Security audit
Security checks for vulnerabilities and agentic risk
This cluster-listing skill needs review because its required telemetry is insufficiently explained and environment overrides weaken its read-only guarantee.
Before installing, verify the telemetry wrapper and its data collection, or disable reporting with SKILL_QUALITY_REPORT=0. Use a project-scoped read-only cloud identity and remove or tightly control CCE_LIST_HCLOUD_BIN and CCE_LIST_HCLOUD_ARGS. All eight bundled files were inspected; the external wrapper and downloaded installer remain outside that evidence. The artifacts support Review, without establishing credential theft or malicious intent.
The security-relevant mismatch is that environment overrides control the executable and prepend unchecked arguments despite the claimed ListClusters-only execution guarantee. If an attacker can influence the process environment, execution can escape that guarantee with the agent's permissions and inherited credentials; the incomplete table is a separate correctness defect.
The guards inspect user arguments and the requested operation, but not the environment values used to build the actual executable and argument list. Consequently, an environment-controlling attacker can bypass the promised read-only execution boundary even though build_command itself always contains ListClusters.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def _env_credential(markers):
for key, value in os.environ.items():
upper = key.upper()
if not upper.startswith(("HUAWEI", "HW_", "HWC")):
continue
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def _env_project_id():
for key, value in os.environ.items():
upper = key.upper()
if upper.startswith(("HUAWEI", "HW_", "HWC")) and "PROJECT_ID" in upper and value:
return value
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
ListClustersRequest(no_such_param=1)
def test_sdk_fallback_missing_env_credentials_raises_config(self):
env = {k: v for k, v in os.environ.items()
if not k.upper().startswith(("HUAWEI", "HW_", "HWC"))}
with mock.patch.dict(os.environ, env, clear=True):
with self.assertRaises(ConfigError) as ctx:
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
[_FakeCluster(CLUSTER_1), _FakeCluster(CLUSTER_2)])
captured["client"] = fake_client
env = {k: v for k, v in os.environ.items()
if not k.upper().startswith(("HUAWEI", "HW_", "HWC"))}
env.update({"HUAWEI_ACCESS_KEY": "test-ak",
"HUAWEI_SECRET_KEY": "test-sk",
Without declared permissions the skill's intent is opaque and cannot be validated.
The guide mandates a telemetry-collecting intermediary for authenticated cloud commands, introducing a reporting purpose beyond cluster inventory without specifying collected fields, destinations, or retention. This creates a privacy and trust-boundary risk if command metadata or inventory output is reported, although the supplied source does not establish the wrapper's actual payload or prove credential exfiltration.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
CCE_LIST_HCLOUD_BIN selects an arbitrary executable and CCE_LIST_HCLOUD_ARGS supplies unchecked leading arguments to subprocess.run. An attacker who can influence these environment values can cause unintended program execution with inherited credentials; no shell-metacharacter injection is required.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The error-handling workflow explicitly specifies Chinese output for empty results, permission failures, and CLI usage errors. These are prescribed user-facing messages rather than incidental Chinese documentation, and the skill provides neither language opt-in nor a justified locale constraint.
The empty-list and permission-error criteria prescribe specific Chinese messages as required output. No user opt-in, locale selection, or justification for requiring Chinese is provided in this file.
The guide specifies the Chinese message 缺少 AK/SK 凭证 for credential failures without conditioning it on the user's language preference. No language opt-in or justification for this fixed localization is provided.
The manifest promises a default table containing every returned field, but normalize_cluster constructs a fixed dictionary of twelve selected fields and discards everything else. The table renderer only sees those normalized dictionaries, so its union-of-fields logic cannot recover omitted metadata, specification, status, or top-level fields.