Huawei Cloud Cce Workload Failure Diagnoser

• Outcome: Review
• Latest audit: Jun 17, 2026 · 1:35 AM UTC
• Version: 0.1.0

Overview

The skill is described as a read-only Huawei CCE workload diagnoser, but the packaged dispatcher exposes powerful cloud, cluster, credential, secret, and remediation actions beyond that purpose.

Install only after reviewing it as a broad Huawei Cloud administration toolkit, not as a narrow read-only diagnoser. Use a least-privilege IAM user that cannot delete or mutate clusters, nodes, workloads, addons, EIPs, AOM rules, HSS state, or Kubernetes secrets unless you explicitly want those powers. Avoid passing confirm=true unless you intend a real production change, and prefer a split or patched version that exposes only the documented diagnostic actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (128)

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: A workload rollout diagnoser should be narrowly scoped, but the documented actions allow broad cluster inspection such as generic pod listing, cluster-wide event retrieval, log access, and storage/network exploration. Even if read-only, this expands data exposure and makes it easier to collect sensitive operational details unrelated to the user's stated workload issue.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: Directly invoking node and network diagnosis from a workload-focused skill expands the blast radius into adjacent domains with different sensitivity and privilege requirements. That makes it easier to pivot from a narrow diagnostic request into broader infrastructure reconnaissance without clear user intent or separate authorization.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The file says cross-domain issues should be handed off to dedicated skills, yet it also instructs users to run node and network diagnosis actions directly here. This internal contradiction weakens operator expectations and policy enforcement, making accidental overreach more likely and undermining least-privilege boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill is described as a workload failure diagnoser, but the exported aliases expose broad cloud inventory and monitoring functions across ECS, VPC, ELB, EVS, IAM, and AOM. This expands the blast radius far beyond the declared purpose and violates least-privilege expectations for a diagnostic skill, enabling unnecessary discovery of infrastructure topology and metadata.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The compatibility alias table exposes destructive and state-changing operations such as delete_cce_cluster, delete_cce_node, delete_cce_workload, resize_node_pool, and scale_cce_workload inside a skill marketed for diagnosis. In this context, an operator or upstream agent could invoke destructive functions through a trusted diagnostic interface, causing outages or irreversible infrastructure changes.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module docstring states the script queries resources and monitoring data, but the actual exported surface includes deletion and scaling capabilities. This capability mismatch can mislead reviewers, operators, and policy engines into granting trust or permissions inappropriate for the real behavior of the code.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This module includes create, update, delete, enable, and disable operations for AOM alarm and notification rules, which are materially broader than the stated workload-failure diagnosis purpose. In an agent setting, this expands the skill from read-oriented diagnosis into write-capable monitoring administration, increasing the chance of accidental or unauthorized changes that can suppress alerts or alter monitoring coverage.

Context-Inappropriate Capability

High

• Confidence: 84% confidence
• Finding: The code manages generic AOM resources such as action/notification rules and mute rules that are not necessary for diagnosing CCE workload rollout or availability failures. That scope creep creates unnecessary privilege requirements and raises the risk that the skill can be used to weaken monitoring or interfere with unrelated operational controls.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This code performs a live Deployment rollback by calling replace_namespaced_deployment after only a parameter-based confirmation check, which exceeds the declared diagnosis-only purpose of the skill. In an agent setting, capability drift from diagnostics into mutation is dangerous because users or upstream orchestrators may invoke the skill expecting read-only behavior, but it can change production cluster state and trigger outages or unauthorized remediation.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The auto_remediation entrypoint chains diagnosis, rollback execution, recovery polling, and optional report-file output, creating a broad control surface inconsistent with the advertised workload-diagnoser role. In security terms, this hidden operational authority increases the chance of unsafe autonomous actions, misuse by other tools, and unexpected writes to both cluster resources and the local environment.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The function writes a markdown report to an arbitrary path supplied in output_file, even though local file modification is not required for workload diagnosis. This can be abused to overwrite or plant files on the host running the agent, especially if the process has elevated filesystem access or runs in a sensitive automation environment.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill claims to diagnose workload failures, but it also implements destructive management actions such as cluster deletion, node deletion, workload deletion, scaling, hibernation, and node draining. In an agent context, adding broad write/destructive capabilities beyond the stated diagnostic purpose materially increases blast radius and makes prompt-induced or mistaken execution far more dangerous.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The function returns full kubeconfig content, including client certificate/key material and cluster endpoints, which can grant direct Kubernetes API access. Exposing reusable access material to callers is far beyond diagnosis and can enable credential theft, persistence, and cluster compromise.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill enumerates Kubernetes Secrets and can optionally return secret data, which is unrelated to rollout or probe failure diagnosis. This creates a direct secret disclosure path for tokens, passwords, certificates, and other sensitive material stored in the cluster.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Binding or unbinding a public EIP on the cluster control plane changes network exposure of the Kubernetes API and is unrelated to failure diagnosis. Enabling public API reachability can expand the attack surface and facilitate external access attempts against the control plane.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file provides mutating cluster-management operations such as addon installation, upgrade, removal, and network/bursting reconfiguration, even though the skill is presented as a workload-failure diagnoser. That scope mismatch is dangerous because a user or upstream agent invoking a supposedly diagnostic skill could unintentionally gain infrastructure-changing capabilities that disrupt cluster availability or alter networking.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The presence of install, update, uninstall, and bursting configuration logic gives this skill powerful state-changing permissions unrelated to diagnosing rollout or replica failures. In the context of a troubleshooting skill, this increases the chance of privilege misuse, accidental destructive actions, and covert repurposing of the skill to modify cluster components or networking under the guise of diagnosis.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata frames this as a workload failure diagnoser, but the file includes create and delete operations for CCE LogConfig resources. Those actions modify cluster logging configuration and can stop or redirect log collection, which exceeds a read-only diagnostic scope and creates an integrity/availability risk if invoked by an agent or user who expected analysis-only behavior.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The recovery-plan generator produces concrete workload modification actions such as scaling workloads and increasing CPU limits, even though the skill is described as a diagnoser. In an agentic environment, diagnostic output can be consumed downstream by automation or operators without adequate validation, turning a read-only diagnosis tool into an implicit change-planning component that may cause unintended production modifications.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The function implements capacity forecasting, autoscaling simulation, HPA preview generation, and report/history persistence, which materially exceeds the declared workload-failure diagnosis scope. In an agent-skill setting, this scope expansion is dangerous because users or orchestrators may invoke the skill expecting read-only diagnosis while the code also supports operational planning outputs and data retention behavior that were not clearly declared.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code generates actionable HPA manifests for uncovered deployments, moving from diagnosis into configuration guidance. Even though it does not directly apply changes here, producing ready-to-use scaling manifests in a supposedly diagnostic skill can mislead downstream agents or users into operational changes without proper approval, review, or sizing validation.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code writes summaries, markdown/HTML reports, SVG charts, and history records to local disk, which is unrelated to the manifest's narrow diagnosis promise and increases data exposure. In an agent environment, undisclosed persistence can retain sensitive cluster metadata longer than expected and create new access paths through local files, backups, or shared workspaces.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements provisioning and mutation workflows for CCE-to-CCI bursting, including VPCEP creation, addon installation/configuration, and workload deployment, which materially exceeds the declared skill purpose of workload failure diagnosis. In an agent setting, this scope mismatch is dangerous because a user invoking a diagnosis skill could trigger infrastructure changes, cost-incurring actions, or cluster state modifications under the guise of troubleshooting.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code creates VPCEP endpoints, enumerates route tables, and installs/configures the virtual-kubelet addon, all of which are privileged control-plane and networking changes unrelated to pure failure diagnosis. These actions can alter connectivity, incur charges, expand attack surface, and change workload scheduling behavior; the mismatch is more dangerous because the surrounding skill is presented as a diagnoser, lowering operator suspicion.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The smoke workload function creates namespaces and creates or patches Deployments, introducing write capability outside the declared diagnosis scope. Even though it asks for confirmation, it still enables cluster mutation, image pulls, and resource consumption from a skill users would reasonably expect to be observational, which can be abused or accidentally invoked to modify production environments.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/huawei_cloud/storage.py:416