ClawHub
Back to skill

Security audit

huawei-cloud-voucher-claim

Security checks for vulnerabilities and agentic risk

Overview

Review before installing: the coupon-transfer safeguards are incomplete, and storing its ledger in a shared directory can expose other files to overwriting.

Have operation restrictions enforced inside both callable execution paths and secure temporary-file creation implemented before relying on the advertised safeguards. Use credentials limited to verified claim/list permissions, keep the ledger in a directory only you can modify, and explicitly run --dry-run before approving the customer, coupon and amount. Offline mocked checks verified dispatch behavior; live cloud effects and downloaded dependencies were not tested.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The claim-only guarantee is broader than the implemented protection: direct Python callers can supply operation names that bypass the CLI-level guard and reach authenticated BSS execution. Actual effects depend on KooCLI support, parameter compatibility, and IAM permissions; the missing default preview and retained server-side idempotency are documentation discrepancies, not additional security vulnerabilities.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_write, network, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/claim_voucher.py (reported line 271)May include surrounding context.

python
cmd.extend(extra)
    cmd.extend(argv)
    try:
        proc = subprocess.run(
            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            timeout=120, universal_newlines=True,
        )

Tainted flow: 'cmd' from os.environ.get (line 265, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/claim_voucher.py (reported line 271)May include surrounding context.

python
cmd.extend(extra)
    cmd.extend(argv)
    try:
        proc = subprocess.run(
            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            timeout=120, universal_newlines=True,
        )

Tainted flow: 'tmp' from os.environ.get (line 597, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
86% confidence
Finding

A configurable ledger destination is not inherently unsafe, but save_ledger() opens the predictable path '.tmp' with truncation and follows existing symlinks. If the ledger is placed in an attacker-writable directory, such as a shared temporary directory, another local user can pre-create that symlink and cause a successful claim to overwrite a file writable by the agent; the default private cache location reduces exposure.

Content

Scanner excerpt · scripts/claim_voucher.py (reported line 598)May include surrounding context.

python
if directory:
            os.makedirs(directory, exist_ok=True)
        tmp = path + ".tmp"
        with open(tmp, "w", encoding="utf-8") as handle:
            json.dump({"entries": entries}, handle, ensure_ascii=False, indent=2)
        os.replace(tmp, path)
    except OSError:

The claim-only write guard is bypassed when claim_voucher() is called directly.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

claim_voucher() forwards its operation argument to build_command() without invoking guard_operation(); that guard exists only in main(). Direct callers can therefore attempt non-claim BSS operations using the agent's credentials despite the claimed restriction, although confirmation is still required and successful execution depends on IAM permissions and accepted parameters.

Content

No source excerpt is available for this finding.