huawei-cloud-bss-account-balance

• Outcome: Review
• Latest audit: Aug 10, 2026 · 8:19 AM UTC
• Version: 1.0.0

Overview

The skill performs the advertised read-only Huawei Cloud billing queries, but it also automatically sends billing-query inputs and results to a separate telemetry endpoint by default.

Review before installing. Use least-privilege Huawei Cloud credentials limited to BSS read actions, avoid pasting or echoing AK/SK values, and disable telemetry with SKILL_QUALITY_DISABLE=1 unless you explicitly approve sending billing-query metadata and results to the configured quality-reporting endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 97% confidence
• Finding: with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill requires access to environment variables and network resources but does not declare those capabilities explicitly. Hidden or undeclared capabilities reduce reviewability and informed consent, especially because the skill reads cloud credentials from the environment and makes outbound requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is balance querying, but the skill also sends execution telemetry to an external service unrelated to Huawei Cloud billing. Because the telemetry includes masked parameters, outputs, errors, stack traces, timing, and trace IDs, it can leak sensitive financial metadata or operational context beyond the user’s expectation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file implements outbound quality-report uploads that are unrelated to the declared function of querying Huawei Cloud account balances. Hidden secondary behavior is risky because it expands the skill's trust boundary and can transmit execution metadata to an external service without being necessary for the user-requested task.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The reporting logic captures and transmits input parameters, output results, error messages, and full stack traces. For a billing/account-balance skill, those values can contain financial details, account identifiers, tokens, or other operationally sensitive data, and the masking is regex-based and incomplete.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The module's documentation describes a generic execution-quality reporting SDK rather than Huawei Cloud balance-query behavior, which indicates capability mismatch and hidden functionality in the skill package. That mismatch increases the chance that users or reviewers will authorize a billing skill while unknowingly deploying telemetry code that exports runtime data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill mentions quality reporting deep in the document but does not present a prominent user-facing warning that telemetry is sent to an external operations console. This undermines transparency and informed consent, especially since the reported data may include outputs and error content from a billing-related workflow.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill sends sensitive financial information, including account balances and transaction history, to Huawei Cloud's external BSS API, but the documentation does not clearly warn users about that data transfer. This can undermine informed consent and create privacy/compliance issues, especially in agent environments where users may assume processing is local unless stated otherwise.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation states that access keys are read from environment variables but does not explicitly warn that cloud credentials will be used to authenticate outbound requests. In multi-tenant or delegated agent settings, lack of disclosure about credential use can lead to unsafe operation, accidental use of high-privilege keys, and poor secret-handling expectations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs users to export long-lived Huawei Cloud AK/SK credentials into environment variables but provides no warning about secret handling, shell history, process exposure, or use of least-privilege credentials. In a cloud billing skill, these credentials can grant access to sensitive financial/account data and may be reused elsewhere, so normalizing unsafe secret handling increases the chance of credential leakage and account compromise.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code performs automatic external reporting of execution data without any visible user-facing disclosure or consent mechanism. In the context of a balance-query skill, silent telemetry is especially problematic because users reasonably expect financial/account queries to remain confined to the intended cloud provider APIs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script reads a command string from templates/test-vars.json and executes it with eval, which allows arbitrary shell metacharacters, command substitution, and chained commands to run on the host. Because this runner is explicitly intended to hit the live Huawei Cloud BSS API, a modified test-vars.json or untrusted test case can trigger both local command execution and unintended actions against real cloud resources or sensitive billing data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.