Security audit
Security checks for vulnerabilities and agentic risk
This cloud inventory skill needs review because command overrides bypass its advertised read-only safeguards.
Prefer a corrected version that constrains command overrides, rejects unsupported regions, and accurately documents credential handling. Use dedicated read-only credentials and a trusted CLI in a controlled environment. Offline tests passed with five SDK-dependent skips; live cloud behavior and downloaded installer/dependency contents were not verified.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
)
def _env_credential(markers):
for key, value in os.environ.items():
upper = key.upper()
if not upper.startswith(("HUAWEI", "HW_", "HWC")):
continue
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def _clean_credential_env(self):
return {
key: value for key, value in os.environ.items()
if not key.upper().startswith(("HUAWEI", "HW_", "HWC"))
}
Without declared permissions the skill's intent is opaque and cannot be validated.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
DWS_LIST_HCLOUD_BIN selects an arbitrary executable, while DWS_LIST_HCLOUD_ARGS supplies unchecked arguments before the fixed DWS command, outside the write-intent guard. If an attacker can influence the inherited environment, these test-oriented hooks permit execution under the agent's identity with its inherited cloud credentials; shell=False does not prevent executable substitution.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The SDK fallback interpolates an unvalidated region into a URL, so URI delimiters can move the apparent myhuaweicloud.com suffix into the path rather than keep it in the hostname. For example, a region shaped like attacker.example/ produces a hostname of dws.attacker.example, potentially directing authenticated SDK traffic to an attacker-controlled service when the CLI is absent; this does not imply the secret key itself is transmitted.
The guide specifies that credential problems are surfaced as 缺少 AK/SK 凭证, requiring a Chinese diagnostic regardless of the user's language. It provides neither language opt-in nor a documented justification for this locale constraint.