huawei-cloud-resource-inventory

• Outcome: Review
• Latest audit: Sep 17, 2026 · 12:21 PM UTC
• Version: 1.0.0

Overview

This is a disclosed read-only Huawei Cloud inventory skill, but it weakens TLS protection while using cloud credentials and collecting broad infrastructure metadata.

Install only if you are comfortable running a broad read-only inventory over your Huawei Cloud tenant. Use least-privilege read-only AK/SK credentials scoped to the needed services and regions, avoid shared shells or CI environments with unrelated Huawei/OBS credentials, and treat the output as sensitive. The TLS verification bypass should be fixed before normal use, especially on networks using proxies or any untrusted network path.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/resource_inventory.py:29
• Finding: TLS Certificate Verification Is Unconditionally Disabled## Vulnerability Details **File Location**: `scripts/resource_inventory.py`, lines 29–30 and 73–75 **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ### Vulnerable Code ```python import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) ``` ```python http_config = HttpConfig.get_default_config() http_config.ignore_ssl_verification = True http_config.timeout = 30 http_config.retry_times = 3 ``` ### Technical Analysis The HTTP configuration supplied to every Huawei Cloud SDK client unconditionally disables TLS certificate verification. The code also globally suppresses `InsecureRequestWarning`, preventing operators from noticing the insecure connection. The configuration is created by `_get_http_config()` and assigned to `ResourceInventory.http_config`. `_build_client()` then passes it to each service client through `.with_http_config(self.http_config)`. Consequently, inventory requests for ECS, BMS, RDS, EVS, DCS, CCE, VPC, EIP, ELB, NAT, and DNS all use this weakened TLS configuration. Without certificate and hostname validation, encryption alone does not authenticate the cloud API endpoint. A network-positioned attacker—or an attacker controlling a proxy configured through `HTTPS_PROXY` or `HTTP_PROXY`—can present an arbitrary certificate without causing the client to reject the connection. ### Attack Path 1. A user invokes the inventory script with valid Huawei Cloud AK/SK credentials. 2. `_get_http_config()` sets `ignore_ssl_verification` to `True`. 3. The script builds cloud service clients using this shared insecure HTTP configuration. 4. A network-positioned attacker intercepts traffic, or an untrusted configured proxy terminates the TLS connection using an attacker-controlled certificate. 5. Because certificate verification is disabled, the SDK accepts the unauthenticated endpoint. 6. The attacker can observe requests and returned tenant inventory or alter API responses before they reach th ...[truncated 886 chars]
• Remediation: ## Remediation Suggestions - Remove `http_config.ignore_ssl_verification = True` and retain the SDK's secure certificate-verification default. - Remove global suppression of `urllib3.exceptions.InsecureRequestWarning`. - If an enterprise proxy or private certificate authority is required, configure an explicit trusted CA bundle while preserving certificate-chain and hostname validation. - Reject invalid or untrusted proxy certificates rather than silently continuing. - Add tests confirming that connections using expired, hostname-mismatched, self-signed, or otherwise untrusted certificates fail closed. - Document secure proxy configuration and avoid offering a general-purpose option that disables TLS verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

ACCESS_KEY / _AK / SECRET_KEY / _SK patterns.
    """
    ak, sk = "", ""
    for k, v in os.environ.items():
        u = k.upper()
        if not (u.startswith("HUAWEI") or u.startswith("HW")
                or u.startswith("HWC") or u.startswith("OBS")):

• Confidence: 95% confidence
• Finding: Iterating over os.environ.items() to harvest keys matching broad AK/SK patterns is a genuine secret-discovery behavior. In an agent or multi-tenant execution environment, this can capture credentials not intended for this skill and then use them to perform extensive tenant reconnaissance across regions, making the context more dangerous than a narrowly scoped local admin script.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The script globally disables SSL certificate verification via urllib3 warning suppression and HttpConfig.ignore_ssl_verification = True. Even though the stated operation is read-only, this exposes cloud API authentication and inventory traffic to man-in-the-middle attacks, enabling credential theft, response tampering, and false inventory results.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill requires both environment access for AK/SK credentials and network access to enumerate cloud resources, but it does not explicitly declare a tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent runtime may permit broader capabilities than intended, and the skill can access tenant-wide inventory data without a machine-readable least-privilege boundary.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The document title and all acceptance criteria are written exclusively in Chinese, which constitutes a natural-language locale constraint. There is no indication that the skill is region-specific for documentation language or that users may choose another language, so this can violate a language/locale policy requiring user opt-in or justification.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document explicitly describes loading AK/SK credentials from environment variables and performing tenant-wide, cross-region inventory queries, but it does not warn that the operation enumerates potentially sensitive infrastructure metadata across the entire account. Even if the skill is read-only, broad resource discovery can expose network topology, asset inventory, and service relationships that are sensitive and should be disclosed to the user before execution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The report explicitly states testing was performed with real tenant AK/SK credentials, which normalizes use of sensitive cloud credentials in test workflows without any warning, masking, or handling guidance. In a cloud inventory skill that enumerates resources across regions, misuse or leakage of such credentials could expose a full tenant-wide asset inventory and enable broader compromise if the credentials are over-privileged.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The verification instructions explicitly read cloud access key and secret key values from environment variables but provide no warning about sensitive credential handling, least-privilege use, redaction, or avoiding exposure in shared shells/CI logs. In the context of a cross-region tenant-wide inventory skill, these credentials likely grant broad read access across many cloud resources, so mishandling them could expose a comprehensive view of infrastructure and materially aid reconnaissance.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code scans the entire process environment for anything that looks like AK/SK credentials, rather than reading only explicit variable names. In a shared agent/runtime environment, this can unintentionally pick up unrelated secrets and use them for broad tenant-wide inventory collection, increasing the risk of secret misuse and unexpected cross-context data access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This skill automatically discovers credentials and performs broad multi-region inventory enumeration, then prints sensitive infrastructure metadata, but provides no explicit warning, consent step, or output minimization. In an agent setting, that makes accidental over-collection and disclosure of tenant topology, IPs, database instances, and other sensitive asset information more likely.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes the skill as outputting results as plain-text tables grouped by resource type. This test fixture explicitly validates a `--format json` mode and expects JSON output, indicating the implemented or intended behavior includes machine-readable JSON output beyond the manifest's described presentation format.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The visible natural-language headings and labels in the documentation are Chinese-only, which may impose a language choice on users without opt-in. There is no indication that the skill is intended solely for a Chinese-speaking or region-specific audience, nor any alternate language option.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown file presents the skill's instructions and policy details entirely in Chinese, and it does not indicate that language selection is optional or configurable. Under the natural-language policy rule, forcing a specific language without user opt-in can be a locale/language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file’s natural-language instructions are exclusively in Chinese, which can constitute a language/locale policy issue when no user opt-in or documented locale scope is provided. The policy allows locale constraints when explicitly justified, but this document gives no indication that it is intentionally limited to Chinese-speaking users or a China-specific audience.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkbms>=3.1.0
huaweicloudsdkrds>=3.1.0

• Confidence: 96% confidence
• Finding: The dependency uses a lower-bound version specifier instead of pinning to an exact version, so installs may resolve to different package versions over time. This increases supply-chain risk and can introduce breaking changes or newly published malicious/compromised releases into the environment without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkbms>=3.1.0
huaweicloudsdkrds>=3.1.0
huaweicloudsdkevs>=3.1.0

• Confidence: 96% confidence
• Finding: The dependency is not strictly pinned, which means future installations may fetch newer unexpected versions. That weakens build reproducibility and exposes the skill to supply-chain compromise or unreviewed upstream changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkbms>=3.1.0
huaweicloudsdkrds>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdkdcs>=3.1.0

• Confidence: 96% confidence
• Finding: Using an open-ended version range allows the resolver to install later releases that were not tested with this skill. If an upstream package is compromised or introduces insecure behavior, the skill could inherit that risk at install time.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkbms>=3.1.0
huaweicloudsdkrds>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdkdcs>=3.1.0
huaweicloudsdkcce>=3.1.0

• Confidence: 96% confidence
• Finding: An unpinned dependency permits nondeterministic package resolution and makes the environment dependent on whatever latest compatible release is available. This is a classic supply-chain hygiene issue that can lead to vulnerable or malicious code being pulled in unintentionally.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkecs>=3.1.0
huaweicloudsdkbms>=3.1.0
huaweicloudsdkrds>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdkdcs>=3.1.0
huaweicloudsdkcce>=3.1.0
huaweicloudsdkvpc>=3.1.0

• Confidence: 96% confidence
• Finding: The package is declared with only a minimum version, so different builds may consume different upstream code. That creates avoidable supply-chain exposure and reduces confidence that the deployed skill matches the tested one.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkbms>=3.1.0
huaweicloudsdkrds>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdkdcs>=3.1.0
huaweicloudsdkcce>=3.1.0
huaweicloudsdkvpc>=3.1.0
huaweicloudsdkeip>=3.1.0

• Confidence: 96% confidence
• Finding: Because the dependency is unpinned, installation can silently drift to a new release with changed or insecure behavior. Even in a read-only inventory skill, compromised SDK code could affect confidentiality of cloud metadata or credentials handled by the runtime.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkrds>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdkdcs>=3.1.0
huaweicloudsdkcce>=3.1.0
huaweicloudsdkvpc>=3.1.0
huaweicloudsdkeip>=3.1.0
huaweicloudsdkelb>=3.1.0

• Confidence: 96% confidence
• Finding: This declaration allows any version at or above the minimum, which undermines reproducible builds and increases supply-chain risk. A later compromised or incompatible package release could be installed without any code change in this repository.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkevs>=3.1.0
huaweicloudsdkdcs>=3.1.0
huaweicloudsdkcce>=3.1.0
huaweicloudsdkvpc>=3.1.0
huaweicloudsdkeip>=3.1.0
huaweicloudsdkelb>=3.1.0
huaweicloudsdknat>=3.1.0

• Confidence: 96% confidence
• Finding: An open-ended version constraint leaves the final installed package version to external state at install time. That can introduce vulnerable or malicious upstream code and makes incident response harder because builds are not deterministic.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkdcs>=3.1.0
huaweicloudsdkcce>=3.1.0
huaweicloudsdkvpc>=3.1.0
huaweicloudsdkeip>=3.1.0
huaweicloudsdkelb>=3.1.0
huaweicloudsdknat>=3.1.0
huaweicloudsdkdns>=3.1.0

• Confidence: 96% confidence
• Finding: The dependency is not pinned, so future installations may retrieve a newer release that has not been validated for security or compatibility. Since this skill inventories networking resources, a compromised SDK could expose sensitive topology or credential-related data handled in memory.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcce>=3.1.0
huaweicloudsdkvpc>=3.1.0
huaweicloudsdkeip>=3.1.0
huaweicloudsdkelb>=3.1.0
huaweicloudsdknat>=3.1.0
huaweicloudsdkdns>=3.1.0
huaweicloudsdkiam>=3.1.0

• Confidence: 96% confidence
• Finding: Using >= instead of an exact version allows unreviewed upstream package changes to enter the environment. This creates a low-severity but real supply-chain vulnerability due to loss of reproducibility and trust in tested artifacts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkvpc>=3.1.0
huaweicloudsdkeip>=3.1.0
huaweicloudsdkelb>=3.1.0
huaweicloudsdknat>=3.1.0
huaweicloudsdkdns>=3.1.0
huaweicloudsdkiam>=3.1.0

• Confidence: 96% confidence
• Finding: This requirement does not pin the package to a fixed release, so the resolved code can change between installs. That increases exposure to compromised upstream releases and makes reliable security review more difficult.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkeip>=3.1.0
huaweicloudsdkelb>=3.1.0
huaweicloudsdknat>=3.1.0
huaweicloudsdkdns>=3.1.0
huaweicloudsdkiam>=3.1.0

• Confidence: 96% confidence
• Finding: An unpinned dependency permits package drift and can unexpectedly introduce insecure or malicious updates from the upstream repository. For a cloud inventory skill that touches broad tenant metadata, even read-only operation does not eliminate the risk of data exposure through a compromised SDK.

Static analysis

No suspicious patterns detected.