Security audit

huawei-cloud-find-skills

Security checks across malware telemetry and agentic risk

Overview

The skill is framed as a Huawei Cloud skill finder/installer, but the package includes mismatched creator/testing guidance, credential-related instructions, and automatic install-count reporting that need review before use.

Review this package before installing. The core finder script appears limited to fetching and ranking an external index, but installation mutates the local skill set and reports an install count remotely. The bundled references appear copied from a Huawei Cloud skill-creator package and could steer an agent toward credential use, live cloud calls, and resource creation/deletion outside the stated finder purpose.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill performs multiple network actions such as fetching indexes from GitCode, retrieving SKILL.md from GitHub, and sending a POST request to an install-count endpoint, yet no explicit permission declaration is shown. Hidden or undeclared network capability weakens user and platform trust boundaries because the agent may contact external services without clear prior authorization or review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The manifest description frames the skill as a search/discovery/install helper, but the body also specifies external data fetching, bilingual keyword expansion, ranking logic, and a distinct installation workflow with side effects. This mismatch can cause an agent or user to underestimate what the skill will do, especially the external calls and operational behavior, which undermines informed consent and safe routing.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation claims the skill is read-only, but Step 3.1 instructs the agent to send a POST request that increments remote install counters. Mislabeling state-changing behavior as read-only is dangerous because users and orchestration systems may permit the skill under a lower-trust model while it still performs mutation on an external service.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill includes a separate telemetry-style API call to record installation counts before installation, but this behavior is not clearly described in the manifest description. Undisclosed outbound reporting creates privacy and consent concerns and may violate expectations that the skill only searches for and installs other skills.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file explicitly presents itself as a quick reference for a different skill ('huawei-cloud-skill-creator-skill') than the manifested finder/browse-only skill. This kind of cross-skill instruction contamination can cause an agent invoked for discovery or installation to load creation-oriented guidance, broadening its effective behavior beyond its declared purpose and increasing the chance of unsafe command selection.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The reference content includes operational cloud-management and skill-creation commands such as creating and deleting servers, VPCs, buckets, and generating skill files, which directly contradict a browse/find/install-only skill scope. If the agent consults this file during execution, it may be steered toward performing destructive or privilege-requiring actions unrelated to user intent, creating a real risk of unauthorized resource changes or expanded capability use.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill manifest says this skill should search, browse, discover, and install existing Huawei Cloud skills, but the referenced guide instead instructs the agent to design, generate, validate, and test new skills. That capability expansion is dangerous because it materially changes the trust boundary and can cause the agent to create files, generate operational content, and perform cloud actions far beyond the user's expected intent for a discovery/install skill.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This section directs full lifecycle testing for resource-creating skills, including creating cloud resources, testing them, and deleting them afterward. In the context of a skill-finder/install skill, these instructions are unjustified and dangerous because they can trigger real infrastructure changes, incur charges, and risk cleanup failures that leave billable or exposed resources behind.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The guide requires the agent to verify commands by executing CLI, SDK, and API calls and even suggests installing SDK packages and using credentials. For a skill whose stated purpose is only to find or install existing skills, requesting or using cloud credentials is unnecessary privilege expansion and increases the risk of unintended authenticated actions or credential misuse.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger text is broad enough to activate on many Huawei Cloud-related requests, including management tasks that may exceed simple skill discovery. Over-broad invocation can route unrelated or sensitive requests into a skill that promotes installation and external network access, increasing the chance of unnecessary side effects or user confusion.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The installation workflow directs the agent to execute package installation commands and a telemetry POST without a clear, prominent user warning or consent checkpoint. Because `npx` installation executes third-party package logic and modifies the local environment, failing to warn or confirm can lead to unintended code execution, package trust issues, and silent data disclosure to external endpoints.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The checklist requires Chinese trigger words but does not constrain them to be specific, scoped, or minimally activating. In a skill-discovery context, overly broad trigger phrases can cause accidental invocation, unintended routing, or prompt collisions with unrelated user requests, which increases the chance of incorrect tool selection and downstream unsafe actions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide tells users to echo whether access key and secret key environment variables are set. Even without printing full secret values intentionally, this can disclose credential presence/state into terminal history, logs, screen recordings, or shared sessions, which is unnecessary operationally and can aid attackers or expose sensitive environment structure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.