Security audit

Huawei Cloud Cce Workload Failure Diagnoser

Security checks for vulnerabilities and agentic risk

Overview

The skill claims to be read-only diagnosis, but it ships runnable cloud and Kubernetes mutation capabilities plus unsafe credential handling.

Review before installing. Use only tightly scoped read-only Huawei Cloud IAM and Kubernetes RBAC credentials, do not provide admin credentials, and do not run this in production until the dispatcher is restricted to the declared diagnosis actions and the temporary credential-file and TLS verification issues are fixed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce_diagnosis.py:751
Finding: CCE kubeconfig credentials are persisted to predictable temporary files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/network.py:769
Finding: Signed Huawei Cloud NAT requests disable TLS certificate verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce.py:1143
Finding: Kubernetes API connections disable TLS verification while using client certificates
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/huawei_cloud/cce.py:3982
Finding: Client private keys are written through race-prone and fixed temporary paths
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/huawei_cloud/dispatcher.py:1469
Finding: Diagnosis Skill dispatcher exposes destructive cloud and Kubernetes operations
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/huawei_get_node_security_groups.py:128
Finding: Standalone utility accepts account passwords and cloud secrets through command-line arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (458)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This diagnosis skill contains active remediation logic that patches Deployment replica counts and also exposes node-pool expansion elsewhere in the file. In a diagnostic context, hidden write actions against a live cluster are highly dangerous because a caller expecting read-only analysis could trigger production changes, outages, cost increases, or interfere with incident response.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code can stop, start, and reboot ECS instances even though the skill is positioned as a CCE workload failure diagnoser. In this context, those actions are especially dangerous because they can cause production outages, data loss, or service disruption under the guise of a diagnostic workflow, violating user expectations and least privilege.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL-CN.md (reported line 1)May include surrounding context.
md
--- name: workload-failure-diagnoser description: Use this skill for CCE workload rollout failures such as release failed, rolling update stuck, replicas unavailable, Deployment new ReplicaSet not creating Pods, StatefulSet or DaemonSet update blocked, and probe-related readiness failures. ---

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Querying ECS by IP, inspecting security groups, and using IAM password authentication/token acquisition are infrastructure/security inspection features outside the declared workload diagnosis scope. The added authentication modes and network-security access increase sensitivity and attack surface.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/huawei_cloud/cce_nodepool.py:456

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/network.py:781

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/huawei_cloud/storage.py:416