huawei-cloud-obs-list

• Outcome: Review
• Latest audit: Nov 5, 2026 · 9:41 AM UTC
• Version: 1.0.5

Overview

This bucket-listing skill needs review because its advertised safeguards and query limits are unreliable, and its installer source remains unverified.

Use independently verified Huawei installation instructions and credentials restricted to bucket listing. Before use, remove or tightly control the executable overrides and fix fallback handling so endpoint and count limits remain effective. Keep credentials out of chat and consider bucket names private account information. No live cloud calls or installer execution were performed; external installer behavior remains unverified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This command sequence creates the same unverified remote-code execution exposure as the preceding finding, rather than demonstrating shell-parameter injection. Its legitimate CLI-installation purpose does not eliminate the risk of executing substituted installer content.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 10)May include surrounding context.

bash

# Linux/macOS quick start
curl -sSL https://cn-north-4-res.hcccloud.com/cli/latest/install.sh -o install.sh
bash install.sh
hcloud version

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_list_obs_buckets.py (reported line 235)May include surrounding context.

python

class TestSdkFallback(unittest.TestCase):
    def test_missing_env_credentials_raises_config(self):
        env = {k: v for k, v in os.environ.items()
               if not k.upper().startswith(("HW", "HUAWEI", "HWC"))}
        with mock.patch.dict(os.environ, env, clear=True):
            with self.assertRaises(ConfigError) as ctx:

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The installation workflow executes a downloaded shell script without warning about its system-integrity implications.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The installation instructions immediately execute a mutable remote shell script without an integrity check or review step. Compromise of the distribution endpoint or published installer would execute attacker-controlled code with the installing user's privileges, potentially exposing cloud credentials; HTTPS alone does not prevent this supply-chain scenario.

Content

No source excerpt is available for this finding.

Environment overrides bypass the manifest's strict read-only execution guard.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The read-only guards inspect parsed user arguments but do not inspect the executable or extra arguments supplied through the environment. Consequently, an environment-controlled replacement executable can ignore the fixed ls arguments entirely, defeating the claimed read-only execution boundary when that environment is attacker-influenced.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list_obs_buckets.py (reported line 191)May include surrounding context.

python

cmd.extend(extra)
    cmd.extend(argv)
    try:
        proc = subprocess.run(
            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            timeout=120, universal_newlines=True,
        )

Tainted flow: 'cmd' from os.environ.get (line 185, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 90% confidence

Finding

Environment variables select the executable and prepend unrestricted arguments before the supposedly fixed OBS command. If a lower-trust launcher or configuration can influence those variables, it can cause arbitrary program execution with the skill's privileges and inherited credentials; this is executable/argument injection, not shell metacharacter injection.

Content

Scanner excerpt · scripts/list_obs_buckets.py (reported line 191)May include surrounding context.

python

cmd.extend(extra)
    cmd.extend(argv)
    try:
        proc = subprocess.run(
            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            timeout=120, universal_newlines=True,
        )

SDK fallback silently ignores the requested endpoint and bucket-count cap.

Medium

• Category: Excessive Agency
• Confidence: 100% confidence

Finding

The manifest states that --endpoint overrides the destination and --page-size caps the returned count. On fallback, the endpoint is not forwarded at all, while list_buckets_via_sdk accepts page_size but never uses it: L316-L327 select the regional endpoint and L334-L345 request and return the entire bucket list. Consequently, the same invocation can contact a different endpoint and return more inventory than requested solely because hcloud is unavailable.

Content

No source excerpt is available for this finding.

Pass criteria require Chinese-language error hints without user language choice or a documented justification.

Low

• Category: Output Handling
• Confidence: 98% confidence

Finding

The pass criteria explicitly require error paths to produce a Chinese hint on stderr. This imposes a specific output language without user opt-in, and the file does not document a justification for that language constraint.

Content

No source excerpt is available for this finding.