华为云 RDS 实例列表查询

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:29 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed read-only Huawei Cloud RDS inventory helper, with the main risk being careful handling of local cloud credentials.

Install only if you are comfortable creating a local Huawei Cloud config.json with AK/SK credentials. Use a dedicated read-only IAM identity limited to RDS instance listing and, if needed, project listing; keep config.json out of shared folders, restrict file permissions, and rotate the keys if exposure is suspected.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: list_rds.py:223

Finding

Long-Lived Cloud Credentials Stored in Plaintext Configuration

Content

View full analysis

Vulnerability Details

File Location: list_rds.py:223-226
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

python

with open(config_path, "r", encoding="utf-8") as fh:
    cfg = json.load(fh)
ak = (cfg.get("ak") or "").strip()
sk = (cfg.get("sk") or "").strip()

The plaintext credential format is also demonstrated in config.example.json:1-6 and recommended in SKILL.md:20-34.

Technical Analysis

The application requires users to store a Huawei Cloud Access Key ID and Secret Access Key in an unencrypted JSON file. It reads these long-lived credentials directly from the filesystem without checking whether the file has restrictive ownership or permissions.

Although .gitignore excludes config.json from ordinary Git operations, this only reduces accidental repository commits. It does not protect the credentials from other local users, overly broad file permissions, compromised processes, filesystem backups, workspace collection, or accidental transfer through mechanisms outside Git.

The credentials are subsequently used to generate authenticated Huawei Cloud API requests. Therefore, disclosure of the configuration file provides reusable authentication material rather than only transient session data.

Attack Path

1. A user creates config.json and stores valid Huawei Cloud AK/SK credentials as instructed.
2. The file is created with permissions that allow another local account or process to read it, or it is copied into an unprotected backup or shared workspace.
3. An attacker obtains the file and extracts the plaintext ak and sk values.
4. The attacker uses the credentials to sign Huawei Cloud API requests from another system.
5. The attacker exercises every permission granted to the associated cloud identity until the credentials are revoked, rotated, or otherwise disabled.

This path requires an attacker to obtain local filesystem, backup, or works ...[truncated 842 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer short-lived credentials supplied through workload identity, instance identity, federation, or another Huawei Cloud-supported temporary credential mechanism.
2. Where static credentials are unavoidable, retrieve them from an operating-system credential manager or dedicated secrets-management service instead of storing them in JSON.
3. Support environment-variable credential injection for automation so secrets do not need to reside in the project directory.
4. If file-based credentials remain supported:
   • Require owner-only permissions, such as mode 0600 on POSIX systems.
   • Verify file ownership and permissions before reading it, and reject insecure files with a clear error.
   • Document secure file creation and storage procedures.
   • Keep the file outside shared project and workspace directories.
5. Use a dedicated cloud identity restricted to the documented read-only actions and relevant resources.
6. Rotate credentials regularly and immediately revoke any credentials suspected of exposure.
7. Add automated secret scanning to development and release workflows, while retaining the existing .gitignore rule as defense in depth.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares use of Python and documents reading local credential files and making outbound requests to Huawei Cloud APIs, but it does not define any explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and can allow broader-than-expected file access or network use if the agent framework relies on manifest scoping for enforcement or user review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example values for the access key fields are written only in Chinese, which imposes a specific language on users. The file does not provide an English alternative, user language choice, or any documentation that this skill is intentionally restricted to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file’s natural-language instructions and output strings are entirely in Chinese, and the CLI does not indicate any language choice or opt-in. This can violate language/locale policy when a skill imposes a specific language without allowing the user to select their preferred locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code reads AK/SK credentials from a local config file and uses them to make authenticated HTTP requests to Huawei Cloud APIs. Although the module docstring describes the behavior, the runtime flow does not provide a user-facing disclosure, confirmation, or visible notice when accessing credentials and transmitting signed requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This test file contains natural-language comments and validates CLI output in Chinese, such as the Chinese class docstring and the expected message '暂无 RDS 实例'. That indicates the skill behavior is locked to a specific language/locale rather than offering a user choice, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.