huawei-cloud-flexus-l-server-flexusagent-deployment

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill explicitly instructs the agent to reply with the Web UI URL and the new admin password in conversation (SKILL.md:251), which directly conflicts with the top "never expose credentials" security rules (SKILL.md:1-7) and therefore contains a deceptive/conflicting instruction that would force leaking secrets.

---

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires the agent to output sensitive values (e.g., "Password: ") and shows command-line parameters for AK/SK, admin passwords, and API keys which forces inclusion or handling of secrets verbatim in outputs — a high exfiltration risk.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Two URLs are direct links to .sh scripts hosted on public Huawei OBS buckets that the skill downloads and pipes to bash (high-risk: remote shell scripts can deliver malware); the remaining URLs are standard Huawei Cloud or local-instance endpoints and are not inherently suspicious.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). High-risk: the code deliberately logs sensitive authorization headers and cleartext admin passwords and creates/executing remote scripts (curl | bash) via the cloud operations service, enabling credential leakage and remote code execution on customer instances.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). Yes—during the import-app-workflow required workflow, the agent fetches outsider-authored free text from a public OBS URL (index.json and per-workflow template.yml) via requests.get(...), parses it as JSON/YAML prose, and then embeds that content into the COC script payload (yaml_content) that is executed remotely.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill constructs and executes remote COC scripts at runtime that curl-and-pipe to bash (e.g. https://documentation-samples.obs.cn-north-4.myhuaweicloud.com/solution-as-code-publicbucket/solution-as-code-moudle/agent/reset_admin_password.sh and https://flexus-config-cn-north-4-product.obs.cn-north-4.myhuaweicloud.com/stable/dify/scripts/import_yml_to_dify.sh) and also fetches workflow/template content from OBS at runtime (f"https://flexus-config-cn-north-4-product.obs.cn-north-4.myhuaweicloud.com/stable/dify/dify-templates/national/index.json?timestamp={int(time.time())}" and f"https://flexus-config-cn-north-4-product.obs.cn-north-4.myhuaweicloud.com/stable/dify/dify-templates/national/templates/{app_workflow_id}/template.yml?timestamp={int(time.time())}"), meeting the criteria for runtime-fetched content that executes remote code or controls runtime behavior.