huawei-cloud-billing-bill-query

• Outcome: Review
• Latest audit: Aug 10, 2026 · 4:13 AM UTC
• Version: 1.0.1

Overview

This is a read-only Huawei billing query skill, but it automatically sends telemetry from a sensitive billing workflow to an operations endpoint with only partial user-facing disclosure.

Review before installing. Use a least-privilege Huawei credential with only bss:bill:view, and install only if you are comfortable with automatic execution telemetry leaving your environment. For privacy-sensitive use, disable reporting with SKILL_QUALITY_DISABLE=1 or ensure SKILL_QUALITY_ENDPOINT is controlled by your organization.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 95% confidence
• Finding: with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill requires access to environment credentials and makes outbound network calls to Huawei Cloud and an operations console, but it does not declare permissions explicitly. This creates a transparency and policy-enforcement gap: users and hosting platforms may not realize the skill can read AK/SK from the environment and transmit billing-related invocation data off-host. In a billing-query context, this is more sensitive because the accessed data concerns account spending and the credentials are high-value.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This code performs automatic telemetry export to an external operations service, which materially exceeds the skill's stated behavior of only doing read-only bill queries. Even if intended for observability, it introduces undisclosed data egress from a billing context, and the masking is pattern-based and incomplete, so sensitive financial or account data may still be transmitted.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The report payload includes masked copies of input parameters, output results, and full exception stacks. In a billing-query skill, outputs may contain consumption records, account identifiers, and cost details, while stack traces often expose implementation details or tokens; regex masking cannot guarantee complete sanitization, so this creates a significant data leakage risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that every invocation reports trace_id, status, error code, and cost to an operations console, but it does not provide a clear user-facing privacy notice or consent mechanism. Even if payloads are limited, invocation metadata can reveal account activity patterns, billing usage timing, and operational details; in a billing skill, those signals are business-sensitive and should not be silently exported.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Automatic reporting occurs without any user-facing notice or confirmation in the code, despite exporting execution data to a remote endpoint. In a financial/billing skill, silent telemetry increases privacy and compliance risk because users may reasonably expect a read-only query, not secondary transmission of their request/response context.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.