Huawei Device Inspector

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:49 PM UTC
• Version: 1.0.0

Overview

This skill is a Huawei network inspection guide, but it exposes plaintext SSH credentials and disables SSH host verification for infrastructure devices.

Review carefully before installing or using. Treat the embedded SSH password as exposed, rotate it if it corresponds to real devices, remove concrete credentials from the skill, use a secret manager or user-supplied credentials, enable verified SSH host keys, and run inspections only against devices you are authorized to administer.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:15
• Finding: Hard-Coded SSH Credentials for Network Infrastructure## Vulnerability Details **File Location**: `SKILL.md`, lines 15-23 **Vulnerability Type**: Hard-coded plaintext credentials **Risk Level**: High ### Vulnerable Configuration ```text S7703S core switch - Management address: 192.168.255.253 - Username: openclaw - Password: openclaw@2026 AR6280-S router - Management address: 192.168.255.254 - Username: openclaw - Password: openclaw@2026 ``` ### Technical Analysis The Skill embeds reusable SSH usernames and passwords for two network infrastructure devices directly in its documentation. Any user, process, archive, log, source repository, or distribution system with access to the Skill can recover these credentials without additional authorization. The same account and password are reused on both devices, increasing the scope of a single credential disclosure. Although the documented inspection commands are read-only, the actual privileges granted to the `openclaw` account are not established by the reviewed file. An attacker can execute any operations permitted by the device-side account rather than being limited to the commands documented by the Skill. ### Attack Path 1. An attacker obtains access to the Skill package, a repository copy, an artifact archive, or output containing `SKILL.md`. 2. The attacker extracts the management addresses, username, and plaintext password. 3. The attacker obtains network access to the `192.168.255.0/24` management segment or another route capable of reaching the disclosed addresses. 4. The attacker initiates SSH connections to `192.168.255.253` and `192.168.255.254`. 5. The attacker authenticates using the exposed `openclaw` credentials. 6. The attacker enumerates device information and executes any commands authorized for that account. ### Impact Assessment Successful exploitation provides authenticated access to a core switch and router, subject to the permissions assigned to the exposed account. Potential consequences include: - Disclosure of firmware, topology, har ...[truncated 557 chars]
• Remediation: ## Remediation Suggestions 1. Immediately rotate the exposed password on both devices and invalidate all copies of the disclosed credential. 2. Use a unique account and credential for each device to prevent compromise from spreading between systems. 3. Remove usernames and passwords from `SKILL.md`, source control, package archives, examples, logs, and generated reports. 4. Retrieve credentials at runtime from an approved secret manager or protected credential store. 5. Do not pass secrets through command-line arguments or environment mechanisms that can be exposed to unrelated processes. 6. Configure dedicated inspection accounts with read-only permissions limited to the required `display` commands. 7. Restrict SSH access using management VLAN controls, firewall rules, source-address allowlists, and administrative jump hosts. 8. Prefer key-based authentication backed by protected private keys where supported. 9. Review authentication logs for use of the exposed account and investigate unexpected source addresses or commands. 10. Add automated secret scanning to repository and package publication workflows.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34
• Finding: SSH Host Identity Verification Is Disabled## Vulnerability Details **File Location**: `SKILL.md`, line 34 **Vulnerability Type**: Missing SSH host authentication **Risk Level**: High ### Vulnerable Code ```python child = pexpect.spawn(f'ssh -o StrictHostKeyChecking=no {username}@{host}', timeout=60) ``` ### Technical Analysis The SSH command explicitly sets `StrictHostKeyChecking=no`. This prevents the client from failing safely when it encounters an unknown or changed host key. As a result, the automation does not reliably verify that it is communicating with the intended Huawei device before submitting the password. Because the password is subsequently entered through the interactive SSH session, an attacker able to redirect or intercept management traffic can present an attacker-controlled SSH service. The client can accept that endpoint without requiring confirmation of a trusted host key, allowing the attacker to capture the submitted credential. The hostile endpoint could also return fabricated command output, causing the generated inspection report to contain false health or security information. ### Attack Path 1. An attacker gains a network position capable of influencing traffic between the Skill host and a target management address. 2. The attacker uses techniques such as ARP spoofing, route manipulation, DNS manipulation where hostnames are later used, or direct address takeover to redirect the SSH connection. 3. The attacker presents an arbitrary SSH host key from a malicious SSH endpoint. 4. Because strict host-key checking is disabled, the automation does not reject the untrusted endpoint. 5. The automation submits the configured username and password to the malicious endpoint. 6. The attacker captures the credential and can attempt authentication against the genuine devices. 7. The malicious endpoint may additionally provide forged command output, concealing alarms or creating misleading inspection results. ### Impact Assessment Exploitation can expose the SSH credentials used ...[truncated 554 chars]
• Remediation: ## Remediation Suggestions 1. Remove `-o StrictHostKeyChecking=no`. 2. Pre-provision the verified public host keys of each managed device in a dedicated, access-controlled `known_hosts` file. 3. Invoke SSH with explicit fail-closed settings, for example: ```python child = pexpect.spawn( f'ssh -o StrictHostKeyChecking=yes ' f'-o UserKnownHostsFile=/secure/path/huawei_known_hosts ' f'{username}@{host}', timeout=60 ) ``` 4. Validate host-key fingerprints through a trusted out-of-band channel before adding them to `known_hosts`. 5. Treat a missing, changed, or mismatched host key as a security failure and stop the inspection rather than automatically accepting the key. 6. Protect the `known_hosts` file from modification by the Skill account or unrelated users. 7. Use isolated management networks, static address controls, switch protections, and authenticated administrative jump hosts to reduce interception opportunities. 8. Rotate the documented password because the combination of disabled verification and embedded credentials creates a direct credential-theft risk. 9. Log host-key verification failures and alert administrators to unexpected key changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Plaintext SSH credentials and access details are exposed without any secret-handling safeguards or warning, making credential theft trivial for anyone who can read the file. Because the credentials appear to grant administrative access to network devices, compromise could lead to configuration tampering, service disruption, or broader network intrusion.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill embeds real-looking management IPs, usernames, and plaintext passwords for network infrastructure devices directly in documentation. This creates immediate credential exposure risk and enables unauthorized access to core routing/switching equipment, which is far beyond what a generic inspection skill needs to demonstrate functionality.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The title, instructions, trigger keywords, and output template are all specified exclusively in Chinese, which effectively forces a specific language for use and reporting. SQP-3 flags language or locale policy violations when no user opt-in or documented justification for the locale constraint is provided.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The markdown describes connecting over SSH to switches and routers, collecting device state, alarms, and security-risk information, but provides no user-facing warning about authorization, sensitive infrastructure access, or the need to protect collected operational data. For markdown files, safety-relevant behaviors that affect user data, privacy, or system integrity should be disclosed.

Static analysis

No suspicious patterns detected.