ClawHub
Back to skill

Security audit

huawei-cloud-cce-list

Security checks for vulnerabilities and agentic risk

Overview

This skill performs a disclosed read-only Huawei Cloud CCE cluster listing, but users should treat the required cloud credentials and resulting resource inventory as sensitive.

Install only if you intend to let the skill query your Huawei Cloud CCE inventory. Use least-privilege read-only credentials limited to cce:cluster:list, prefer a non-production or scoped account for testing, avoid exposing AK/SK values in shared terminals or logs, and consider pinning dependency versions before operational use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill explicitly relies on environment variables for AK/SK credentials, but no corresponding permission/capability declaration is present. This creates a trust and transparency gap: a runner may expose sensitive environment data to the skill without users or policy engines having a clear declarative signal that credential access is required.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The verification steps require Huawei Cloud AK/SK credentials to be present and used for live API queries, but they do not warn the user that these are sensitive secrets or that running the test will access real cloud account data. This creates avoidable risk of credential mishandling, accidental disclosure in shell history/logs, or unintentional exposure of production resource metadata during verification.

Unpinned Dependencies

Low
Category
Supply Chain
Content
huaweicloudsdk-cce>=3.1.0
huaweicloudsdk-core>=3.1.0
Confidence
96% confidence
Finding
The dependency is specified with only a lower bound, so future installs may pull newer versions that have not been tested with this skill. This creates a supply-chain and reproducibility risk: a compromised or breaking upstream release could be introduced automatically into deployments.

Unpinned Dependencies

Low
Category
Supply Chain
Content
huaweicloudsdk-cce>=3.1.0
huaweicloudsdk-core>=3.1.0
Confidence
96% confidence
Finding
This dependency is also unpinned and permits installation of any newer version above the minimum. That increases exposure to unexpected upstream changes, including malicious or vulnerable releases, and makes builds non-reproducible.

Static analysis

No suspicious patterns detected.