ClawHub
Back to skill

Security audit

huawei-cloud-ecs-show

Security checks for vulnerabilities and agentic risk

Overview

This server lookup skill needs review because unchecked settings can change what runs and where authenticated requests go.

Before installing, have the unchecked command overrides removed or restricted and region values validated against trusted endpoints. Use a dedicated read-only cloud identity rather than relying on the script's guard. The SDK fallback reads credentials directly, and Markdown export overwrites the selected file. The supplied scanners do not establish malicious intent; the Review verdict rests on the verified execution and endpoint-scoping gaps.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Environment overrides bypass the promised ShowServer-only execution guard.

High
Category
Excessive Agency
Confidence
97% confidence
Finding

The guards inspect user arguments and the requested operation, but do not constrain the environment-selected executable or prepended CLI arguments. Consequently, an environment-controlled replacement executable can ignore the appended ShowServer arguments entirely and perform local or cloud mutations, undermining the skill's central read-only guarantee; this becomes especially consequential when the available credentials have write permissions.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The guide claims the script never reads AK/SK, but explicitly describes an SDK fallback that reads those credentials from the environment.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

L16–L17 state that authentication is fully delegated to the active KooCLI profile and that the script never reads AK/SK. However, L38–L40 explicitly describe the SDK fallback reading AK/SK environment variables, contradicting that assurance about the script's credential handling.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/show_ecs.py (reported line 291)May include surrounding context.

python
cmd.extend(extra)
    cmd.extend(argv)
    try:
        proc = subprocess.run(
            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            timeout=120, universal_newlines=True,
        )

Tainted flow: 'cmd' from os.environ.get (line 285, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
94% confidence
Finding

The executable and prepended arguments come from environment variables without validation, allowing an attacker who can influence the inherited environment to select arbitrary executable code running with the agent's permissions and credential access. This is executable/argument injection rather than shell injection, and exploitation requires control of those environment values.

Content

Scanner excerpt · scripts/show_ecs.py (reported line 291)May include surrounding context.

python
cmd.extend(extra)
    cmd.extend(argv)
    try:
        proc = subprocess.run(
            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            timeout=120, universal_newlines=True,
        )

Acceptance criteria require Chinese-only error messages without a language choice.

Low
Category
Output Handling
Confidence
90% confidence
Finding

These criteria require specific Chinese error messages for invalid instance IDs, missing instances, and permission failures. They provide no user language choice or documented justification for fixing these outputs to Chinese.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.