Security audit
Security checks for vulnerabilities and agentic risk
The inventory function fits its purpose, but unsafe dependency installation and command overrides require review before use.
Have the installer corrected before use: retain certificate verification, pin and verify dependencies in an isolated environment, and obtain KooCLI through Huawei's documented downloads. Use project-scoped read-only credentials, clear both command override variables, and choose or disable Markdown output. Downloaded installer and dependency contents remain outside the inspected bundle.
scripts/ensure_env.pyDependency installation disables TLS certificate verification
Substituted SDK packages can execute arbitrary code during installation or subsequent import, including accessing cloud credentials available to the process. This attack does not require compromising the legitimate mirrors.
Without declared permissions the skill's intent is opaque and cannot be validated.
The empty-list and permission-error criteria prescribe Chinese messages as required output. The file provides neither user opt-in nor a documented reason for imposing this language regardless of the user's preference.
The installation instructions execute a mutable remote shell script without verifying its integrity or authenticity beyond HTTPS. Compromise of the distribution endpoint could therefore result in arbitrary code execution with the invoking user's privileges, potentially exposing cloud credentials; the read-only ELB API restriction does not constrain installer execution.
The subprocess call is not shell injection, but its reachable caller installs unpinned packages from third-party mirrors using --trusted-host, which relaxes HTTPS certificate verification for those hosts. A network or mirror attacker could supply malicious packages that execute during installation or subsequent import, with access to the process environment and potentially cloud credentials.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
The write-intent guard checks user arguments and the requested operation, but does not check the environment-selected executable or prepended arguments. An attacker-controlled executable can ignore the fixed ListLoadbalancers arguments entirely, so the promised read-only restriction is not an execution boundary when those environment values are attacker-influenced.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
ELB_LIST_HCLOUD_BIN selects the executable, while ELB_LIST_HCLOUD_ARGS supplies arguments without validation before execution. If an attacker can influence the inherited environment through launcher or workspace configuration, these hooks permit arbitrary executable selection and argument injection under the agent's privileges; exploitation depends on that environment-control capability, not shell metacharacters.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)