huawei-cloud-billing-account-balance

• Outcome: Review
• Latest audit: Aug 6, 2026 · 10:20 AM UTC
• Version: 1.0.0

Overview

This read-only Huawei balance skill is mostly coherent, but it automatically sends billing-result telemetry to an external operations service by default.

Review before installing. Use a least-privilege Huawei policy such as bss:balance:view, avoid broad BSS read permissions when possible, and set SKILL_QUALITY_DISABLE=1 unless you intentionally want execution data sent to the skillsopr endpoint. Do not run it with production billing credentials unless that telemetry path is acceptable to your organization.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 94% confidence
• Finding: with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill documentation describes code that reads cloud credentials from environment variables and makes outbound network requests to Huawei Cloud and an additional operations console for execution-quality reporting, but no explicit permissions are declared. This creates a permission-transparency gap: users and reviewers may not realize the skill can access sensitive AK/SK material and transmit metadata off-box, which increases the risk of unintended credential exposure or covert data egress if the implementation changes or is abused.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This code performs external telemetry reporting that is not necessary to fulfill a read-only account-balance query. That mismatch increases data exposure and operational risk because a billing skill unexpectedly transmits execution metadata off-box to a remote service.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The report payload includes masked input, output, and full exception stack data, which is broader than needed for a balance check and may still contain sensitive financial, account, or environmental details after incomplete masking. Stack traces especially can reveal internal paths, configuration, identifiers, and error context useful for further compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide states that every execution is reported to an operations console and that reporting fails silently, but it does not clearly warn users what metadata may be transmitted or require explicit opt-in consent. In a billing/account-balance skill, even execution metadata can reveal sensitive operational behavior, account usage patterns, or identifiers, and silent background reporting reduces transparency and informed user control.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation states that the skill reads AK/SK credentials from environment variables and sends execution metadata to an external operations console, but it does not clearly disclose these trust and data-flow boundaries to the user. Even if the reported fields are limited to status, error code, and trace_id, undisclosed outbound reporting and implicit credential use create avoidable privacy, compliance, and operational risk, especially in environments where users expect local-only or non-telemetry behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The SDK transmits execution data to a remote endpoint automatically and the code provides no user-facing notice, consent, or confirmation path. In a billing context, silent telemetry is more dangerous because users reasonably expect a simple read-only balance lookup, not export of execution details.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly states that each execution automatically reports masked inputs, outputs, and stack traces to an external operations platform. That is a real security/privacy concern because it normalizes broad telemetry collection for a billing skill and may lead integrators to deploy data exfiltration by default.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The API and comments encourage callers to capture and send execution input/output content to a backend service, making sensitive-data transmission part of normal integration guidance. In the context of a cloud billing skill, that increases the chance of routine leakage of financial/account information and debugging artifacts.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.