T08 · Insecure Dependencies
Warning
- Location
references/task-kubectl-setup.md:17- Finding
Unverified kubectl Binary Installed into a Privileged System Path
- Content
View full analysis
- Remediation
View remediation
Security audit
Huawei Cloud Cce Workload Manager
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Huawei Cloud Kubernetes workload manager, but it asks for sensitive kubeconfig and cluster-management authority with some overly broad and unsafe examples that deserve review before installation.
Install only if you are comfortable giving the agent Kubernetes and Huawei Cloud authority. Use a narrowly scoped IAM user, avoid federation kubeconfig unless truly needed, prefer short-lived kubeconfigs, verify kubectl downloads, avoid cluster-admin examples by default, and never paste real passwords into command-line arguments or chat transcripts.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/task-config-secret-storage.md:20- Finding
Passwords Exposed Through kubectl Command-Line Arguments
- Content
View full analysis
create secret generic --from-literal=password=s3cret -n ` | | Create docker-registry | `kubectl --kubeconfig= create secret docker-registry regcred --docker-server=swr.cn-north-4.myhuaweicloud.com --docker-username= --docker-password= -n ` | ``` The registry-password pattern is repeated in the same file at lines 91–92: ```bash kubectl --kubeconfig= create secret docker-registry regcred --docker-server=swr.cn-north-4.myhuaweicloud.com --docker-username= --docker-password= -n ``` Related occurrences include: - `SKILL.md`, line 248 - `references/common-pitfalls.md`, line 183 ### Technical Analysis The examples encourage users to replace placeholders with real passwords directly in command-line arguments. Depending on the execution environment, complete commands may be retained in: - Shell history - Agent conversations and execution transcripts - CI/CD job logs - Terminal session recording - Process accounting and endpoint telemetry - Process listings available to other local users - Troubleshooting or audit records Although Kubernetes transmits the resulting Secret through the configured API connection, placing the plaintext value in the command itself unnecessarily exposes it before transmission. Kubernetes Secret values being base64 encoded does not protect credentials from users or processes that can retrieve the Secret. ### Attack Path 1. A user substitutes a real application or registry password into the documented command. 2. The command is executed in an interactive shell, Agent session, or CI/CD runner. 3. The complete command is ca ...[truncated 984 chars]- Remediation
View remediation
password.txt kubectl --kubeconfig="$KUBECONFIG_PATH" \ create secret generic db-secret \ --from-file=password=password.txt \ -n "$NAMESPACE" rm -f password.txt ``` 3. For registry credentials, create a protected Docker configuration file through an approved credential-management process and import it: ```bash kubectl --kubeconfig="$KUBECONFIG_PATH" \ create secret generic regcred \ --from-file=.dockerconfigjson="$HOME/.docker/config.json" \ --type=kubernetes.io/dockerconfigjson \ -n "$NAMESPACE" ``` 4. Prefer a secrets manager, external-secrets operator, sealed-secret workflow, or CI/CD secret-file mechanism so plaintext credentials are not exposed to the Agent or command logs. 5. Configure CI/CD systems to mask sensitive values and disable shell tracing around secret operations. 6. Ensure temporary files use mode `0600`, are created outside shared directories, and are deleted immediately after use. 7. Warn users that base64 encoding in Kubernetes Secrets is not encryption and recommend encryption at rest plus restrictive RBAC for Secret access. 8. Replace literal example passwords such as `s3cret` with explicit non-secret placeholders and add a warning not to insert real credentials directly into commands. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (589)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill includes an inline example that creates a Kubernetes Secret from a literal password on the command line. Even though the text elsewhere warns against exposing secrets, this specific pattern can leak credentials through shell history, process listings, logging systems, terminal capture, and copied transcripts.
- Content
md # ConfigMap kubectl --kubeconfig=~/.kube/cce-kubeconfig.yaml create configmap app-config --from-literal=key1=value1 -n production kubectl --kubeconfig=~/.kube/cce-kubeconfig.yaml get configmaps -n production # Secret kubectl --kubeconfig=~/.kube/cce-kubeconfig.yaml create secret generic db-secret --from-literal=password=s3cret -n production
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
This section centers the skill around obtaining kubeconfig, which is a sensitive cluster access credential. In the context of an agent skill, documenting and operationalizing credential acquisition materially increases the chance of credential exposure, misuse, or use as a bridge to broader cluster actions.
- Content
md ## Overview CCE workload management uses a two-layer permission model: Huawei Cloud IAM controls access to kubeconfig generation (hcloud CLI), and Kubernetes RBAC controls what operations can be performed with kubectl after kubeconfig is obtained. Both layers must be configured correctly for the skill to function. ## Huawei Cloud IAM Read-Only Operations
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The listed IAM actions explicitly authorize creation or retrieval of kubeconfig artifacts, which are credentials for cluster access. Providing these permissions in a reusable skill lowers the barrier to credential harvesting or unauthorized operational access if the skill is invoked in the wrong context.
- Content
md | API Action | Permission | Purpose | | -------------------------- | ----------------- | -------------------------------------- | | `cce:cert:create` | Create cert | Obtain CCE cluster kubeconfig | | `ucs:kubeconfig:create` | Create kubeconfig | Obtain UCS-managed cluster kubeconfig | | `ucs:federationKubeconfig:get` | Get federation | Download federation kubeconfig |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
Federation kubeconfig retrieval is especially sensitive because it may enable multi-cluster access from a single credential. In a workload-management skill, that broadens blast radius considerably if mishandled or overgranted.
- Content
md | API Action | Permission | Purpose | | -------------------------- | ----------------- | -------------------------------------- | | `cce:cert:create` | Create cert | Obtain CCE cluster kubeconfig | | `ucs:kubeconfig:create` | Create kubeconfig | Obtain UCS-managed cluster kubeconfig | | `ucs:federationKubeconfig:get` | Get federation | Download federation kubeconfig | ## Minimum Read-Only Policy (JSON)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
The same section also references downloading federation kubeconfig, which can aggregate access across clusters. This is more dangerous than ordinary cluster read access because a single mishandled credential can affect multiple environments.
- Content
md | -------------------------- | ----------------- | -------------------------------------- | | `cce:cert:create` | Create cert | Obtain CCE cluster kubeconfig | | `ucs:kubeconfig:create` | Create kubeconfig | Obtain UCS-managed cluster kubeconfig | | `ucs:federationKubeconfig:get` | Get federation | Download federation kubeconfig | ## Minimum Read-Only Policy (JSON)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
The same section also references downloading federation kubeconfig, which can aggregate access across clusters. This is more dangerous than ordinary cluster read access because a single mishandled credential can affect multiple environments.
- Content
md | -------------------------- | ----------------- | -------------------------------------- | | `cce:cert:create` | Create cert | Obtain CCE cluster kubeconfig | | `ucs:kubeconfig:create` | Create kubeconfig | Obtain UCS-managed cluster kubeconfig | | `ucs:federationKubeconfig:get` | Get federation | Download federation kubeconfig | ## Minimum Read-Only Policy (JSON)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The 'minimum read-only policy' still includes permissions to obtain kubeconfig, which is itself a sensitive credential regardless of downstream RBAC limitations. In practice, exposing even read-only cluster credentials can reveal infrastructure details, workloads, secrets metadata, and become a foothold for further abuse.
- Content
Minimum Read-Only Policy (JSON)
This policy allows obtaining kubeconfig but kubectl operations will be limited to read-only based on Kubernetes RBAC:
json {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
The policy JSON concretely grants kubeconfig creation and federation retrieval actions, making credential access directly actionable. Such copy-pastable examples increase the likelihood of broad deployment without careful scoping or review.
- Content
md "ucs:cluster:get", "ucs:quota:get", "cce:cert:create", "ucs:kubeconfig:create", "ucs:federationKubeconfig:get" ], "Resource": ["*"]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
This line continues the explicit inclusion of federation kubeconfig permissions within a general-use policy. That bundling can unintentionally grant multi-cluster credential access to operators who only need single-cluster workload management.
- Content
md "ucs:quota:get", "cce:cert:create", "ucs:kubeconfig:create", "ucs:federationKubeconfig:get" ], "Resource": ["*"] }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
The note may reduce perceived risk by focusing on RBAC limits after kubeconfig issuance, but obtaining kubeconfig is already a sensitive event. This framing can cause users to underestimate the security implications of granting credential-generation permissions.
- Content
}
text ⚠️ **Note**: This policy grants IAM permission to obtain kubeconfig, but actual kubectl permissions depend on Kubernetes RBAC. With default RBAC, a read-only IAM policy results in read-only kubectl access. ## Full Management Policy (JSON)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The document introduces write-capable kubeconfig acquisition, which creates a direct bridge from cloud IAM policy to powerful cluster operations. In an agent-integrated skill, this substantially increases the consequences of misconfiguration or unauthorized invocation.
- Content
Full Management Policy (JSON)
This policy grants IAM permission to obtain kubeconfig with write-capable RBAC:
json {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
This policy line includes kubeconfig creation permissions in a 'full management' template, which can be readily applied as-is. Combining credential issuance with broad management intent raises the risk of persistent overprivileged access.
- Content
md "cce:cluster:list", "cce:cert:create", "ucs:cluster:get", "ucs:kubeconfig:create", "ucs:federationKubeconfig:get", "ucs:quota:get" ],
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
Including federation kubeconfig retrieval in the full-management policy further broadens scope to multi-cluster access. If assigned unnecessarily, a compromise of this credential path could impact entire fleets rather than a single cluster.
- Content
md "cce:cert:create", "ucs:cluster:get", "ucs:kubeconfig:create", "ucs:federationKubeconfig:get", "ucs:quota:get" ], "Resource": ["*"]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 78% confidence
- Finding
The permission-assignment steps normalize obtaining kubeconfig as a standard part of the workflow and pair it with guidance to create additional RBAC bindings. In a skill context, this combination increases operational risk by encouraging credential issuance plus privilege expansion in one path.
- Content
md 5. Select the custom policy and confirm 2. **Kubernetes RBAC**: 1. Obtain kubeconfig via hcloud CLI 2. Check current permissions with `kubectl auth can-i` 3. Create RoleBinding or ClusterRoleBinding as needed 4. Verify permissions with `kubectl auth can-i` again
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Task: Kubeconfig Acquisition ## Operations Catalog