Security audit
Security checks for vulnerabilities and agentic risk
The bucket-reporting function fits its purpose, but insecure dependency installation and incomplete query limits warrant review before use.
Before use, install reviewed dependencies in an isolated environment with certificate verification enabled, and use [Huawei's downloads and checksum files](https://support.huaweicloud.com/qs-hcli/hcli_02_003.html). Use bucket-list-only credentials and keep secrets out of chat. Clear the extra-command environment overrides, and do not rely on SDK fallback to enforce endpoint or count restrictions. Run optional shell tests only with trusted paths and region values. All bundled files were inspected, including the scanner's partial-coverage areas; remote installer contents, downloaded dependencies and live cloud behavior remain unverified.
scripts/ensure_env.pyDependency installation disables TLS certificate verification
A substituted dependency can execute code with the privileges of the user running setup and access files or credentials available to that account.
The command matches the declared read-only bucket-listing operation, but implements only that narrow portion of the advertised listing-and-reporting workflow. In particular, it does not generate a PDF, a central declared capability. The supplied code shows no OBS writes or unrelated resource access; the mismatch is missing advertised functionality rather than an undeclared dangerous operation.
The installation instructions execute a mutable remote shell script without checking a pinned digest or signature. HTTPS protects transport but does not prevent a compromised distribution endpoint from supplying code that runs with the user's permissions and could access cloud credentials.
# Linux/macOS quick start
curl -sSL https://cn-north-4-res.hcccloud.com/cli/latest/install.sh -o install.sh
bash install.sh
hcloud version
Without declared permissions the skill's intent is opaque and cannot be validated.
The report format fixes the column labels in Chinese and specifies the title as OBS 桶列表, regardless of the user's language. No language selection or justification for Chinese-only output is provided; selecting a Huawei Cloud region does not establish a user language preference.
Lines 65–68 fix the PDF title, headers, and summary label to Chinese, while lines 79–80 require Chinese error hints. These are explicit output-language requirements with no user opt-in or documented justification for a Chinese-only locale.
The subprocess call itself uses an argument list safely, but its pip caller installs executable dependencies from mirrors using --trusted-host, which disables normal TLS certificate verification for those hosts. An attacker able to intercept mirror traffic could substitute packages, and the absence of pinned versions and hashes leaves no independent artifact-integrity check before installation or import.
import subprocess
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
The extra-arguments hook accepts positional OBS URLs that contain no blocked mutation keywords, allowing ls to enumerate objects rather than only buckets. This defeats the stated bucket-only capability boundary when the environment hook is influenced by a caller, although it does not itself bypass IAM or demonstrate a write operation.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
guard_write_intent(" ".join(extra))
cmd.extend(extra)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
guard_write_intent(" ".join(extra))
cmd.extend(extra)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The module explicitly states that Chinese column headers are always written, and the fixed labels and title at lines 35–36 enforce that output language. No language opt-in, locale selection, or region-specific requirement justifying this restriction is provided.
SDK fallback drops the requested endpoint, and its page_size parameter is never applied, so fallback can contact a different destination and return more inventory metadata than the caller requested. This is a limited scope-control failure rather than an IAM bypass, and it matters when callers rely on endpoint selection or the count cap to constrain processing and disclosure.