huawei-cloud-business-tf-support

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:37 AM UTC
• Version: 1.0.0

Overview

The skill is read-only, but it is labeled as billing-only while its instructions and packaged scripts can query broader Huawei Cloud account, IAM, and resource metadata.

Review this before installing unless you specifically intend to grant Huawei Cloud credentials for broad read-only billing, account, IAM, and resource metadata queries. Use a tightly scoped read-only credential, avoid production secrets where possible, and be aware the setup installs Python dependencies, creates a local virtual environment, validates IAM access, and disables SSL verification in the SDK configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (56)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares itself as a billing/pricing query tool, yet the documentation instructs execution of shell scripts, use of environment variables, and networked SDK/API calls without corresponding declared permissions. This creates a trust-boundary mismatch: users or orchestration systems may grant or invoke the skill under false assumptions, while it can access credentials, run local commands, and reach cloud APIs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior materially exceeds the stated purpose: instead of only billing and pricing inquiries, the skill describes general Huawei Cloud resource discovery, IAM lookups, environment setup, and service validation. This scope expansion can expose unrelated cloud inventory and metadata, increasing the blast radius and enabling unintended reconnaissance under the guise of a narrow billing-only tool.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The SKILL documentation presents a general resource-query skill even though the metadata says it is limited to billing and fee support. This inconsistency can mislead operators and automated agents into invoking a much broader cloud-enumeration capability than expected, potentially exposing infrastructure details and credential-derived context.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The capability scope explicitly includes resource listing, detail retrieval, specifications, and dependency discovery unrelated to billing or pricing. In practice, that allows cloud inventory and topology enumeration, which is sensitive operational information and meaningfully more dangerous than the claimed narrow billing use case.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: Labeling the skill as a general 'Huawei Cloud Resource Query' tool in the body contradicts the billing-only manifest and increases the chance of misuse or overbroad invocation. While this is primarily a semantic and governance issue, misleading naming materially affects operator trust and policy decisions in systems that route tasks based on metadata.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script exposes a Huawei Cloud BMS inventory/specification query capability even though the skill manifest explicitly limits the skill to billing, fee, refund, coupon, balance, and pricing inquiries. This scope mismatch can enable unauthorized infrastructure enumeration through a skill that downstream systems or operators may trust as finance-only, weakening least-privilege and increasing the blast radius if the skill is invoked in the wrong context.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script advertises DCS pricing inquiry support but never calls Huawei Cloud billing or pricing APIs; it returns estimates derived from hard-coded SKU tables and constants. In a billing/pricing skill, this can mislead downstream automation or users into trusting stale or incorrect financial data, causing bad provisioning or cost decisions.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The CLI description and help text claim a pricing inquiry, but the implementation only performs local arithmetic from fixed constants. This is a security-relevant integrity issue because users may rely on the output as authoritative cloud pricing when it is only an undocumented estimate.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This script adds a city metadata lookup capability that does not align with the skill's declared billing and pricing-only purpose. In an agent skill, undocumented capabilities expand the effective permission surface and can mislead users or orchestrators about what the skill may do, undermining trust and policy-based tool selection.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code implements an unjustified reference-data lookup using cloud credentials and a live API call, despite being unrelated to Terraform billing or pricing inquiries. Even if the data itself is low sensitivity, hidden or unnecessary capabilities violate least privilege and create room for misuse, policy bypass, or unexpected data access patterns inside a narrowly scoped skill.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script exposes a generic unit-conversion enumeration endpoint rather than a billing-specific inquiry, which exceeds the manifest’s stated billing/pricing-only scope. In an agent skill context, scope expansion is dangerous because it can enable unintended data access paths or tool misuse beyond what routing, policy, or user expectations permit.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The CLI advertises that --region controls the request region, but the client is always built with BssRegion.CN_NORTH_1, ignoring user input. This creates a trust boundary violation: callers may believe requests are constrained to one region while the code silently targets another, causing incorrect data retrieval, policy bypass, or operational mistakes in multi-region environments.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script performs a geographic county lookup via `ListCountiesRequest`, which is outside the declared skill scope of billing, fee, refund, coupon, balance, or pricing inquiries. In an agent skill, this kind of scope drift is dangerous because it expands accessible functionality beyond the user's stated business purpose, undermines least privilege, and can be used to bypass policy or tooling assumptions about what the skill is allowed to do.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script exposes a generic measure-unit enumeration capability that is not clearly tied to the skill’s declared Terraform billing and pricing inquiry scope. Even though the operation is read-only, expanding a skill beyond its stated purpose weakens least-privilege boundaries and can enable unauthorized metadata discovery or capability creep inside an agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This code adds an undeclared metadata-enumeration action that is not justified by the stated billing-only support purpose. In agentic systems, undeclared capabilities are risky because they create hidden behavior that operators and policy layers may not expect, increasing the chance of misuse or bypass of intended functional constraints.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script goes beyond billing or pricing lookup and enumerates detailed customer resource inventory, including resource IDs, names, project IDs, parent relationships, lifecycle timestamps, and service metadata. In a skill advertised as billing-only, this is an unnecessary expansion of accessible data and increases the risk of unauthorized infrastructure discovery and sensitive metadata exposure.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The accepted arguments enable broad customer resource enumeration by resource ID, order ID, status, expiration window, service type, and customer ID, which is not justified by the stated Terraform billing/pricing support purpose. This creates an unnecessary discovery surface that can be used to map customer assets and account relationships under the guise of a billing helper.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This script performs a province-list lookup via the BSS client, which is not aligned with the skill manifest’s declared billing/pricing-only purpose. In an agent setting, this kind of scope drift is dangerous because it expands authenticated capabilities beyond what users and policy reviewers expect, undermining least privilege and increasing the chance of unintended data access or misuse.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script enumerates all Huawei Cloud service types via ListServiceTypesRequest, which does not match the declared skill scope of billing, balances, orders, refunds, or pricing inquiry. This scope drift matters because it broadens the agent’s reachable data surface and enables generic cloud catalog reconnaissance under a billing-labeled skill, increasing the chance of unauthorized or unintended information access.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script accepts a --region argument and updates the Region variable, but the Huawei Cloud client is always constructed with BssRegion.CN_NORTH_1. This creates a misleading interface where operators may believe they are querying one region while the request is actually sent to another, which can lead to incorrect billing data retrieval, audit mistakes, and operational decisions based on false assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The script allows querying enterprise-wide or sub-customer billing data via the --method and --sub_customer_id parameters, which expands access beyond a narrowly scoped Terraform pricing/billing lookup. In a multi-tenant enterprise context, this can expose other accounts' billing summaries and customer identifiers if the executing credentials have broad BSS privileges, creating an unnecessary data exposure path.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script performs ECS flavor enumeration, which is an infrastructure discovery capability unrelated to the skill's declared billing/pricing-only purpose. Even though it is read-only, exposing resource catalog and regional availability details expands the skill's operational scope and can aid reconnaissance, especially when users or downstream agents trust the manifest to constrain behavior.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code intentionally implements broad infrastructure discovery by paging through flavor data, supporting filtering, sorting, and enumeration across regions and availability zones. In the context of a Terraform billing-support skill, this unjustified discovery surface is risky because it can be repurposed to map cloud capabilities and available compute options beyond the user's expected billing inquiry workflow.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script performs ELB control-plane inventory enumeration by listing load balancer flavors, which exceeds the skill's declared billing/pricing-only scope. This kind of scope drift is dangerous because an agent authorized to answer pricing questions could be induced to access unrelated infrastructure metadata, violating least privilege and potentially enabling broader cloud reconnaissance.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script's stated behavior goes beyond the skill's declared billing-only purpose by preparing a general Huawei Cloud environment and claiming resource-service validation. In a billing inquiry skill, broader cloud access validation increases credential exposure and encourages unnecessary privilege use outside the expected scope.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/ensure_env.py:284