huawei-cloud-obs-dir-count

• Outcome: Review
• Latest audit: Nov 12, 2026 · 6:16 AM UTC
• Version: 1.0.6

Overview

ClawScan marks this skill suspicious because scanners report unsafe CLI installation and credential-handling practices; the review is incomplete, and the results do not establish malicious intent.

Consider the skill suspicious and review the installation and credential steps before installing. The scan covered 9 of 10 components; analysis of one shell script was partial because a static parser limit was reached, so the evidence is incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied script's primary purpose is skill-specification validation. It never invokes KooCLI or the OBS SDK, accepts no bucket or prefix parameters, and implements no immediate or recursive OBS directory counting. References to 'hcloud OBS ls' are merely text searches within SKILL.md. Although the script is read-only, that shared property does not resolve the material purpose and output mismatch. This assessment applies to the supplied code chunk, not any unseen implementation.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The installation sequence downloads a mutable latest archive and installs its executable without checking a trusted signature or pinned digest. HTTPS protects transport, but a compromised distribution location could still supply malicious code that would later execute with the user's access to cloud credentials; the issue is supply-chain integrity rather than demonstrated tool-parameter injection.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 20)May include surrounding context.

Linux (x86_64)

bash

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-linux-amd64.tar.gz
tar -xzf hcloudcli-linux-amd64.tar.gz
chmod +x hcloud
sudo mv hcloud /usr/local/bin/

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

> ```
>
> If the output is `Please set ak, sk and endpoint in the configuration file!` or an `InvalidAccessKeyId` error,
> obsutil credentials are not configured. Ask the user to configure them in their own terminal (never ask the user
> to paste AK/SK into the conversation). Provide the following example command:
>
> ```

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 23)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-linux-amd64.tar.gz tar -xzf hcloudcli-linux-amd64.tar.gz chmod +x hcloud sudo mv hcloud /usr/local/bin/

text

### Linux (ARM64)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 32)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/hcloudcli/latest/hcloudcli-linux-arm64.tar.gz tar -xzf hcloudcli-linux-arm64.tar.gz chmod +x hcloud sudo mv hcloud /usr/local/bin/

text

### macOS

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 67)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz tar -xzf obsutil_linux_amd64.tar.gz chmod +x obsutil_linux_amd64_/obsutil sudo mv obsutil_linux_amd64_/obsutil /usr/local/bin/

text

### Linux (ARM64)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 76)May include surrounding context.

curl -O https://obs-community-tool.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_arm64.tar.gz tar -xzf obsutil_linux_arm64.tar.gz chmod +x obsutil_linux_arm64_/obsutil sudo mv obsutil_linux_arm64_/obsutil /usr/local/bin/

text

---

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 85)May include surrounding context.

Important: OBS credentials do not inherit from the KooCLI account credentials. The hcloud OBS ls command reads AK/SK/endpoint from the obsutil config file (~/.obsutilconfig).

Never ask the user to paste AK/SK directly into the conversation. Instruct them to run the following in their own terminal:

bash

hcloud obs config -i=<YourAK> -k=<YourSK> -e=obs.<Region>.myhuaweicloud.com

Credential setup places access keys in command-line arguments without warning about local exposure.

Medium

• Category: Output Handling
• Confidence: 97% confidence

Finding

Entering real access and secret keys directly into command arguments can expose them through persistent shell history, process inspection, or command auditing. Avoiding chat disclosure is beneficial, but does not eliminate these local exposure paths; stolen keys could grant whatever cloud permissions the credentials hold.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/count_obs_directories.py (reported line 169)May include surrounding context.

python

url += "/" + prefix.strip("/")
    url += "/"
    try:
        proc = subprocess.run(
            ["hcloud", "OBS", "ls", url, "-d"],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/count_obs_directories.py (reported line 269)May include surrounding context.

python

# problems surface through _translate_cli_error at runtime.
    have_hcloud = False
    try:
        proc = subprocess.run(
            ["bash", "-lc", "command -v hcloud"], capture_output=True, text=True, timeout=10
        )
        have_hcloud = proc.returncode == 0

Error-handling instructions require relaying Chinese-language hints without user language opt-in.

Low

• Category: Output Handling
• Confidence: 94% confidence

Finding

The workflow specifies that error hints are in Chinese and instructs the agent to relay those hints to the user. This imposes Chinese-language error responses without offering a language choice or documenting a justification for the restriction.

Content

No source excerpt is available for this finding.

Verification requirements mandate Chinese error messages without user language choice or a documented justification.

Low

• Category: Output Handling
• Confidence: 98% confidence

Finding

The nonexistent-bucket and missing-credential checks require Chinese diagnostic hints, and the pass criteria explicitly mandate Chinese stderr messages. This imposes a specific output language without offering user opt-in or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Error-handling instructions mandate Chinese-language diagnostics without user opt-in.

Low

• Category: Output Handling
• Confidence: 96% confidence

Finding

The CLI error translator explicitly specifies returning Chinese troubleshooting messages, and the SDK translator repeats that requirement at line 95. Recognized errors are therefore presented in Chinese regardless of the user's language, with no language choice or documented justification for this restriction.

Content

No source excerpt is available for this finding.