Security audit
Security checks for vulnerabilities and agentic risk
This voucher lookup tool needs review because executable overrides can bypass its read-only guard, and its credential handling contradicts its main instructions.
Before installing, remove or constrain the executable overrides and correct the credential-handling documentation. Use a trusted CLI installation, an isolated read-only account, and explicitly selected credentials rather than an environment containing several Huawei accounts. The current overrides are documented only in the script header. External installation payloads and live SDK behavior were not verified; no malicious behavior was established.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
)
def _env_credential(markers):
for key, value in os.environ.items():
upper = key.upper()
if not upper.startswith(("HUAWEI", "HW_", "HWC")):
continue
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def _clean_credential_env(self):
return {
key: value for key, value in os.environ.items()
if not key.upper().startswith(("HUAWEI", "HW_", "HWC"))
}
Without declared permissions the skill's intent is opaque and cannot be validated.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
VOUCHER_LIST_HCLOUD_BIN selects an unrestricted executable, while VOUCHER_LIST_HCLOUD_ARGS supplies unrestricted arguments before the validated BSS operation. If an attacker can influence the agent's inherited environment, these overrides allow arbitrary execution outside the read-only operation guard, with access to inherited cloud credentials; this is conditional on environment control, not injection through ordinary query arguments.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The empty-result and permission-error criteria prescribe specific Chinese messages. Neither criterion offers language selection or documents why these messages must remain Chinese regardless of the user's language.