ClawHub
Back to skill

Security audit

Huawei Cloud Cci Instance Management

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Huawei CCI management, but it includes unsafe helper-script execution and broad/destructive cloud capabilities that need review before use.

Review and fix the helper before installing: replace shell=True with an argument list, validate region values, pin dependencies, and require explicit confirmation for every delete or bulk cleanup path. Use least-privilege Huawei credentials scoped to the intended project and region, and treat Secret, RBAC, public IP, and namespace deletion guidance as privileged administration.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/cci_network_helper.py:70
Finding

Shell Command Injection Through the Region Argument

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/cci_network_helper.py:33
Finding

Unpinned Security-Sensitive Runtime Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (31)

Tainted flow: 'headers' from os.environ.get (line 197, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cci_network_helper.py (reported line 143)May include surrounding context.

python
headers = sign_request("POST", host, resource_path, body, ak, sk, project_id)

    resp = requests.post(url, data=body.encode("utf-8"), headers=headers)
    result = json.loads(resp.text)

    if resp.status_code == 201:

Tainted flow: 'headers' from os.environ.get (line 197, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cci_network_helper.py (reported line 199)May include surrounding context.

python
headers = sign_request("GET", host, resource_path, "", ak, sk, project_id)

    resp = requests.get(url, headers=headers)
    result = json.loads(resp.text)

    if resp.status_code == 200:

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill claims broad CCI lifecycle management via hcloud CLI with two-step confirmation for destructive actions, but the referenced behavior appears narrower and includes direct OpenAPI/helper-script usage plus at least one delete path without enforced confirmation. This mismatch is dangerous because operators may trust safeguards and coverage that are not actually implemented, leading to accidental destructive actions or execution of less-reviewed code paths.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
| Create/query/delete Namespace | [references/task-namespace-management.md](references/task-namespace-management.md) |
| Create/query/delete Network | [references/task-network-management.md](references/task-network-management.md) |
| Create/query/update/delete/scale Deployment | [references/task-deployment-management.md](references/task-deployment-management.md) |
| Create/query/update/delete StatefulSet | [references/task-statefulset-management.md](references/task-statefulset-management.md) |
| Create/query/delete Pod | [references/task-pod-management.md](references/task-pod-management.md) |
| Create/query/delete EIPPool | [references/task-eippool-management.md](references/task-eippool-management.md) |
| Query status, view logs, events | [references/task-logs-and-status.md](references/task-logs-and-status.md) |

Memory Manipulation

High
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/cci-operation-catalog.md (reported line 52)May include surrounding context.

md
| `readAppsV1NamespacedStatefulSet` | Read StatefulSet |
| `readAppsV1NamespacedStatefulSetStatus` | Read StatefulSet status |
| `patchAppsV1NamespacedStatefulSet` | Update StatefulSet |
| `replaceAppsV1NamespacedStatefulSet` | Replace StatefulSet |
| `deleteAppsV1NamespacedStatefulSet` | Delete StatefulSet |
| `deleteAppsV1CollectionNamespacedStatefulSet` | Delete all StatefulSets in namespace |

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Secret management is high-risk because it enables reading, modifying, and deleting sensitive credentials and configuration data, yet the skill is described as container instance lifecycle management rather than secret administration. In this context, undocumented secret-handling capability creates a path for credential disclosure or tampering that is disproportionate to the user’s expected task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

RBAC management is especially dangerous because it permits creating or modifying RoleBindings and inspecting cluster roles, which can be used to expand privileges or alter authorization boundaries. Since the skill’s stated purpose is CCI instance management, embedding authorization-administration features creates unnecessary privilege-escalation potential in normal operational flows.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
| `cci:statefulset:get` | Read StatefulSet |
| `cci:statefulset:list` | List StatefulSets |
| `cci:statefulset:update` | Update StatefulSet |
| `cci:statefulset:delete` | Delete StatefulSet |
| `vpc:vpcs:list` | List VPCs (for Network creation) |
| `vpc:subnets:get` | Read subnet details (for Network creation) |

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/cci-operation-catalog.md (reported line 53)May include surrounding context.

md
| `cci:statefulset:get` | Read StatefulSet |
| `cci:statefulset:list` | List StatefulSets |
| `cci:statefulset:update` | Update StatefulSet |
| `cci:statefulset:delete` | Delete StatefulSet |
| `vpc:vpcs:list` | List VPCs (for Network creation) |
| `vpc:subnets:get` | Read subnet details (for Network creation) |

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/iam-policies.md (reported line 28)May include surrounding context.

md
| `cci:statefulset:get` | Read StatefulSet |
| `cci:statefulset:list` | List StatefulSets |
| `cci:statefulset:update` | Update StatefulSet |
| `cci:statefulset:delete` | Delete StatefulSet |
| `vpc:vpcs:list` | List VPCs (for Network creation) |
| `vpc:subnets:get` | Read subnet details (for Network creation) |

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/task-statefulset-management.md (reported line 86)May include surrounding context.

md
| `cci:statefulset:get` | Read StatefulSet |
| `cci:statefulset:list` | List StatefulSets |
| `cci:statefulset:update` | Update StatefulSet |
| `cci:statefulset:delete` | Delete StatefulSet |
| `vpc:vpcs:list` | List VPCs (for Network creation) |
| `vpc:subnets:get` | Read subnet details (for Network creation) |

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/cci_network_helper.py (reported line 10)May include surrounding context.

python
#!/usr/bin/env python3
"""
CCI Network Creation Helper Script

This script creates a CCI Network by directly calling the CCI OpenAPI,
bypassing hcloud CLI's limitation with annotation keys containing dots.

hcloud CLI treats dots in annotation keys as nested object delimiters,
making it impossible to pass 'network.alpha.kubernetes.io/default-security-group'
via CLI parameters or --cli-jsonInput (which also doesn't properly transmit
annotations in actual API requests, despite showing them in --dryrun).

Usage:
    python cci_network_helper.py create \
        --namespace <ns-name> \
        --name <network-name> \
        --vpc-id <vpc-id> \
        --subnet-id <neutron-subnet-id> \
        --network-id <neutron-network-id> \
        --security-group-id <sg-id> \
        --region <region>

    python cci_network_helper.py delete \
        --namespace <ns-name> \
        --name <network-name> \
        --region <region>

    python cci_network_helper.py st

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This is a concrete tool-parameter abuse issue: externally supplied input is passed into a shell command, enabling abuse of the tool execution boundary. In an agent environment, user-controlled parameters reaching subprocess execution can turn a cloud-management skill into an arbitrary command execution primitive on the agent host.

Content

Scanner excerpt · scripts/cci_network_helper.py (reported line 74)May include surrounding context.

python
import subprocess
    try:
        cmd = f"hcloud IAM KeystoneListProjects --cli-region={region} --cli-output=json"
        result = subprocess.run(
            cmd, capture_output=True, timeout=15,
            encoding="utf-8", errors="replace", shell=True,
        )

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill describes operational use of shell, network access, environment/config inspection, and a Python helper script, but does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens containment and review because an execution environment may grant broader capabilities than users or platform policy expect, especially for a cloud-management skill capable of creating and deleting infrastructure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list contains broad terms like 'namespace', 'deployment', 'pod', and generic container-related phrases that can cause unintended invocation outside the intended Huawei CCI context. In a cloud-management skill, accidental routing is risky because it may surface destructive operational guidance or propose commands in the wrong context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
### Credential Security

- **Never expose AK/SK values** in conversation, commands, or output
- **Never ask user to input AK/SK directly** in conversation
- **Only use** `hcloud configure list` to check credential status (presence only, not values)
- **Prefer** profile mode or environment variables over explicit AK/SK parameters

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The catalog lists destructive operations such as delete and collection-delete actions without visible warnings, scope cautions, or reminders about confirmation requirements. In an agent-driven workflow, missing safety cues increases the likelihood of accidental deletion of namespaces or bulk resource removal, especially because the skill advertises broad lifecycle management.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The catalog materially expands the skill’s effective capability beyond the stated CCI instance lifecycle scope by documenting administrative operations for Secrets, RBAC, Services, Ingress, Jobs, Endpoints, and API discovery. In an agent setting, exposing broader cloud-control functions than declared increases the chance of unintended privileged actions, data exposure, or misuse through prompt confusion or capability overreach.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Hard-coding a default region of cn-north-4 can cause users to create, inspect, or delete resources in an unintended geography without explicit confirmation. In an infrastructure-management skill, region mistakes can lead to compliance issues, operational impact, unexpected data residency exposure, and accidental modification of the wrong environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The EIPPool workflow provisions a public IP for a pod but does not clearly warn that this exposes the workload to the public Internet and may incur ongoing bandwidth/EIP charges. In a container-management skill, omission of this warning increases the chance that users unintentionally publish a service or create billable external networking resources without understanding the security and cost implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document enumerates broad create/delete permissions, including namespace deletion that can cascade to all contained resources, but does not clearly warn about the destructive effect or recommend least-privilege scoping. In an operational skill for full lifecycle CCI management, this can normalize granting excessive rights and increase the chance of accidental or over-broad privilege assignment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/task-statefulset-management.md (reported line 92)May include surrounding context.

hcloud CCI deleteAppsV1NamespacedStatefulSet --name= --namespace= --cli-region=

text

**WARNING:** PVCs created by volumeClaimTemplates are NOT automatically deleted when the StatefulSet is deleted. Manual cleanup is required:

```bash
hcloud CCI deleteCoreV1NamespacedPersistentVolumeClaim --name=<pvc-name> --namespace=<ns-name> --cli-region=<region>

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest frames this skill as operating CCI via the hcloud CLI, but the documentation explicitly directs users to use a Python helper script for Network creation because the CLI cannot handle dotted annotation keys. That means the documented behavior extends beyond the claimed CLI-only operating model.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest claims full lifecycle management using hcloud CLI, but these sections state that annotations with dots are a confirmed hcloud limitation and that users must use a Python helper script instead, especially for Network resources. This is a direct description-behavior mismatch because the documented implementation is not fully achievable through the advertised CLI interface.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/verification-method.md (reported line 63)May include surrounding context.

md
Two-step confirmation process:

1. **Test without confirmation:** show preview and warning only, do not execute deletion.
2. **Test with confirmation:** verify the resource is actually deleted by attempting to read it (should return 404 or empty result).

## 8. Complete Verification Checklist

Static analysis

No suspicious patterns detected.