T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/iam-policies.md:69- Finding
Permission Failure Workflow Recommends an Account-Wide Governance Policy
- Content
View full analysis
- Remediation
View remediation
Security audit
Huawei Cloud Swr Image Governance
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Huawei Cloud SWR governance helper, but it can steer users toward broad account-wide write permissions for sensitive registry administration tasks.
Install only if you intend an agent to help administer Huawei Cloud SWR. Prefer read-only or task-specific IAM policies, avoid granting the full wildcard governance policy for narrow tasks, and manually review any command that changes permissions, retention rules, shared domains, or agency delegation before running it.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger list includes generic phrases such as "namespace permissions" and "repository permissions" without requiring Huawei Cloud or SWR context. In a markdown skill description, these broad terms can overlap with many unrelated permission-management requests and may cause unintended invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill documents retention-rule creation, update, and deletion workflows that can automatically delete image tags, but it does not require an explicit pre-execution warning or confirmation step before destructive retention behavior is configured or removed. In an infrastructure governance context, this is dangerous because users may unintentionally enable cleanup rules that delete production artifacts or assume deletion effects are reversible when they are not.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document includes commands that create agency delegation without an explicit warning that this changes trust relationships and enables additional service capabilities. In an operational skill focused on governance and permissions, omission of impact warnings can cause users to apply privilege-affecting changes they do not fully understand, increasing the chance of unintended access expansion or configuration drift.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples show permission-granting commands for namespace and repository access but do not explicitly warn that these commands modify other users' effective access, with namespace-level changes potentially affecting all repositories under the namespace. In this skill context, that is especially sensitive because the skill is specifically designed for image governance and access control, so users may copy commands directly and unintentionally overgrant privileges.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document provides a full write-capable IAM policy covering permission grants, updates, deletions, retention changes, domain management, and agency creation, but it does not prominently warn that these actions can change access control, revoke access, expose images, or disrupt registry governance. In a skill specifically designed to manage SWR permissions and governance, operators may copy and apply the policy wholesale, increasing the chance of over-privileged access and accidental destructive or security-sensitive changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The agency creation section mentions use cases but does not prominently warn that creating the agency delegates cross-service access to SWR on the user's behalf. In a cloud administration context, this can cause users to authorize broader trust relationships affecting OBS/CCE access without understanding the privilege and governance implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The guide documents updating and deleting retention rules without clearly warning that retention policies can trigger irreversible image/tag cleanup and operational disruption if misconfigured. In an infrastructure-management skill, omission of destructive-impact warnings can lead users to unintentionally delete artifacts needed for deployment, rollback, or forensics.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation includes a state-changing
CreateAgencycommand that modifies account delegation without any explicit warning, confirmation guidance, or discussion of required authorization. In an agent skill context, this increases the risk that an automated assistant or user will execute the command as a routine setup step, unintentionally granting SWR additional cross-service access and changing the account's trust configuration.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file includes commands to create, update, and delete repository permissions, which can affect access to private images and operational integrity. Although there are checklists and verification steps, the documentation does not clearly warn users that these actions change authorization and may unintentionally grant or revoke access for other principals.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The creation examples configure automated cleanup for container tags, but the guidance does not prominently and repeatedly warn that tags not matched by selectors/rules may later be deleted. In an image-governance skill, this is dangerous because users may copy examples into production repositories and unintentionally create destructive retention policies, causing irreversible loss of deployable images and operational disruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Updating an existing retention rule changes future deletion behavior, yet the workflow lacks a clear warning that a seemingly small change to selectors, days, or tag count can cause subsequent automated cleanup of tags that were previously retained. In this SWR governance context, that can lead to irreversible image deletion, broken rollback paths, and production recovery risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes this skill's retention capability as creating, listing, updating, and deleting image retention rules. In the retention management file, scenario S4 instructs users to call
hcloud SWR ListReposDetails, which is a repository inventory operation rather than a retention-rule operation. That extends behavior beyond the file's claimed retention-management scope.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document provides step-by-step instructions to create shared download domains that enable external image access, but it does not clearly warn that this expands the repository's exposure boundary or advise readers to validate necessity, scope, and lifecycle before enabling sharing. In an image-governance skill, omission of access-control risk context can lead to unintended public or cross-organization distribution of container images, increasing the chance of data leakage or unauthorized consumption.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This markdown file documents responses containing user IDs, usernames, namespace permissions, domain IDs, and feature-gate states, which can reveal access-control and environment details. The file provides no warning that these values may be sensitive and should be handled or shared carefully.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The operations table uses Chinese text for the descriptions while the rest of the document is in English, which imposes a specific language on part of the skill content without user opt-in or an alternative. This can violate language/locale policy expectations for consistent, user-selectable communication.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The operation table uses Chinese text for key descriptions like 查询组织权限, 创建组织权限, 修改组织权限, and 删除组织权限, while the rest of the document is in English. This effectively imposes a language choice on users without opt-in or justification, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
Nearly all example commands hard-code
--cli-region=cn-north-4, which effectively steers users into a specific regional configuration. The file does not state that this is only an example or provide guidance for selecting another region, which can violate language/locale choice expectations.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Several operation descriptions are written only in Chinese while the rest of the skill content is in English, which imposes a language assumption without user opt-in. There is no note that the skill is intended for Chinese-speaking users or that bilingual output is expected.
- Content
Static analysis
No suspicious patterns detected.