Huawei Cloud Swr Enterprise Instance

• Outcome: Review
• Latest audit: Jun 17, 2026 · 2:33 AM UTC
• Version: 0.1.0

Overview

This skill is mostly coherent for managing Huawei Cloud container registries, but it includes powerful cloud permissions and examples that can expose registries or credentials if used carelessly.

Install only if you intend to let an agent manage Huawei Cloud SWR enterprise registries. Use a least-privilege IAM policy instead of the full-management example where possible, avoid public 0.0.0.0/0 access, do not pass real secrets directly on command lines, prefer validated TLS, and require explicit human confirmation before deleting instances, namespaces, artifacts, credentials, endpoints, or domains.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The document labels part of the workflow as read-only while nearby steps instruct state-changing operations such as instance creation, configuration updates, credential issuance, and deletion. This can mislead operators or automation into performing privileged, billable, or destructive actions under a false safety assumption, increasing the chance of unintended resource changes.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The document explicitly states that the hcloud CLI CreateInstance path is broken and that the Python SDK helper should be used, but the checklist still directs users to the broken CLI command. This inconsistency can cause failed runs, unsafe workarounds, or incorrect automation behavior, especially if agents treat the checklist as authoritative.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The command examples instruct users to place registry access keys and secrets directly on the command line via `--credential.access_key` and `--credential.access_secret`. This is dangerous because command-line arguments are commonly exposed through shell history, process listings, CI logs, terminal recording, and copy/paste into shared tickets or documentation, which can lead to credential disclosure and unauthorized access to external registries.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document includes a full-management IAM policy with destructive and credential-related actions such as instance deletion, credential creation, endpoint updates, and domain changes, all scoped to Resource "*". It also instructs automatic retry after permission expansion without requiring a renewed risk acknowledgment or emphasizing least-privilege narrowing, which can normalize overbroad access grants and increase the chance of unnecessary privileged execution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file explicitly states that the long-term credential response includes authentication token data, but it provides no warning, masking guidance, or handling requirements. In a skill centered on infrastructure lifecycle management, this increases the chance that secrets are printed to logs, surfaced in chat output, or copied into downstream systems where they can be exposed and reused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly shows enabling anonymous access to an enterprise registry configuration without warning about the resulting unauthenticated access exposure. In the context of a container registry management skill, this can lead users to unintentionally expose images or registry access paths to unauthorized parties, materially weakening access control.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide instructs users to configure remote registry credentials and even demonstrates `--insecure=true`, which disables certificate validation, without any warning about credential interception, man-in-the-middle risk, or insecure secret handling. Because this skill manages enterprise registry integrations, insecure transport or poor secret hygiene can expose credentials that grant broad access to image supply chains.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide describes creation of long-term access credentials for CI/CD without warning that these are persistent secrets that can be reused if leaked. In an enterprise registry context, compromise of long-lived credentials can enable unauthorized pushes, pulls, or tampering across software delivery workflows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide shows enabling public access and performing full-replacement whitelist updates without warning that this can expose the registry to the internet or accidentally remove legitimate allowlist entries. In this context, operators could either overexpose an enterprise registry or lock out trusted administrative systems, causing both security and availability issues.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation provides a concrete command to set the public access whitelist to 0.0.0.0/0, which effectively exposes the enterprise registry to the entire internet. Although it says 'use with caution,' that warning is too weak for such a high-risk configuration because users may copy-paste it into production and unintentionally remove all network-based protection.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions direct users to generate temporary and long-term credentials and return them, but provide no warning about secret handling, output exposure, logging, shell history, or secure storage. In an agent or shared terminal context, this can directly leak live credentials into chat transcripts, CI logs, terminal captures, or audit systems, enabling unauthorized registry access.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The checklist repeats an instance-creation command that may incur charges but omits the earlier cost warning, making it easier for users or automation to execute billable actions without noticing financial impact. In procedural checklists, condensed steps are often treated as the actionable source of truth, so omitted warnings materially reduce safety.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script performs irreversible deletion of SWR enterprise instances, and optionally associated OBS/DNS resources, without any confirmation gate, dry-run mode, or explicit risk acknowledgement. In an agent or automation context, this increases the chance of accidental destructive actions from mis-parsed input, prompt injection, or operator error.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.