ClawHub
Back to skill

Security audit

iam-query

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a read-only Huawei Cloud IAM query skill, but it needs review because its setup and SDK configuration weaken TLS protections while handling cloud credentials.

Review before installing. Use only temporary or least-privilege Huawei Cloud credentials, run it in an isolated environment, and avoid sensitive production accounts unless you are comfortable with the TLS-verification bypass and unpinned dependency installation behavior. Do not share or persist query outputs containing IAM users, access keys, MFA status, policy bindings, tokens, or identity-provider metadata.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill requests or implies powerful capabilities—environment access, network access, and shell execution—without explicitly declaring permissions or constraining them to least privilege. In this context, those capabilities are especially sensitive because the skill handles cloud credentials and instructs execution of local scripts, creating a path for secret exposure, unintended package installation, or arbitrary command execution beyond simple IAM reads.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior materially exceeds a read-only IAM query skill: it creates a virtual environment, installs dependencies, downloads bootstrap resources, and reportedly may disable SSL verification or use proxies. That mismatch is dangerous because users may consent to a low-risk identity query but actually execute code that modifies the local environment and fetches remote content, enabling supply-chain compromise or credential theft under the guise of a harmless skill.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The manifest presents the skill as IAM-specific, but the body describes a generic Huawei Cloud resource query tool spanning multiple services and resource types. This scope deception undermines trust boundaries: a user invoking an IAM skill may unintentionally authorize broader cloud enumeration than expected, increasing exposure of unrelated infrastructure metadata.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The execution instructions allow running scripts from arbitrary service categories under scripts/<service_category>/ rather than limiting execution to IAM-specific scripts. In a skill that already has shell, environment, and network capabilities, that broad dispatch model can be abused to execute unintended code paths or enumerate services far outside the user’s stated intent.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The title and overview describe a broad Huawei Cloud resource query capability, contradicting the IAM-only positioning in metadata. While this is partly a documentation integrity issue, in security-sensitive tooling it increases the likelihood of overbroad use, operator confusion, and accidental disclosure of non-IAM cloud inventory data.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
This helper performs OS-level package installation and uses privileged system package managers even though the skill is described as a read-only IAM query tool. That materially expands the trust boundary from cloud read APIs to host modification, creating unnecessary risk of unintended system changes or abuse if the script is run in sensitive environments.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The script disables TLS verification globally, then downloads external bootstrap code (get-pip.py) and executes it locally. That combination creates a strong supply-chain and man-in-the-middle risk: an attacker who can tamper with network traffic or a mirror response could achieve arbitrary code execution on the host.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This guide explicitly documents read-only scripts that enumerate highly sensitive IAM data such as access keys, last-used times, MFA devices, and attached policies, but provides no cautions about confidentiality, least-privilege use, or secure handling of results. In an IAM-query skill, exposing credential inventory and authorization mappings can materially aid reconnaissance, privilege mapping, and follow-on compromise if outputs are shown to unintended users or logged insecurely.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The guide documents token validation and identity-provider metadata retrieval without any warning that these outputs may contain sensitive authentication, federation, or environment details. Even though the operations are read-only, such information can support account discovery, SSO/federation reconnaissance, and abuse planning when exposed beyond intended administrators.

Unbounded Resource Access

Medium
Category
Excessive Agency
Content
# ── 工具函数 ──────────────────────────────────────────────────────────

def run_cmd(cmd, timeout=None, **kwargs):
    """运行命令，返回 (returncode, stdout, stderr)

    Args:
Confidence
71% confidence
Finding
The helper accepts timeout=None, allowing child processes to run indefinitely if callers omit a timeout. In a setup script that can invoke package managers and installers, this can lead to hangs or resource exhaustion and is especially undesirable in automation or agent-executed contexts.

Unpinned Dependencies

Low
Category
Supply Chain
Content
huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0
Confidence
95% confidence
Finding
The dependency is specified with a lower-bound only (>=3.1.0), which allows installation of any newer release, including versions with unreviewed behavior changes or a compromised upstream package. In a security-sensitive IAM query skill, SDK dependency drift is more dangerous because the code interacts with identity data and credentials, so supply-chain compromise or breaking changes could affect confidentiality or reliability.

Unpinned Dependencies

Low
Category
Supply Chain
Content
huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0
Confidence
95% confidence
Finding
This dependency is also unpinned and may resolve to any future version above 3.1.0, creating supply-chain and reproducibility risk. Because this package provides IAM-specific functionality, an unsafe or incompatible future release could expose sensitive identity metadata, mishandle authentication flows, or introduce malicious code into a privileged environment.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/ensure_env.py:284