Security audit

huawei-cloud-storage-query

Security checks across malware telemetry and agentic risk

Overview

This looks like a read-only Huawei Cloud storage query skill, but it needs review because it uses cloud credentials while disabling TLS verification and installing runtime dependencies.

Review before installing. Use only least-privilege read-only Huawei Cloud credentials, avoid running setup on sensitive hosts, and prefer a version that keeps TLS certificate verification enabled and pins dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill exposes shell, network, and environment-variable capabilities but does not declare permissions or boundaries for them. In practice it instructs execution of local scripts that validate credentials, create virtual environments, install dependencies, and call cloud/IAM endpoints, which expands trust and execution scope beyond a simple documentation-only query skill.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior materially exceeds the declared read-only storage-query purpose: it performs IAM-based project discovery, credential validation, dependency installation, virtual-environment setup, and may retrieve OBS object content. This mismatch can cause users or orchestrators to grant the skill broader trust than intended, enabling credential use, data access, and local system modification outside the advertised scope.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: A supposedly read-only query skill requires running environment check scripts that install dependencies and create or modify a virtual environment. That introduces local side effects and supply-chain exposure, because package installation and bootstrap scripts execute code on the host before the actual query runs.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The claim of 'no write operations' is misleading because the documented workflow includes dependency installation and virtual-environment creation, both of which modify the local system. Mislabeling side effects reduces informed consent and can bypass policy controls that allow only read-only skills.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The notes reiterate that the skill is read-only, but the earlier prerequisites and execution flow still mandate local setup actions with side effects. Repeating the misleading safety framing increases the chance that operators trust and run the skill without recognizing its installation and execution risks.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script enumerates tenant domain projects via `ListDomainProjects`, which expands beyond the declared storage-query scope in the skill manifest. Even though it is read-only, domain/project enumeration exposes broader account structure and identifiers that can aid reconnaissance and enable access-scope discovery unrelated to the user’s storage query intent.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The script enumerates CBR projects for the supplied region, which exposes account/project inventory beyond narrowly scoped storage-object queries like buckets, volumes, or backups. In a read-only skill this is not destructive, but project enumeration can reveal organizational structure and enable broader reconnaissance across cloud resources.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is described as a read-only Huawei Cloud storage query tool, but this helper performs local environment mutation including Python installation, venv creation, pip installation, and dependency changes. That expands the trust boundary from cloud-read operations to arbitrary local system setup, increasing supply-chain and host-impact risk beyond what a user would reasonably expect from the manifest.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: This script executes local commands through subprocess as part of environment preparation, including package installation workflows unrelated to querying storage resources. In a skill whose advertised scope is cloud resource reads, silently invoking local tooling broadens attack surface and can have unexpected host-side effects.

Description-Behavior Mismatch

Low

Confidence: 80% confidence
Finding: The credential-validation step calls IAM list-users APIs, which is outside the manifest's stated storage-query scope and accesses identity metadata. While the call is read-only, it collects information from a different service domain than users were led to expect, creating a least-privilege and disclosure concern.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script loads cloud credentials and immediately uses them to make a live Huawei CBR API request, but there is no user-facing disclosure, consent check, or indication that authenticated remote access will occur. In an agent-skill context, this can surprise users, expose sensitive metadata from backups, and enable unintended cloud data access under the operator's credentials.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: This is a true vulnerability: the code globally disables TLS certificate verification by setting ignore_ssl_verification = True and suppresses the resulting warnings. That allows a man-in-the-middle attacker on the network or on a configured proxy path to intercept or tamper with Huawei Cloud API traffic, potentially exposing AK/SK-derived authenticated requests, resource metadata, and backup or storage inventory data.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script globally disables HTTPS certificate verification by setting the default SSL context to an unverified one. That affects outbound downloads and potentially SDK/API traffic in this process, enabling man-in-the-middle attacks that can tamper with downloaded bootstrap code, package metadata, or API responses and credentials.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The helper downloads get-pip.py from the network and immediately executes it, while certificate verification has already been disabled globally. This creates a direct remote code execution path through a compromised mirror, network attacker, or tampered download, with the potential to execute arbitrary code on the host during environment setup.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0
Confidence: 96% confidence
Finding: huaweicloudsdkcore>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0
Confidence: 96% confidence
Finding: huaweicloudsdkiam>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0 huaweicloudsdkcbr>=3.1.0
Confidence: 96% confidence
Finding: huaweicloudsdkevs>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0 huaweicloudsdkcbr>=3.1.0
Confidence: 96% confidence
Finding: huaweicloudsdksfsturbo>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0 huaweicloudsdkcbr>=3.1.0
Confidence: 96% confidence
Finding: huaweicloudsdkobs>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0 huaweicloudsdkcbr>=3.1.0
Confidence: 96% confidence
Finding: huaweicloudsdkcbr>=3.1.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/ensure_env.py:284