Security audit
Security checks for vulnerabilities and agentic risk
This cloud inventory skill needs review because it requires extra downloaded telemetry software without explaining what information it sends.
Review the telemetry component before installing this version. Prefer a version that makes telemetry installation and execution optional, documents what it sends and where, and authenticates a pinned release independently. Setting SKILL_QUALITY_REPORT=0 does not establish that installation or wrapper execution is avoided. Use an isolated environment, credentials limited to dms:instance:list, and trusted executable configuration. All bundled files were inspected; the downloaded software remains outside this review, and no malicious payload or actual data theft was established.
The inventory-only description omits mandatory installation and execution of an additional telemetry component, expanding the workflow to persistent host changes and remotely supplied code. The body does disclose this dependency, so it is not wholly concealed, but the DMS write-intent guard does not constrain the installer or wrapper's access to the credential-bearing environment.
The read-only inventory framing does not capture the installation of executables and supporting modules into the user's persistent executable directory. Although telemetry is mentioned later in the document, making this unrelated component mandatory expands the trust boundary beyond Huawei DMS GET requests and exposes the host if the downloaded release is compromised.
The chunk concerns setup of skill-quality-cli rather than Huawei Cloud instance discovery. Nothing supplied connects that tool to KooCLI, the Huawei Cloud SDK fallback, or another supporting part of the declared workflow. This is an undeclared, unrelated installation capability. The assessment is limited to the visible commands and comments; the contents and side effects of the referenced installation scripts cannot be verified.
The matched request fetches JSON rather than directly executing a script, but that JSON selects the executable package subsequently installed. Because both the package URL and expected digest come from the same mutable, unsigned manifest, compromise of that release channel can produce an accepted malicious installation despite the checksum validation.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
An unrelated telemetry executable is made a prerequisite for a task that only needs DMS read access, with automatic installation if absent. This unnecessarily introduces remotely supplied code into an environment that may contain cloud credentials; disabling reporting does not necessarily avoid installing or executing the wrapper.
All hcloud commands must pass through telemetry tooling, but the document does not specify collected fields, reporting destinations, redaction, or retention. The wrapper can observe command arguments and potentially inventory output, creating an inadequately disclosed confidentiality risk; the supplied material does not establish that secrets are actually transmitted.
The instructions download a mutable latest installer and immediately execute it without a pinned version or independent integrity verification. HTTPS reduces transit risk, but a compromised distribution endpoint could still deliver arbitrary code with the invoking user's privileges; the installation heading alone does not establish informed approval of those effects.
The guide explicitly requires an additional telemetry executable and forbids direct hcloud use if installation fails, unnecessarily coupling credentialed inventory work to unrelated tooling. The component is declared in this guide, contrary to that part of the finding, but neither telemetry data handling nor a functional bypass is provided.
This helper automatically installs persistent executable code from a mutable remote manifest, expanding an inventory task into host software installation. SHA256 checking and archive path/link checks are useful defenses, but an attacker controlling the manifest can supply both a malicious package and its matching digest.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
The manifest describes listing DMS instances using KooCLI or the Huawei Cloud SDKs, but this script downloads a separate skill-quality-cli package (L26–L48) and installs executable files and supporting modules under ~/.local/bin (L78–L88). Installing this unrelated tool is not required for DMS inventory and is not declared in the manifest; manual invocation and checksum verification do not resolve that purpose mismatch.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
DMS_LIST_HCLOUD_BIN selects an arbitrary executable, and DMS_LIST_HCLOUD_ARGS supplies arguments before the fixed read-only operation, without either being checked by the guards. If an attacker can influence these environment variables in an agent or job configuration, they can run code with the process's privileges and inherited cloud credentials; shell=False does not prevent execution of an attacker-selected program. This is a conditional configuration trust-boundary issue, not an exploit through ordinary instance-name arguments, and its significance is reduced if the execution environment is exclusively trusted.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
env = self._clean_env(HUAWEI_ACCESS_KEY="ak", HUAWEI_SECRET_KEY="sk",
HUAWEI_PROJECT_ID="proj")
with mock.patch.dict(os.environ, env, clear=True):
client = __import__("list_dms")._sdk_client("rabbitmq", "cn-north-4")
self.assertEqual(client._credentials.ak, "ak")
self.assertEqual(client._credentials.sk, "sk")
self.assertEqual(client._credentials.project_id, "proj")
Lines 14, 15, and 18 explicitly require Chinese error hints, while lines 7–8 prescribe Chinese messages and table labels. These requirements impose a specific output language without offering user opt-in or documenting why the skill requires that locale.
The manifest explicitly includes empty instance lists among error scenarios that must produce a hint and a non-zero exit. At L732–L734, an empty list instead returns 0; with --json, L728–L730 prints [] and returns 0 before the empty-list hint is reached.
The manifest explicitly includes empty instance lists among conditions that produce a non-zero exit. However, L473–L479 invoke main with empty results for both engines and assert exit code 0, establishing a success contract that contradicts the declared behavior and prevents exit-code-based callers from detecting this condition.