iam-query

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:46 AM UTC
• Version: 1.1.1

Overview

This IAM query skill is mostly read-only, but it performs under-disclosed local setup and insecure network handling that users should review before installing.

Install only if you are comfortable with local code execution, package installation, persistent .venv creation, and live Huawei Cloud credential validation. Do not use production AK/SK or bearer tokens with this skill unless TLS verification is fixed and dependency installation is made explicit and controlled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill requests execution of local shell commands, reads environment variables, and performs networked operations, yet declares itself as a simple read-only IAM query skill without corresponding permission disclosure. This is dangerous because users or orchestrators may authorize the skill under a lower-trust assumption while it can bootstrap environments, access credentials, and reach external resources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest claims the skill is limited to read-only IAM querying, but the documentation requires environment bootstrapping, virtualenv creation, package installation, and possible downloads from external sources. That mismatch materially expands the attack surface: a user expecting harmless queries may instead allow code execution, package installation, and supply-chain exposure on the local system.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The metadata says this is an IAM-only skill, but the body describes a generic Huawei Cloud resource-query framework covering broader infrastructure discovery. This inconsistency is risky because it can cause overbroad invocation and permit collection of cloud inventory outside the scope users or policy engines intended to authorize.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The overview claims generic cloud resource querying despite the manifest presenting an IAM-focused capability. This can lead to unintended use for non-IAM discovery and broader access to cloud metadata than expected, weakening least-privilege assumptions around when the skill should run.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The capability examples mention images, disks, networks, and other non-IAM resources that are inconsistent with an IAM query skill. In context, this makes the skill more dangerous because IAM credentials and project context could be used to enumerate wider cloud assets than a user anticipated from the name and description.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The code globally suppresses InsecureRequestWarning, which hides evidence that TLS certificate validation has been disabled. In a skill that queries IAM data using cloud access keys, this increases the chance that operators will miss a man-in-the-middle condition and unknowingly send credentials or receive tampered identity data over an untrusted connection.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: The HTTP client explicitly sets ignore_ssl_verification = True for all requests, disabling server certificate validation. Because this skill uses AK/SK and optionally security tokens to query IAM, an attacker controlling the network or a malicious proxy could intercept credentials, alter IAM responses, or impersonate the cloud endpoint.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill is advertised as a read-only IAM query capability, but this environment script performs privileged host changes such as package installation, virtualenv creation, dependency bootstrapping, and real credential/API validation. That materially exceeds the declared trust boundary and can cause unexpected system modification or credential use simply from preparing the environment.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: For a read-only IAM query skill, automatic creation of virtual environments and process re-execution broadens the operational scope into local system management. While not inherently malicious, it introduces host-side side effects and execution chaining that are unnecessary for the stated purpose and increase risk in an agent context.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The script downloads get-pip.py from the network and executes it locally, which is remote code execution by design. In an agent skill whose purpose is only IAM querying, this is unjustified and especially dangerous because TLS verification has also been disabled elsewhere, making supply-chain compromise or man-in-the-middle replacement far easier.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list includes broad generic terms such as identity, policy, agency, and common Chinese equivalents, which increases the chance of accidental invocation in unrelated conversations. Because the skill can execute local scripts and access credentials, unintended invocation creates unnecessary exposure and may launch sensitive environment checks or cloud enumeration without clear user intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs automatic environment validation and dependency installation, including potential system/package-manager changes, without a clear up-front user-facing warning that the host may be modified. This is dangerous because a seemingly read-only query action can alter the local machine, pull packages from external sources, and create supply-chain or persistence risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide advertises scripts that enumerate permanent access keys and access-key usage data, which are highly sensitive IAM artifacts, but it provides no warning about secure handling, output minimization, or redaction. In an agent skill context, this increases the chance that operators will casually expose credential identifiers or related metadata in logs, chat transcripts, or downstream tooling, enabling credential reconnaissance and follow-on attacks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Documenting token validation without noting that both the input token and returned authentication metadata are sensitive can lead users or agents to disclose live bearer tokens or session details during troubleshooting. Because tokens are often directly usable for authenticated access, accidental exposure in an automation or assistant workflow can result in immediate account or API compromise.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script globally disables HTTPS certificate verification by replacing the default SSL context with an unverified one. That allows man-in-the-middle interception of package mirror probing and bootstrap downloads, which becomes especially severe because the script later fetches and executes external code.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

# ── 工具函数 ──────────────────────────────────────────────────────────

def run_cmd(cmd, timeout=None, **kwargs):
    """运行命令，返回 (returncode, stdout, stderr)

    Args:

• Confidence: 75% confidence
• Finding: timeout=None

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0

• Confidence: 90% confidence
• Finding: huaweicloudsdkcore>=3.1.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0

• Confidence: 90% confidence
• Finding: huaweicloudsdkiam>=3.1.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/ensure_env.py:284