huawei-cloud-billing-balance-history

• Outcome: Review
• Latest audit: Aug 7, 2026 · 2:49 PM UTC
• Version: 1.0.1

Overview

The skill is a read-only Huawei Cloud billing query tool, but it sends billing query inputs and results to a separate telemetry endpoint by default and ships real-looking billing/account data in test artifacts.

Review this skill before installing. Use a least-privilege Huawei Cloud read-only billing key, run it only in an environment where outbound telemetry is acceptable, and set SKILL_QUALITY_DISABLE=1 unless you explicitly want execution reports sent to the skillsopr endpoint. The publisher should redact shipped test data and change telemetry to opt-in or limited status-only reporting before this is treated as low-risk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 97% confidence
• Finding: with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly relies on environment-stored AK/SK credentials and outbound network access to Huawei Cloud BSS, yet the finding indicates those capabilities are not formally declared. Undeclared access to secrets and external network destinations weakens reviewability and sandbox policy enforcement, and in this case the built-in quality-reporting path also sends execution metadata to an operations console on every run.

Description-Behavior Mismatch

Low

• Confidence: 86% confidence
• Finding: The report states that every run is automatically sent to an external quality-reporting endpoint, which is behavior outside the core billing-query function. Even if the billing APIs are read-only, this adds a secondary outbound data flow that can leak prompts, query parameters, account metadata, timestamps, or execution context to a third party without being clearly surfaced as part of normal skill behavior.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The report states that every execution performs a synchronous quality-report upload to an external endpoint, which is behavior outside the three user-facing read-only BSS queries described in the skill metadata. Even if billing data is not modified, undisclosed outbound telemetry can transmit user prompts, execution metadata, or account-related details to a third party, creating a privacy and data-governance risk.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This skill is described as a read-only billing query tool, but the SDK adds unrelated outbound telemetry behavior. Even if it does not modify Huawei billing resources, it expands the skill's actual behavior to include data transmission to a third-party operations endpoint, violating least surprise and increasing attack surface.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The report() path is designed to transmit input parameters, output results, error messages, and full stack traces to a remote service. For a billing-balance skill, these fields can contain account balances, debt amounts, billing history, identifiers, and exception context, creating a clear data exfiltration risk beyond the stated purpose of the skill.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The docstring promises desensitized reporting, but _safe_json serializes structured values directly and only falls back to mask_text on serialization failure. As a result, secrets or sensitive business data inside dictionaries/lists are likely transmitted unredacted, creating a mismatch between documented and actual privacy protections.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrase shown in the test case causes the billing-balance skill to activate on a request to recharge an account, which is outside the documented read-only scope. Overly broad activation can route users into the wrong skill and lead to unsafe or confusing behavior, especially when the system responds with raw tooling errors instead of a clear refusal.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The documented actual behavior shows the skill can emit a raw CLI argument parsing error rather than a controlled refusal for an out-of-scope request. While this does not directly modify billing data, it leaks implementation details and degrades safety by failing open into internal error output instead of enforcing a clear capability boundary.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The markdown example includes real-looking sensitive billing data, including a customer ID, account name, service usage breakdown, and detailed consumption/debt amounts. Even though the skill is read-only, exposing this information in shipped test artifacts or documentation can leak financial and account metadata that could enable privacy violations, internal reconnaissance, or targeting of a specific cloud account.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Automatic reporting to an external HTTP endpoint without clear user-facing notice creates a privacy and data-governance risk. In a billing skill, even execution metadata can be sensitive, and if request contents or results are included in the report, users may unknowingly transmit financial information outside the primary cloud provider boundary.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown report acknowledges outbound HTTP uploads to an operations endpoint on each run but does not indicate any user warning, consent flow, or privacy notice. In a billing/balance skill, this is more sensitive because executions may involve financial account context, so silent transmission of run data materially increases privacy and compliance risk.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list includes broad phrases such as '查询余额', 'monthly bill', and 'income expense' that can overlap with ordinary user requests lacking sufficient scoping. This can cause the billing skill to activate for requests outside its intended boundary, increasing the chance of unintended access to sensitive financial/account data or incorrect handling of unrelated tasks.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: Several negative examples are still marked as matched, including a recharge request and malformed or invalid query scenarios, which shows the trigger boundary is not enforcing safe intent discrimination. This means the skill may be selected for unsupported, risky, or ambiguous requests, potentially exposing billing data, causing incorrect agent behavior, or masking needed validation failures.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The SDK performs outbound transmission of execution data without any user-facing notice, confirmation, or opt-in in the code path. In the context of a billing inquiry skill, silent telemetry is especially risky because users reasonably expect financial query results to stay within the service boundary needed to answer the request.

Ssd 3

High

• Confidence: 93% confidence
• Finding: The SDK's own instructions explicitly encourage capturing desensitized inputs, outputs, and stack traces for remote reporting, normalizing a design that can leak sensitive natural-language or structured billing data. This increases the chance that integrators will wire confidential request and response content into telemetry by default.

Ssd 3

High

• Confidence: 94% confidence
• Finding: The comments and API patterns encourage developers to assign full inputs and outputs into the reporting context, which are then serialized and transmitted. In this billing skill, that creates a substantial risk of exposing financial records, account states, and exception details to the telemetry backend.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.