Security audit
Security checks for vulnerabilities and agentic risk
This catalog tool needs review because its setup weakens download security and environment settings can bypass its advertised read-only guard.
Prefer a corrected version that preserves certificate verification and removes arbitrary executable overrides. Install reviewed, pinned dependencies in an isolated environment, use narrowly scoped read-only credentials, and invoke it explicitly for Huawei Cloud. All bundled files were inspected and command construction was checked with mocked subprocesses; external installers, downloaded packages, and live cloud behavior were not verified.
scripts/ensure_env.pyDependency installation disables TLS certificate verification for package mirrors
An active network attacker can substitute an SDK distribution and execute arbitrary Python code. Successful mirror installation returns immediately, so the official-index fallback does not prevent substitution. This is a coding vulnerability, not evidence that the mirrors or packages are malicious.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
self.addCleanup(self._builder_patch.stop)
def _clean_credential_env(self):
env = dict(os.environ)
for key in _CREDENTIAL_ENV_KEYS:
env.pop(key, None)
return env
Without declared permissions the skill's intent is opaque and cannot be validated.
The trigger list includes unqualified phrases such as "service catalog", "product catalog", "产品目录", and "list cloud services" that can refer to other providers or non-cloud catalogs. Although the skill's purpose is Huawei-specific, these triggers do not require Huawei Cloud context, and the write-operation exclusions do not resolve that ambiguity.
The subprocess call uses an argument list and does not introduce shell injection, but its caller installs executable Python packages from mirrors using --trusted-host, disabling certificate verification for those hosts. A network attacker able to intercept mirror traffic could substitute packages that execute during installation or subsequent imports; unpinned dependencies without verified hashes compound this supply-chain risk.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
The read-only guard checks user command-line arguments and the requested operation, but it does not check the environment-controlled program or prefix arguments actually executed. Consequently, an attacker-controlled environment can bypass the advertised read-only restriction entirely, although ordinary catalog filter inputs alone do not provide this control.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
PRODUCT_LIST_HCLOUD_BIN selects the executable, and PRODUCT_LIST_HCLOUD_ARGS supplies unchecked arguments before the fixed BSS operation. If an attacker can influence the inherited environment, they can replace the CLI with another program and supply its options, executing code with the agent's privileges and access to inherited cloud credentials; no shell is required.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)