Security audit
Security checks for vulnerabilities and agentic risk
Review before installing: this IAM skill weakens connection security, can create groups before confirmation, and introduces an unreviewed telemetry executable.
Defer use with production credentials until certificate verification and package-download verification are restored, and confirmation precedes every write. Make telemetry optional and review a pinned release plus its reporting behavior before allowing it access to cloud credentials. Disabling reports does not remove the wrapper's access. Source inspection and isolated checks support these concerns; the downloaded telemetry implementation remains unexamined, and credential theft was not demonstrated.
scripts/iam_user_manage.pySDK connections explicitly disable TLS certificate verification
An interceptor can read IAM request and response data and forge user, group, or policy identifiers returned by lookups. A confirmed authorization workflow can consequently target an unintended identity or policy. This does not establish disclosure of the secret signing key.
scripts/ensure_env.pyDependency installation marks package mirrors as trusted hosts
Substituted packages can execute installation or import-time code with the invoking user's privileges, including access to cloud credentials available to that process.
scripts/iam_user_manage.pyImplicit group creation occurs before the write-confirmation gate
An IAM group is created even though the command subsequently reports that confirmation is required, or fails during later policy resolution. The unconfirmed change is limited to group creation; this path does not itself attach policies or add members.
Although later sections disclose the quality CLI, its installation and execution extend beyond the IAM capability described in the metadata. Persistently installing a remotely selected executable that subsequently wraps privileged IAM commands creates a supply-chain compromise path, not merely a documentation discrepancy.
The SDK implementation explicitly disables TLS certificate verification, allowing an active network attacker to impersonate the IAM endpoint and read authenticated request contents or forge responses. First-page-only lookups also undermine the promised idempotency, although lookup failure alone is primarily a correctness issue rather than proof of privilege escalation.
The telemetry dependency is disclosed in the document body, so it is not completely hidden. Nevertheless, installing a remotely selected executable and requiring it to wrap authenticated IAM commands introduces an unnecessary supply-chain trust boundary: a compromised executable could access inherited credentials and alter authorization operations.
The declared execution tools are Huawei Cloud KooCLI and the official IAM Python SDK. The chunk instead concerns installing and upgrading a different CLI, with no demonstrated connection to IAM provisioning or authorization. This is an undeclared tool-management capability, rather than an evident supporting implementation detail. The installation scripts themselves were not supplied, so their internal behavior cannot be verified.
The fetched manifest controls both the executable download URL and its expected checksum, so compromise of the release service can substitute a malicious binary with a matching hash. HTTPS, mandatory checksum verification, and archive checks provide useful protections, but do not independently authenticate the publisher; executing the installed tool could expose credentials available in an IAM administration environment.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def setUp(self):
import os
self._saved = {}
for key in list(os.environ):
if key.startswith(("HUAWEI", "HW_", "HWC", "HUAWEICLOUD")):
self._saved[key] = os.environ.pop(key)
self.addCleanup(self._restore)
Without declared permissions the skill's intent is opaque and cannot be validated.
The progression from an automatic telemetry dependency to a prohibition on bare hcloud commands pressures the agent to execute unrelated software for an IAM task. This expands trust to a wrapper with access to privileged operations, although the wording alone does not establish malicious intent or prove data transmission.
The document mandates an unrelated telemetry wrapper for authenticated IAM commands, placing another executable inside a security-sensitive execution path. That wrapper can access inherited credential variables and command output; its actual reporting payload is not provided, so credential exfiltration is a risk rather than a demonstrated behavior.
The guide requires a quality-reporting executable to wrap every KooCLI invocation despite telemetry not being necessary for IAM management. Running that executable in the credential-bearing process environment gives it access to sensitive execution context; disabling reports does not necessarily remove the wrapper or its access.
The installer accepts a download URL and checksum from a mutable latest-release manifest, then persistently installs the resulting executable without a separate approval gate. HTTPS, checksum verification, and archive-path checks are useful protections, but compromise of the manifest publisher can still supply both a malicious executable and its matching checksum.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True)
except subprocess.TimeoutExpired:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _default_runner(self, cmd):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
universal_newlines=True, timeout=self.timeout)
except FileNotFoundError:
Both create-user and authorize resolve the group before calling _require_confirm, and resolve_group can execute CreateGroupV5 when --create-group is set. Consequently, a command without --confirm can create a cloud resource before returning a confirmation error, violating the documented write-approval boundary.
The script retrieves a skill-quality-cli release and installs executable files and supporting Python modules into ~/.local/bin. This is neither the declared KooCLI nor the IAM Python SDK, and installing a separate skill-quality tool is not justified by the manifest's IAM user creation and authorization workflow. Manual invocation and checksum verification do not resolve this purpose mismatch.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def call(self, operation, params):
from huaweicloudsdkcore.exceptions import exceptions
handler = getattr(self, "_op_" + operation.lower(), None)
if handler is None:
raise IamError("SDK 后端不支持操作 %s" % operation, operation=operation)
try:
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
with mock.patch.object(IamClient, "new_builder") as builder:
chain = builder.return_value
for method in ("with_credentials", "with_http_config", "with_region"):
getattr(chain, method).return_value = chain
chain.build.return_value = sentinel
backend = iam.SdkBackend("cn-north-4", "ak", "sk")
client = backend._build_client()