous capabilities to hide behind a benign description.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file contains broad AOM monitoring and alarm-management capabilities far beyond the stated storage-failure diagnosis scope, including listing alarms, creating rules, updating rules, and analyzing cluster-wide alert data. In an agent skill, this scope expansion is dangerous because a user invoking a storage diagnoser could be given an interface that enumerates or manipulates unrelated monitoring assets, increasing blast radius and enabling privilege misuse.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can create, update, enable, disable, and delete AOM alarm and action-rule resources, which are active management operations unrelated to passive storage diagnosis. Even with a confirm flag, these functions let the skill mutate monitoring configuration and potentially suppress or remove alerts, which could hide outages, weaken detection, or disrupt incident response if exposed through the agent.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements active rollback/remediation logic against Kubernetes Deployments even though the skill metadata describes a storage diagnosis skill. That scope mismatch is dangerous because a user invoking a diagnosis-oriented skill could unintentionally trigger infrastructure changes to unrelated workloads, especially if downstream tooling passes confirm=true automatically.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The auto-remediation flow diagnoses rollout/application failures and can decide to roll back Deployment revisions, which is unrelated to the stated storage-failure purpose. In context, this broadens the skill from storage troubleshooting into workload mutation, creating a confused-deputy risk where operators trust a storage tool but it acts on application availability instead.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Providing Deployment rollback capability inside a storage diagnosis skill grants write access that is not justified by the declared functionality. If exposed through an agent dispatcher, this can be abused or accidentally invoked to alter running applications, causing downtime, rollback to vulnerable versions, or operational confusion.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code writes a report to a caller-supplied output_file path without restriction, which enables arbitrary local file write within the agent’s filesystem permissions. In a skill whose purpose is remote storage diagnosis, this unnecessary file-system side effect increases attack surface and could overwrite sensitive files or plant data in unexpected locations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file’s behavior is materially inconsistent with the declared skill purpose: it performs autoscaling diagnosis, enumerates cluster workloads, events, addons, node pools, and can inspect Cluster Autoscaler state. In a storage-failure diagnoser, this is an over-broad and misleading capability expansion that can cause unauthorized data access, unexpected API usage, and trust-boundary violations because operators will invoke it under a narrower storage-support expectation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Fetching and parsing Cluster Autoscaler pod logs is unrelated to storage-failure diagnosis and exposes operationally sensitive log content that may include infrastructure details, error traces, identifiers, or misconfiguration clues. Because the manifest does not justify this access, the behavior increases the skill’s effective privilege and broadens data collection beyond user intent.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: Writing reports to arbitrary local paths introduces an undeclared side effect for a diagnostic skill and can persist potentially sensitive cluster findings outside expected channels. If the output_file parameter is user-controlled, this also creates file-write risk such as overwriting files within the agent’s writable scope or leaving sensitive artifacts on disk.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements broad cluster administration capabilities far beyond storage-failure diagnosis, including deletion, scaling, workload mutation, EIP binding, hibernation, and kubeconfig retrieval. This violates least privilege and materially expands the blast radius: a skill invoked for diagnostics can also perform destructive or persistence-enabling actions if misused or prompted indirectly.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill can enumerate Kubernetes Secrets and optionally return their data, which may include service-account tokens, registry creds, TLS material, API keys, and application secrets. That access is unrelated to storage diagnosis and creates a direct credential-exfiltration path from within an overprivileged diagnostic tool.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill exposes kubeconfig and client certificate material for cluster access, effectively minting reusable credentials for the Kubernetes API. In a diagnostic context this is especially dangerous because a user expecting read-only troubleshooting could instead obtain privileged cluster access outside the skill boundary.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Arbitrary pod log retrieval exceeds the stated storage-diagnosis scope and may expose sensitive runtime data such as credentials, tokens, PII, internal URLs, or business data emitted by applications. Because it accepts arbitrary pod and namespace targets, it can be used for broad reconnaissance across workloads unrelated to storage issues.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Binding or unbinding a public EIP on the cluster control plane changes network exposure of the Kubernetes API server and is unrelated to storage diagnosis. This can accidentally or intentionally expose the control plane to the internet, increase attack surface, or disrupt existing access paths.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements active CCE addon lifecycle and reconfiguration operations well beyond a storage-failure diagnoser’s declared purpose. In an agent skill, unjustified write capabilities are dangerous because they let a prompt or user trigger cluster changes such as install, update, uninstall, or network reconfiguration instead of performing read-only diagnosis.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can create and delete arbitrary CCE addons via install_cce_addon and uninstall_cce_addon, which is unrelated to diagnosing PVC, PV, EVS, or CSI failures. In the context of an automated agent, this creates an unnecessary path to modify or disrupt cluster components, potentially causing outages, degraded observability/networking, or persistence changes if invoked mistakenly or abusively.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: configure_cce_bursting_addon performs write-side network and scheduling configuration changes for the virtual-kubelet bursting addon, which is outside the declared storage troubleshooting scope. Because it patches live addon values including subnet, project, VPC-related fields, misuse could alter cluster scheduling/network behavior and create service disruption unrelated to the user’s diagnostic request.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This file adds broad application-log querying, recent-log retrieval, anomaly analysis, and Kubernetes audit-log discovery/inspection that are outside the declared storage-failure diagnosis scope. In a diagnosis-oriented skill, this creates unnecessary access to sensitive operational and security telemetry, increasing the chance of data over-collection, misuse, or privilege abuse if the skill is invoked with valid credentials.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill can create and delete CCE LogConfig custom resources, which changes cluster log collection behavior instead of only diagnosing storage failures. Because LogConfig controls where and how logs are collected, these write operations can be abused to redirect, broaden, suppress, or disrupt logging, exceeding the advertised read/diagnose role of the skill.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Application log management and audit-log inspection are not justified by the manifest for a storage-failure diagnoser and materially broaden the observable data surface. Even if intended for troubleshooting, these capabilities can expose sensitive app data, user identities, request metadata, and operational history unrelated to storage incidents.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file claims to support storage-failure diagnosis, but the implementation performs broad CCE health inspection focused on CPU, ELB traffic, pod crashes, replica mismatch, alarms, and general cluster diagnostics rather than PVC/PV/CSI/EVS-specific workflows. In an agent system, this scope mismatch is dangerous because it can cause the wrong skill to be selected, expose unrelated cluster-wide telemetry, and produce misleading remediation for storage incidents, increasing the chance of operational mistakes during incident response.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416