Huawei Cloud ECS Detail Query

• Outcome: Pass
• Latest audit: Sep 1, 2026 · 9:19 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent read-only Huawei Cloud ECS lookup tool, but users should handle its cloud credentials and inventory output carefully.

Install only if you intend to let the agent query Huawei Cloud ECS inventory. Use a least-privilege IAM user limited to ecs:servers:get and ecs:servers:list, avoid entering AK/SK values directly on command lines, verify the hcloud installer source, and treat returned instance names, IDs, key pair names, volumes, and IP addresses as sensitive operational data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill explicitly instructs users to run shell commands and consume credentials from environment variables, but the manifest does not declare permissions for shell or environment access. This creates a transparency and policy gap: agents or reviewers cannot accurately assess the capability surface, and a skill with undeclared execution/secret access is riskier to approve or sandbox correctly.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to download and immediately execute a remote installer script with curl and bash, but provides no integrity verification, signature checking, checksum validation, or warning about reviewing the script first. If the download source, transport path, or hosting bucket is compromised, users could execute arbitrary attacker-controlled code on their systems.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide shows how to configure long-lived access keys and secret keys, including exporting them as shell environment variables, without any guidance on secure storage, least privilege, rotation, or avoiding credential leakage in shell history and process environments. In a cloud administration context, mishandled AK/SK credentials can enable unauthorized access to ECS resources and broader account compromise depending on assigned permissions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The verification instructions require configured AK/SK cloud credentials and direct enumeration of ECS instance metadata, including names, status, flavor, and IP information, without any warning about handling sensitive account or infrastructure data safely. While this is framed as normal testing, the skill context involves production-capable cloud access, so running these steps can expose internal asset inventory and instance details to whoever performs or observes the verification.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The documentation shows a command that places the access key and secret key directly on the command line, which can expose credentials through shell history, process listings, audit logs, and terminal recording. Even though the skill also recommends environment variables elsewhere, providing a plaintext CLI example materially increases the chance of credential leakage by users following the docs.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _load_credentials():
    ak, sk = "", ""
    for k, v in os.environ.items():
        u = k.upper()
        if not (u.startswith("HUAWEI") or u.startswith("HW") or u.startswith("HWC")):
            continue

• Confidence: 80% confidence
• Finding: The credential loader iterates over all environment variables and heuristically selects any names resembling Huawei AK/SK values. Broad environment harvesting increases the chance of unintentionally consuming the wrong secrets, crossing trust boundaries, or using attacker-controlled variables in a shared runtime, especially in agent environments where many secrets may coexist.

Static analysis

No suspicious patterns detected.