Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently lists Huawei Cloud resources, with credential and command-configuration caveats.
Use a read-only Huawei identity and select the intended region/project. Leave the command-override variables unset unless you trust their configuration; the list guard is not a sandbox for replacement programs. The SDK fallback reads cloud keys into memory despite conflicting wording. Verify installer downloads using Huawei's published checksums. All eight artifact files were reviewed and 78 mocked tests passed; live cloud behavior and downloaded dependencies remain unverified.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def _env_credential(markers):
for key, value in os.environ.items():
upper = key.upper()
if not upper.startswith(("HUAWEI", "HW_", "HWC")):
continue
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
list_resource_via_sdk(resource, "cn-north-4", project_id="p-1")
def test_sdk_missing_credentials_surfaces_aksk_hint(self):
clean_env = {k: v for k, v in os.environ.items()
if not k.upper().startswith(("HUAWEI", "HW_", "HWC"))}
with mock.patch.dict(os.environ, clean_env, clear=True), \
mock.patch("list_codearts.subprocess.run",
Without declared permissions the skill's intent is opaque and cannot be validated.
Although subprocess.run uses an argument list without a shell, its executable and prefixed arguments can be replaced through CODEARTS_LIST_HCLOUD_BIN and CODEARTS_LIST_HCLOUD_ARGS. If an untrusted caller or launcher can influence those variables, it can execute a different program with the agent's privileges and inherited cloud credentials, bypassing the list-operation guard.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The environment-to-process flow permits unrestricted executable replacement and argument prefixing, rather than merely supplying read-only API parameters. Exploitation requires influence over the inherited environment, but under that condition the replacement process receives the agent's execution privileges and credentials; shell=False does not prevent this form of executable substitution.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The criteria specify Chinese table labels and require the Chinese messages 「无 CodeArts 资源」 and 「请检查 IAM 权限」 for empty results and permission errors. No user language opt-in or justification for restricting these outputs to Chinese is documented.
The module documentation at L015–L016 states that the script never reads secrets itself. However, _env_credential reads environment values at L604–L610, and L653–L654 invokes it to retrieve the access key and secret key directly into the script. This credential handling is appropriate for the declared SDK fallback, but contradicts the documented secret-handling guarantee.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
% (spec["modules"][0].split(".")[0], exc)
)
client_cls = getattr(root_mod, spec["client"])
region_cls = getattr(region_mod, spec["region"])
request_cls = getattr(root_mod, spec["request"])
query_cls = getattr(root_mod, spec["query"]) if spec.get("query") else None
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
)
client_cls = getattr(root_mod, spec["client"])
region_cls = getattr(region_mod, spec["region"])
request_cls = getattr(root_mod, spec["request"])
query_cls = getattr(root_mod, spec["query"]) if spec.get("query") else None
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
client_cls = getattr(root_mod, spec["client"])
region_cls = getattr(region_mod, spec["region"])
request_cls = getattr(root_mod, spec["request"])
query_cls = getattr(root_mod, spec["query"]) if spec.get("query") else None
ak = _env_credential(("ACCESS_KEY", "_AK"))
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
client_cls = getattr(root_mod, spec["client"])
region_cls = getattr(region_mod, spec["region"])
request_cls = getattr(root_mod, spec["request"])
query_cls = getattr(root_mod, spec["query"]) if spec.get("query") else None
ak = _env_credential(("ACCESS_KEY", "_AK"))
sk = _env_credential(("SECRET_KEY", "_SK"))
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
"安装与区域配置。" % (resource, region, exc)
)
call = getattr(client, _sdk_method(resource))
items = []
offset = 0
for _ in range(max_pages):
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
% str(exc)[:300]
)
raise ApiError("SDK 调用失败：%s" % str(exc)[:300])
batch = list(getattr(response, spec["list_attr"], None) or [])
items.extend(_sdk_item_to_dict(item) for item in batch)
total = getattr(response, spec["total_attr"], None) \
if spec["total_attr"] else None
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
raise ApiError("SDK 调用失败：%s" % str(exc)[:300])
batch = list(getattr(response, spec["list_attr"], None) or [])
items.extend(_sdk_item_to_dict(item) for item in batch)
total = getattr(response, spec["total_attr"], None) \
if spec["total_attr"] else None
if total is not None and len(items) >= total:
break