Huawei Cloud Swr Enterprise Instance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:37 AM UTC
• Version: 0.1.0

Overview

This appears to be a real Huawei Cloud SWR administration skill, but it should be reviewed carefully because it can create credentials, expose registries, and delete cloud resources with weak guardrails.

Install only if you intend to let an agent administer Huawei Cloud SWR enterprise resources. Use a least-privileged IAM user, require explicit human confirmation before delete or credential actions, avoid inline secrets in shell commands, do not use insecure TLS or 0.0.0.0/0 public access except under a documented exception, and pin/review SDK dependencies before running the helper.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: references/task-instance-registries.md:36

Finding

<![CDATA[Registry credentials are exposed through command-line arguments]]>

Content

View full analysis

\ --name=harbor-prod \ --type=swr-pro \ --url=https://harbor.example.com \ --credential.type=basic \ --credential.access_key=admin \ --credential.access_secret= \ --insecure=false \ --description="Production Harbor" \ --cli-region=cn-north-4 ``` The update workflow repeats the same pattern: ```bash hcloud SWR UpdateInstanceRegistry \ --instance_id= \ --registry_id= \ --name=harbor-prod \ --type=swr-pro \ --url=https://harbor.example.com \ --credential.type=basic \ --credential.access_key=admin \ --credential.access_secret= \ --insecure=false \ --description="Updated: Production Harbor v2" \ --cli-region=cn-north-4 ``` ### Technical Analysis The documented workflows instruct users to provide registry passwords, secret keys, or access secrets directly as command-line arguments. Command arguments can be exposed through: - Shell history files - Process inspection tools while the command is running - CI/CD build logs - Terminal session recording - Audit and observability agents - Error reports that reproduce the complete command This conflicts with the Skill's separate instruction that credential secrets must never be exposed or logged. Placeholder values do not eliminate the risk because users are expected to replace them with real credentials. ### Attack Path 1. An operator follows the documented registry creation or update workflow. 2. The operator replaces `` or `` with a real registry secret. 3. The shell stores the command in his ...[truncated 668 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/task-instance-registries.md:47

Finding

<![CDATA[Documented registry workflow disables TLS certificate verification]]>

Content

View full analysis

\ --name=self-signed-harbor \ --type=swr-pro \ --url=https://harbor.internal.local \ --credential.type=basic \ --credential.access_key=admin \ --credential.access_secret= \ --insecure=true \ --cli-region=cn-north-4 ``` ### Technical Analysis The `--insecure=true` setting disables verification of the remote registry's TLS certificate. Encryption without certificate validation does not authenticate the remote endpoint. An attacker capable of intercepting or redirecting network traffic can impersonate the registry. The risk is amplified because the same command transmits basic authentication credentials. A man-in-the-middle endpoint may capture those credentials and manipulate synchronized image content. ### Attack Path 1. An operator configures a self-signed registry using the documented insecure option. 2. An attacker gains a network interception position or modifies DNS/routing for the registry hostname. 3. Because certificate verification is disabled, the malicious endpoint is accepted. 4. Authentication information is sent to the attacker's endpoint. 5. The attacker reuses the credentials against the legitimate registry or supplies modified images during synchronization. ### Impact Assessment A successful attack can disclose registry credentials, expose private images, alter replicated artifacts, and introduce malicious container images into downstream deployment pipelines. The practical scope depends on network position and the registry account's privileges. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/swr_instance_helper.py:367

Finding

<![CDATA[Unsafe argparse boolean conversion can enable destructive options unexpectedly]]>

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/swr_instance_helper.py:261

Finding

<![CDATA[Irreversible instance deletion is executed without an enforced confirmation guard]]>

Content

View full analysis

Remediation

View remediation

`. - In interactive use, display the instance name, region, project, and affected resource summary before confirmation. - Require a separate explicit confirmation for OBS and DNS cleanup. - Support a `--dry-run` mode that shows the intended request without executing it. - Reject deletion in non-interactive environments unless an explicit automation-safe confirmation flag is supplied. - Apply least-privilege IAM policies so identities that only inspect or create instances cannot delete them. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/swr_instance_helper.py:15

Finding

<![CDATA[Huawei Cloud SDK dependencies are installed without version or integrity constraints]]>

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/task-instance-endpoints.md:163

Finding

<![CDATA[Documentation provides a directly executable globally accessible whitelist configuration]]>

Content

View full analysis

\ --ip_list.1.ip=0.0.0.0/0 \ --ip_list.1.description="Allow all" \ --cli-region=cn-north-4 ``` ### Technical Analysis The example configures the public endpoint whitelist as `0.0.0.0/0`, allowing connections from every IPv4 address. Although the comment says to use the setting with caution, the workflow does not require confirmation, a time limit, or compensating controls. Because endpoint-policy updates are documented as full replacements, copying this example may also remove existing restricted entries and replace them with unrestricted access. ### Attack Path 1. An operator copies the globally accessible whitelist example. 2. The endpoint policy replaces the existing restricted whitelist with `0.0.0.0/0`. 3. The SWR endpoint becomes reachable from arbitrary internet addresses. 4. Attackers discover the endpoint and attempt credential stuffing, brute-force authentication, enumeration, or exploitation of exposed services. 5. If credentials or an applicable service vulnerability are available, the attacker accesses registry content or modifies images. ### Impact Assessment The setting does not itself bypass authentication, but it substantially expands the attack surface. Potential consequences include unauthorized image access, account attacks, exploitation attempts, operational load, and increased exposure of the registry authentication interface. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (43)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/command-reference.md (reported line 160)May include surrounding context.

6. Instance Credentials

bash

# Create a long-term access credential
hcloud SWR CreateInstanceLtcredential --instance_id=<instance-id> --name=my-credential --cli-region=cn-north-4

# Create a temporary access credential

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/command-reference.md (reported line 163)May include surrounding context.

6. Instance Credentials

bash

# Create a long-term access credential
hcloud SWR CreateInstanceLtcredential --instance_id=<instance-id> --name=my-credential --cli-region=cn-north-4

# Create a temporary access credential

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/iam-policies.md (reported line 47)May include surrounding context.

md

| `swr:instanceRepository:update`     | Update instance repo         | Modify repository settings                      |
| `swr:instanceArtifact:delete`       | Delete instance artifact     | Remove image versions                           |
| `swr:instanceArtifact:scan`         | Scan instance artifact       | Trigger vulnerability scanning                  |
| `swr:instanceCredential:create`     | Create instance credential   | Obtain access credentials                       |
| `swr:instanceCredential:update`     | Update instance credential   | Enable/disable long-term credentials            |
| `swr:instanceCredential:delete`     | Delete instance credential   | Remove long-term credentials                    |
| `swr:instanceEndpoint:create`       | Create instance endpoint     | Configure VPC internal endpoints                |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/parameter-reference.md (reported line 47)May include surrounding context.

md

| `--url`                     | Yes      | Registry URL             | Target registry address                      |
| `--credential.type`         | Yes      | Auth type                | `basic` only                                 |
| `--credential.access_key`   | Yes      | Access ID/username       | Auth credential                               |
| `--credential.access_secret` | Yes    | Access secret/password   | Auth credential                               |
| `--insecure`                | Yes      | Verify remote cert       | `true` (skip) or `false` (verify)            |
| `--instance_id` (body)      | Cond.    | Target instance ID       | Required when type=swr-pro-internal          |
| `--project_id` (body)       | Cond.    | Target project ID        | Required when type=swr-pro-internal          |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The documentation includes handling of registry access secrets and passwords as command-line parameters, which are highly sensitive and may be exposed via shell history, process listings, logs, or agent traces. In an agent setting, this increases the chance of secret disclosure during automation or debugging.

Content

Scanner excerpt · references/swr-instance-api-guide.md (reported line 326)May include surrounding context.

md

- `--url` (required, body): Registry URL
- `--credential.type` (required, body): Auth type, only `basic` supported
- `--credential.access_key` (required, body): Access ID/username
- `--credential.access_secret` (required, body): Access secret/password
- `--insecure` (required, body): Verify remote cert (`true`=skip, `false`=verify)
- `--description` (optional, body): Registry description
- `--instance_id` (optional, body): Target instance ID (required for `swr-pro-internal`)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Including long-term and temporary credential creation and management in a skill described as lifecycle management introduces a highly sensitive capability mismatch. An agent using this documentation could mint or alter access credentials, enabling persistence, privilege extension, or unauthorized access to registries and CI/CD systems.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Creation of long-term access credentials is a privileged secret-generation capability that can establish durable access to the registry environment. In a skill that is broader than advertised, this is particularly dangerous because it enables persistence and later unauthorized reuse if the generated credentials are mishandled.

Content

Scanner excerpt · references/swr-instance-api-guide.md (reported line 623)May include surrounding context.

Instance Credential Operations

1. Create Long-term Access Credential

bash

hcloud SWR CreateInstanceLtCredential --instance_id=<instance-id> --name=my-credential --cli-region=cn-north-4

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Temporary credential creation is still a sensitive credential-access capability, even if less risky than long-term credentials. In an automated skill, temporary credentials can still be abused for unauthorized pulls, pushes, or reconnaissance if issued without strict scoping, visibility, and handling controls.

Content

Scanner excerpt · references/swr-instance-api-guide.md (reported line 637)May include surrounding context.

Use Case: Long-term credentials for CI/CD pipelines and automation tools.

2. Create Temporary Access Credential

bash

hcloud SWR CreateInstanceTempCredential --instance_id=<instance-id> --cli-region=cn-north-4

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/task-instance-credentials.md (reported line 23)May include surrounding context.

md

## Workflows

### W1: Create a Long-term Access Credential

Long-term credentials are suitable for CI/CD pipelines, automation tools, and persistent access.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/task-instance-credentials.md (reported line 53)May include surrounding context.

md

## Workflows

### W1: Create a Long-term Access Credential

Long-term credentials are suitable for CI/CD pipelines, automation tools, and persistent access.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill references environment-based credentials (HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION) and operational CLI/SDK usage, but it declares no explicit tool scope or permissions boundary. In an agent setting, missing scope metadata can let the skill be invoked with broader access than intended, increasing the chance of credential use, destructive instance operations, or accidental secret exposure during execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list mixes specific terms with broad phrases like "实例管理" and the standalone product terms "SWR 企业版" / "企业仓库实例", which may be invoked in generic discussion rather than an explicit request to use this skill. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest explicitly frames the skill as operating 'via hcloud CLI'. The reference states that instance creation cannot be done with hcloud CLI and instead must use 'python scripts/swr_instance_helper.py', which contradicts the claimed CLI-based operation model for a core lifecycle action.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes 'Huawei Cloud SWR enterprise instance lifecycle management', which naturally covers creating, viewing, updating configuration, and deleting enterprise instances. This command reference goes much further by documenting namespace, registry sync target, repository, artifact, credential, endpoint, domain, and job management commands, which are separate administrative capabilities rather than core instance lifecycle operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The examples place sensitive credentials such as access keys and secrets directly on the command line. On many systems, command-line arguments may be exposed via shell history, process listings, audit logs, or orchestration tooling, causing unintended credential disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The credential-creation examples instruct users to generate long-term and temporary access credentials without any guidance on secure handling, output protection, rotation, or storage. In an admin-focused SWR skill, these credentials likely grant meaningful registry access, so poor handling can directly enable unauthorized image access or modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly states that the long-term credential response includes authentication token material, but it does not warn that this output is sensitive or instruct users to avoid logging, displaying, or persisting it. In an infrastructure-management skill, such documentation increases the chance that users or downstream tooling will expose reusable credentials in chat transcripts, terminals, CI logs, or audit systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The examples show enabling anonymous access without a prominent warning that this may expose registry content to unauthenticated users. In the context of a registry service, anonymous access can unintentionally publish images or metadata and weaken access control assumptions.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Documenting anonymous_access=true as a straightforward example creates an unsafe pattern because it encourages weakening authentication on a registry service. In the context of an agent skill, such examples are especially risky because automation may treat them as normal or recommended operational actions.

Content

Scanner excerpt · references/swr-instance-api-guide.md (reported line 138)May include surrounding context.

bash

# Enable anonymous access
hcloud SWR UpdateInstanceConfiguration --instance_id=<instance-id> --anonymous_access=true --cli-region=cn-north-4

# Disable anonymous access
hcloud SWR UpdateInstanceConfiguration --instance_id=<instance-id> --anonymous_access=false --cli-region=cn-north-4

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document substantially exceeds the stated scope of enterprise instance lifecycle management by covering repository, artifact, registry, credential, endpoint, and domain administration. That scope expansion increases the attack surface and may cause an agent bound to this skill to perform sensitive actions that a user would not reasonably expect from a lifecycle-management skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples normalize use of --insecure=true, which disables certificate verification and permits TLS interception or spoofing attacks. For registry credentials and artifact transfer, this can expose usernames, passwords, and pulled/pushed content to man-in-the-middle attackers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Cross-instance and project-wide repository discovery goes beyond instance-scoped lifecycle management and enables broader enumeration than users may expect. In an agent context, this can leak inventory information across instances and facilitate follow-on targeting of sensitive repositories or artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation teaches creation and management of long-term access credentials without warning about secure storage, limited use, rotation, and revocation. This can lead operators or agents to create durable secrets that are mishandled, retained too long, or exposed through logs and automation systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide shows enabling public access to the instance endpoint without an explicit warning that this increases internet exposure. In a registry context, making endpoints public can expand the attack surface for authentication attacks, misconfiguration abuse, and unintended data exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Tenant-level domain overview is not necessary for enterprise instance lifecycle tasks and exposes broader tenancy metadata. In an automated agent workflow, this widens the accessible security boundary and can reveal external exposure configuration across the tenant.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.