Huawei Device Inspector

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:49 PM UTC
• Version: 1.0.0

Overview

This skill is a Huawei network inspection guide, but it exposes plaintext SSH credentials and disables SSH host verification for infrastructure devices.

Review carefully before installing or using. Treat the embedded SSH password as exposed, rotate it if it corresponds to real devices, remove concrete credentials from the skill, use a secret manager or user-supplied credentials, enable verified SSH host keys, and run inspections only against devices you are authorized to administer.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:15

Finding

Hard-Coded SSH Credentials for Network Infrastructure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-23
Vulnerability Type: Hard-coded plaintext credentials
Risk Level: High

Vulnerable Configuration

text

S7703S core switch
- Management address: 192.168.255.253
- Username: openclaw
- Password: openclaw@2026

AR6280-S router
- Management address: 192.168.255.254
- Username: openclaw
- Password: openclaw@2026

Technical Analysis

The Skill embeds reusable SSH usernames and passwords for two network infrastructure devices directly in its documentation. Any user, process, archive, log, source repository, or distribution system with access to the Skill can recover these credentials without additional authorization.

The same account and password are reused on both devices, increasing the scope of a single credential disclosure. Although the documented inspection commands are read-only, the actual privileges granted to the openclaw account are not established by the reviewed file. An attacker can execute any operations permitted by the device-side account rather than being limited to the commands documented by the Skill.

Attack Path

1. An attacker obtains access to the Skill package, a repository copy, an artifact archive, or output containing SKILL.md.
2. The attacker extracts the management addresses, username, and plaintext password.
3. The attacker obtains network access to the 192.168.255.0/24 management segment or another route capable of reaching the disclosed addresses.
4. The attacker initiates SSH connections to 192.168.255.253 and 192.168.255.254.
5. The attacker authenticates using the exposed openclaw credentials.
6. The attacker enumerates device information and executes any commands authorized for that account.

Impact Assessment

Successful exploitation provides authenticated access to a core switch and router, subject to the permissions assigned to the exposed account. Potential consequences include:

• Disclosure of firmware, topology, har ...[truncated 557 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately rotate the exposed password on both devices and invalidate all copies of the disclosed credential.
2. Use a unique account and credential for each device to prevent compromise from spreading between systems.
3. Remove usernames and passwords from SKILL.md, source control, package archives, examples, logs, and generated reports.
4. Retrieve credentials at runtime from an approved secret manager or protected credential store.
5. Do not pass secrets through command-line arguments or environment mechanisms that can be exposed to unrelated processes.
6. Configure dedicated inspection accounts with read-only permissions limited to the required display commands.
7. Restrict SSH access using management VLAN controls, firewall rules, source-address allowlists, and administrative jump hosts.
8. Prefer key-based authentication backed by protected private keys where supported.
9. Review authentication logs for use of the exposed account and investigate unexpected source addresses or commands.
10. Add automated secret scanning to repository and package publication workflows.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34

Finding

SSH Host Identity Verification Is Disabled

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 34
Vulnerability Type: Missing SSH host authentication
Risk Level: High

Vulnerable Code

python

child = pexpect.spawn(f'ssh -o StrictHostKeyChecking=no {username}@{host}', timeout=60)

Technical Analysis

The SSH command explicitly sets StrictHostKeyChecking=no. This prevents the client from failing safely when it encounters an unknown or changed host key. As a result, the automation does not reliably verify that it is communicating with the intended Huawei device before submitting the password.

Because the password is subsequently entered through the interactive SSH session, an attacker able to redirect or intercept management traffic can present an attacker-controlled SSH service. The client can accept that endpoint without requiring confirmation of a trusted host key, allowing the attacker to capture the submitted credential. The hostile endpoint could also return fabricated command output, causing the generated inspection report to contain false health or security information.

Attack Path

1. An attacker gains a network position capable of influencing traffic between the Skill host and a target management address.
2. The attacker uses techniques such as ARP spoofing, route manipulation, DNS manipulation where hostnames are later used, or direct address takeover to redirect the SSH connection.
3. The attacker presents an arbitrary SSH host key from a malicious SSH endpoint.
4. Because strict host-key checking is disabled, the automation does not reject the untrusted endpoint.
5. The automation submits the configured username and password to the malicious endpoint.
6. The attacker captures the credential and can attempt authentication against the genuine devices.
7. The malicious endpoint may additionally provide forged command output, concealing alarms or creating misleading inspection results.

Impact Assessment

Exploitation can expose the SSH credentials used ...[truncated 554 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove -o StrictHostKeyChecking=no.
2. Pre-provision the verified public host keys of each managed device in a dedicated, access-controlled known_hosts file.
3. Invoke SSH with explicit fail-closed settings, for example:

python

child = pexpect.spawn(
    f'ssh -o StrictHostKeyChecking=yes '
    f'-o UserKnownHostsFile=/secure/path/huawei_known_hosts '
    f'{username}@{host}',
    timeout=60
)

4. Validate host-key fingerprints through a trusted out-of-band channel before adding them to known_hosts.
5. Treat a missing, changed, or mismatched host key as a security failure and stop the inspection rather than automatically accepting the key.
6. Protect the known_hosts file from modification by the Skill account or unrelated users.
7. Use isolated management networks, static address controls, switch protections, and authenticated administrative jump hosts to reduce interception opportunities.
8. Rotate the documented password because the combination of disabled verification and embedded credentials creates a direct credential-theft risk.
9. Log host-key verification failures and alert administrators to unexpected key changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Plaintext SSH credentials and access details are exposed without any secret-handling safeguards or warning, making credential theft trivial for anyone who can read the file. Because the credentials appear to grant administrative access to network devices, compromise could lead to configuration tampering, service disruption, or broader network intrusion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill embeds real-looking management IPs, usernames, and plaintext passwords for network infrastructure devices directly in documentation. This creates immediate credential exposure risk and enables unauthorized access to core routing/switching equipment, which is far beyond what a generic inspection skill needs to demonstrate functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The title, instructions, trigger keywords, and output template are all specified exclusively in Chinese, which effectively forces a specific language for use and reporting. SQP-3 flags language or locale policy violations when no user opt-in or documented justification for the locale constraint is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown describes connecting over SSH to switches and routers, collecting device state, alarms, and security-risk information, but provides no user-facing warning about authorization, sensitive infrastructure access, or the need to protect collected operational data. For markdown files, safety-relevant behaviors that affect user data, privacy, or system integrity should be disclosed.

Content

No source excerpt is available for this finding.