huawei-cloud-cce-list

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:17 AM UTC
• Version: 1.0.2

Overview

This is a real read-only Huawei Cloud CCE cluster listing helper, but it merits review because its credential lookup can pick unintended cloud keys from the environment.

Review before installing. Use a dedicated low-privilege Huawei IAM user limited to cce:cluster:list, run it in an environment that contains only the intended HUAWEICLOUD_SDK_AK and HUAWEICLOUD_SDK_SK values, avoid extra HUAWEI/HW/HWC credential variables, and pin or lock dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: huawei-cloud-cce-list.py:28

Finding

Ambiguous Environment Variable Matching Can Select Unintended Cloud Credentials

Content

View full analysis

Vulnerability Details

File Location: huawei-cloud-cce-list.py:28-41
Vulnerability Type: Overbroad credential discovery and ambiguous credential selection
Risk Level: Medium

Vulnerable Code:

python

def _load_credentials() -> Tuple[str, str]:
    ak, sk = "", ""
    for k, v in os.environ.items():
        u = k.upper()
        if not (u.startswith("HUAWEI") or u.startswith("HW") or u.startswith("HWC")):
            continue
        if "ACCESS_KEY" in u or u.endswith("_AK") or u == "AK":
            ak = v or ak
        if "SECRET_KEY" in u or u.endswith("_SK") or u == "SK":
            sk = v or sk
    if not ak or not sk:
        print("Error: AK/SK environment variables were not found.", file=sys.stderr)
        sys.exit(_EXIT_AUTH_ERR)
    return ak, sk

Technical Analysis

The documented credential variables are HUAWEICLOUD_SDK_AK and HUAWEICLOUD_SDK_SK, but the implementation enumerates the entire process environment and heuristically accepts any variable whose name begins with HUAWEI, HW, or HWC and contains a matching suffix or substring.

If multiple matching variables exist, later entries encountered during environment iteration overwrite earlier values. The access key and secret key are also selected independently, so credentials from different variable pairs can be combined. This violates deterministic credential selection and can result in authentication against an unintended Huawei Cloud account.

The code does not expose credential values in its output, and this issue does not independently grant an attacker new privileges. Exploitation requires influence over the environment of the process.

Attack Path

1. An attacker, wrapper script, CI configuration, or neighboring deployment component gains the ability to define environment variables for the Skill process.
2. It defines matching variables such as HWC_OTHER_AK and HWC_OTHER_SK.
3. The loade ...[truncated 839 chars]

Remediation

View remediation

Remediation Suggestions

Read only the explicitly documented variables and reject incomplete credential pairs:

python

def _load_credentials() -> Tuple[str, str]:
    ak = os.getenv("HUAWEICLOUD_SDK_AK")
    sk = os.getenv("HUAWEICLOUD_SDK_SK")

    if not ak or not sk:
        print(
            "Error: set HUAWEICLOUD_SDK_AK and HUAWEICLOUD_SDK_SK.",
            file=sys.stderr,
        )
        raise SystemExit(_EXIT_AUTH_ERR)

    return ak, sk

Additional hardening should include:

• Do not enumerate the complete environment to discover credentials.
• Do not support undocumented aliases unless each alias is explicitly named and conflicts are rejected.
• Use temporary, least-privileged credentials where supported.
• Add tests with multiple similarly named environment variables to verify deterministic selection.
• Ensure CI and process-launch configurations prevent untrusted users from modifying the Skill's environment.

T09 · Insecure Skill Coding Practices

Note

• Location: huawei-cloud-cce-list.py:52

Finding

Documented 30-Second API Timeout Is Not Enforced

Content

View full analysis

Vulnerability Details

File Location: huawei-cloud-cce-list.py:52-60
Vulnerability Type: Missing explicit network timeout
Risk Level: Low

Vulnerable Code:

python

return CceClient.new_builder() \
    .with_credentials(creds) \
    .with_region(region_obj) \
    .build()


def query_clusters(client: CceClient) -> list:
    request = ListClustersRequest()
    response = client.list_clusters(request)
    return response.items if response.items else []

The security constraints in SKILL.md:23-27 state that every API call must have a 30-second timeout, but neither the client builder nor the request configures such a timeout.

Technical Analysis

Catching RequestTimeoutException later in the program only handles a timeout generated by the SDK or transport; it does not establish the declared 30-second deadline. Without an explicit connection and read timeout, behavior depends on SDK, HTTP transport, operating-system, or proxy defaults. Those defaults may substantially exceed 30 seconds.

This is primarily an availability and reliability weakness. It becomes security-relevant when the Skill runs in an automation worker, shared agent, or pipeline where a blocked invocation consumes limited execution capacity.

Attack Path

1. The process sends the CCE API request through an unresponsive endpoint, faulty proxy, network sink, or stalled connection.
2. The peer accepts or partially establishes the connection but does not complete the response.
3. Because the application does not impose the documented 30-second deadline, the call remains blocked until a lower-level timeout occurs.
4. Repeated blocked invocations can consume worker slots, delay automation, or cause an external orchestration timeout.

Exploitation requires the attacker to influence the network path, proxy configuration, DNS resolution, or remote endpoint behavior.

Impact Assessment

No additional cloud or local pri ...[truncated 265 chars]

Remediation

View remediation

Remediation Suggestions

Configure explicit connection and read timeouts through the Huawei Cloud SDK's supported HTTP configuration API. Both values should be bounded so that the effective request deadline satisfies the documented 30-second limit.

The hardening plan should include:

• Set explicit connection and read timeouts rather than relying on SDK defaults.
• If the SDK distinguishes connection, read, and total deadlines, configure all relevant values.
• Preserve the existing RequestTimeoutException handling.
• Do not retry authentication failures.
• Limit retries for network errors and ensure the total retry duration remains bounded.
• Add an integration test using a deliberately stalled endpoint or transport stub and verify that execution terminates within the promised deadline.
• Update documentation if the SDK cannot guarantee a strict total deadline.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Open-Ended Dependency Constraints Permit Unreviewed Future Releases

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Unpinned third-party dependencies and non-reproducible installation
Risk Level: Medium

Vulnerable Code:

text

huaweicloudsdk-cce>=3.1.0
huaweicloudsdk-core>=3.1.0

Technical Analysis

Both dependencies use open-ended lower bounds without upper bounds, exact version pins, a lock file, or package hashes. Consequently, identical installation commands executed at different times can resolve to different package versions.

The package names are consistent with the declared Huawei Cloud functionality, and no evidence of current typosquatting or an intentionally malicious package was found. The weakness is that any future version satisfying the lower bound is accepted automatically without project-level review or integrity verification.

Python packages can execute code during installation in some build configurations and always execute imported module initialization code at runtime. A compromised upstream release would therefore execute in the Skill process context.

Attack Path

1. An upstream package account, release pipeline, distribution artifact, or package-index delivery path is compromised, or a future incompatible release is published.
2. The resulting release retains a version greater than or equal to 3.1.0.
3. A new deployment runs the documented package installation without a lock file or required hashes.
4. The package resolver selects the new release.
5. Malicious code executes during package build, installation, or import under the privileges of the installing or running process.

This is a supply-chain attack path and depends on compromise or unsafe change outside this repository.

Impact Assessment

A malicious dependency could execute with the privileges of the package installer or Skill process. Depending on deployment practices, this may permit access to environment variables, includ ...[truncated 329 chars]

Remediation

View remediation

Remediation Suggestions

Adopt reproducible, integrity-verified dependency management:

• Pin each dependency to a reviewed exact version using ==.
• Generate a lock file that includes all transitive dependencies.
• Record and enforce package hashes, for example through pip install --require-hashes.
• Install only from the intended HTTPS package index or an internally controlled package mirror.
• Run dependency vulnerability and provenance checks in CI.
• Review changelogs and security advisories before updating pins.
• Perform installations inside a dedicated virtual environment or isolated container as a non-root user.
• Keep credential-bearing runtime environments separate from dependency build and installation jobs where practical.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

整体上，代码的核心用途与声明基本一致：都是查询华为云 CCE 集群列表并做表格化展示，触发词和目标资源也匹配，没有发现越权访问或无关能力。但声明明确举例了“节点数等关键字段”，而实际实现只输出名称、状态、集群版本、平台版本，没有节点数这一重要字段，因此描述与实际行为存在功能层面的不一致。虽然这是较小范围的偏差，不影响其主要用途判断，但按照描述与行为精确匹配的标准，仍应判定为 mismatch。

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · huawei-cloud-cce-list.py (reported line 30)May include surrounding context.

python

def _load_credentials() -> Tuple[str, str]:
    ak, sk = "", ""
    for k, v in os.environ.items():
        u = k.upper()
        if not (u.startswith("HUAWEI") or u.startswith("HW") or u.startswith("HWC")):
            continue

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill explicitly relies on environment variables for Huawei Cloud AK/SK credentials but does not declare any tool scope such as permissions or allowed-tools. This creates an authorization-boundary problem: an agent may grant broader access than intended, and users reviewing the manifest cannot easily see that secret-bearing environment access is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents behavior that reads sensitive credentials from environment variables and sends authentication data to Huawei Cloud IAM, but it does not include any warning about credential use, privacy implications, or network access. Under the markdown-file variant of SQP-2, skills should disclose behaviors that affect user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The verification guide instructs users to configure Huawei Cloud AK/SK environment variables but does not warn about secure handling, least privilege, shell history leakage, or use of non-production credentials. Because these are cloud credentials for a live account, omission of safety guidance can lead to accidental exposure or misuse during testing, especially in shared shells, CI logs, or screenshots.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file is entirely written in Chinese and does not indicate that other languages are supported or that Chinese is an optional locale choice. Under the policy rule for natural-language violations, this can be considered a language/locale constraint that is not explicitly opt-in or justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title, participant labels, and interaction text are presented entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. This is a natural-language policy concern because it imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

该代码文件中的描述、参数帮助、错误提示和表头均固定为中文，未提供语言切换、locale 检测或用户选择机制。根据规则，强制特定语言而没有用户选择属于自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency is specified with only a lower bound, which allows future unreviewed versions to be installed. If an upstream release introduces malicious code, a breaking change, or a vulnerable transitive dependency, builds may silently consume it and change the skill's security posture.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

huaweicloudsdk-cce>=3.1.0
huaweicloudsdk-core>=3.1.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Using an unpinned core SDK dependency permits installation of any later version that satisfies the minimum, reducing build reproducibility and increasing supply-chain risk. A compromised or incompatible upstream release could be pulled in automatically during deployment.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

huaweicloudsdk-cce>=3.1.0
huaweicloudsdk-core>=3.1.0

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses Chinese throughout, including the title, headings, table labels, and conclusion, and does not indicate that the language is optional or region-specific. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This file presents all instructions and expected outputs only in Chinese, with no user opt-in, alternative language option, or justification that the skill is region- or language-specific.

Content

No source excerpt is available for this finding.