Security audit
Security checks for vulnerabilities and agentic risk
Review before installing: command overrides exceed the advertised read-only scope, and the installer source needs verification.
Prefer a version that removes or restricts the command overrides and corrects the installation guide. If using this version, leave both MRS_LIST_HCLOUD_* overrides unset, use a trusted KooCLI executable, and configure a dedicated read-only cloud identity outside chat. Obtain KooCLI through Huawei's official instructions and verify its checksum. Cluster details appear in agent output. The review found concrete scope weaknesses, without evidence of malicious intent.
Without declared permissions the skill's intent is opaque and cannot be validated.
The read-only guard checks user arguments and the requested operation, but the actual executable and prefixed arguments come from unchecked environment variables. Consequently, an attacker able to influence that environment can replace the intended ListClusters execution entirely, potentially performing writes or accessing credentials despite the advertised guard; actual cloud-write impact depends on the effective IAM permissions.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
MRS_LIST_HCLOUD_BIN selects an arbitrary executable, and MRS_LIST_HCLOUD_ARGS supplies arguments before the fixed MRS command without validation. If an attacker can influence the inherited environment across a trust boundary, they can select an interpreter or other program and execute code with the agent's privileges and inherited credentials; this is executable/argument injection, not shell interpolation, and ordinary filter inputs alone do not provide that control.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The manifest explicitly supports filtering terminated clusters, and L336 advertises the same capability. However, --cluster-state terminated is rejected because L347 scans all argument values and the substring matcher at L136-L138 matches the keyword terminate from L057, treating a read-only state filter as a mutation.