ClawHub
Back to skill

Security audit

huawei-cloud-gaussdb-list

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious with medium confidence because scanners report that its setup downloads and runs an external installer, and environment settings may redirect its command execution beyond the stated read-only inventory purpose.

Consider the suspicious verdict and the incomplete scan before installing. The Skillspector scan covered 8 of 9 components and had a partial static-analysis result; the external installer was not available for review, and runtime permissions are unknown. Avoid using it where environment settings or cloud credentials could be influenced by untrusted parties.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

Although CLI setup is related to the stated workflow, executing a downloaded installer is a material capability beyond the explicitly read-only behavior and differs from the promised SDK fallback when KooCLI is missing. The remote script's contents are not supplied, so its precise effects and safety cannot be established. The mismatch is installation and external-code execution, not merely the absence of listing logic in this reference chunk.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Markdown export requires Chinese column headers without an explicit user language choice.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

L26 explicitly requires a Chinese header for Markdown exports, and L27 specifies the Chinese column labels. This fixes the output language without user opt-in or a documented justification; it is an output requirement rather than merely documentation written in Chinese.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list_gaussdb.py (reported line 332)May include surrounding context.

python
cmd.extend(extra)
    cmd.extend(argv)
    try:
        proc = subprocess.run(
            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            timeout=120, universal_newlines=True,
        )

Tainted flow: 'cmd' from os.environ.get (line 326, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
87% confidence
Finding

GAUSSDB_LIST_HCLOUD_BIN selects an arbitrary executable, while GAUSSDB_LIST_HCLOUD_ARGS supplies unrestricted arguments before the fixed operation, without passing through the operation guard. If an attacker can influence these environment variables across a trust boundary, they can select an interpreter and execution arguments, running code with the agent's filesystem and cloud-credential access despite the read-only claim; trusted operator-only environment control substantially reduces this risk.

Content

Scanner excerpt · scripts/list_gaussdb.py (reported line 332)May include surrounding context.

python
cmd.extend(extra)
    cmd.extend(argv)
    try:
        proc = subprocess.run(
            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            timeout=120, universal_newlines=True,
        )

Table output requires Chinese headers without a user-selectable language.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The rendering contract explicitly specifies fixed Chinese headers, implemented by the hard-coded table column labels. There is no language selection or documented justification for imposing Chinese output; the JSON option changes the output format rather than offering a locale choice.

Content

No source excerpt is available for this finding.

The skill mandates Chinese-language table headers without offering a language choice.

Low
Category
Output Handling
Confidence
94% confidence
Finding

The description explicitly sets Chinese headers as the default human-readable output, without user opt-in or an option to select another language. JSON and Markdown are format choices, not language choices, and the skill does not document a reason that requires Chinese-language output.

Content

No source excerpt is available for this finding.

The verification criteria require a fixed Chinese empty-region message without a documented language choice or justification.

Low
Category
Output Handling
Confidence
86% confidence
Finding

The expected output specifies the Chinese message 当前区域（cn-north-4）无 GaussDB 实例 when a region is empty. This makes Chinese a requirement for that user-facing response without documenting user opt-in or a justified locale restriction.

Content

No source excerpt is available for this finding.