Security audit

huawei-cloud-computing-query

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a Huawei Cloud query tool, but it also exposes server passwords and console URLs, disables TLS verification, and makes local setup changes that are not fully scoped for a read-only query skill.

Install only if you are comfortable giving the skill Huawei Cloud credentials with permission to read sensitive instance access data. Use least-privilege AK/SK credentials, avoid running password or console scripts unless explicitly needed, treat their output as secret, and be aware the skill disables TLS verification and performs local dependency setup.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no permissions, yet its own instructions require shell execution, network access, environment-variable access, and file writes via environment bootstrapping and virtualenv/package installation. This hidden capability expansion weakens platform trust boundaries and can lead users or orchestrators to approve a skill as low-risk when it can actually execute code, modify the host environment, and access cloud credentials.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a read-only cloud query tool, but the documented/observed behavior includes environment bootstrapping, package installation, writing derived project IDs, and retrieval of sensitive password data for ECS/BMS. That mismatch is dangerous because operators may authorize execution expecting harmless metadata lookup, while the skill can expose secrets and make persistent host changes outside the declared scope.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The guide exposes a capability to retrieve ECS server passwords, which goes beyond ordinary inventory-style read queries and enables access to sensitive authentication material. In a skill advertised as query-only for cloud resources, documenting credential retrieval materially increases the chance of unauthorized access or secret disclosure if invoked or surfaced to users without strict controls.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: Retrieving a VNC remote console address is not merely descriptive resource querying; it enables an access path into compute instances. Because the manifest frames the skill as read-only cloud resource querying, this hidden access-enablement capability broadens the attack surface and may let users obtain sensitive connection details they were not expected to access.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: Serial console login address retrieval similarly enables operational access rather than simple metadata inspection. When omitted from the skill’s declared scope, it creates a dangerous mismatch between expected behavior and actual capability, increasing the risk of unauthorized console access or abuse.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script exposes a Windows bare metal server's initial password, which is a sensitive credential, even though the skill is described as a read-only resource-query capability. In this skill context, returning credentials is more dangerous because users and downstream systems may trust the manifest and invoke the skill expecting only metadata retrieval, leading to accidental secret disclosure and possible unauthorized host access.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code explicitly sets `http_config.ignore_ssl_verification = True`, disabling TLS certificate validation for all Huawei Cloud API requests. This allows a man-in-the-middle attacker on the network or via a configured proxy to intercept or modify responses, exposing cloud credentials and falsifying queried resource data; the read-only nature of the skill reduces write risk but does not prevent credential theft or sensitive metadata disclosure.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The warning suppression comment and `urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)` normalize insecure transport by hiding the very warning that would alert developers or operators that TLS verification has been disabled. This makes the underlying SSL bypass harder to detect and more likely to persist in production, increasing exposure to interception attacks.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script adds a secret-retrieval capability to a skill described as read-only cloud resource querying. It obtains an ECS server password and prints it directly to stdout, creating a clear mismatch between declared behavior and actual sensitive access, which can enable credential disclosure through normal tool use, logs, or downstream agent handling.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code fetches a server password and emits it verbatim with print(password), exposing a live secret-bearing value through standard output. In agent and automation environments, stdout is often captured in transcripts, logs, or tool results, so this can leak credentials well beyond the immediate caller.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This script does more than passively query metadata: it invokes the API that generates a live remote console session descriptor and then prints the returned console URL. That URL can grant interactive access to the target server console, so exposing it in stdout, logs, transcripts, or downstream tooling can leak privileged access material beyond the intended operator.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: For a read-only Huawei Cloud query skill, automatically creating a virtual environment and re-executing the script expands behavior beyond simple querying into local environment mutation. This increases trust and attack surface on the user's machine and is especially concerning in agent-skill contexts where users may expect non-invasive read-only behavior.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script attempts to install Python automatically using OS package managers and elevated commands such as sudo, which is unrelated to the stated read-only cloud-query purpose. In an agent skill, unexpected system-level installation behavior can modify the host, trigger privilege escalation prompts, and create a supply-chain risk surface far beyond the minimum required capability.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script downloads and executes get-pip.py from external URLs, while global TLS verification has been disabled earlier in the file. Executing fetched bootstrap code on the user's machine is a serious supply-chain risk and is unjustified for a read-only cloud query skill.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill metadata says there are no write operations, but on success the script writes a .project_id file into the project directory and mutates environment state. This mismatch can mislead users and automated policy systems about the actual side effects of running the skill.

Intent-Code Divergence

Medium

Confidence: 81% confidence
Finding: The docstring claims the script validates project-level service availability via ECS API, but the implementation only calls IAM ListUsers and never performs the stated ECS availability check. This is a security-relevant integrity issue because it misrepresents what the script does and may cause users to trust a validation step that is not actually happening.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide explicitly documents a capability to retrieve a Windows bare metal server's initial password and presents it as a routine query operation without any warning about secret handling, access control expectations, or output redaction. In a cloud infrastructure skill, credential material is highly sensitive; normalizing its retrieval increases the risk of inadvertent disclosure in logs, transcripts, or to users who should not receive credentials directly.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The guide describes obtaining a VNC remote login address for a bare metal server without noting that the URL is a remote-access artifact that may grant or facilitate console access. Even if the URL is not sufficient alone in every deployment, exposing or casually handling it can leak access pathways and operationally sensitive infrastructure details.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The guide documents server password retrieval with no warning that the returned value is a secret requiring strict handling. This can normalize unsafe use, increase accidental disclosure in transcripts or logs, and facilitate compromise of cloud instances if the output is exposed to unauthorized parties.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Remote console access details are sensitive because they can provide a direct path to instance interaction, especially if URLs or tokens are time-bound credentials. Omitting any warning may cause operators or downstream systems to treat the information as harmless metadata and expose it improperly.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Serial console login details are sensitive operational access information, not ordinary status data. Without warnings or handling guidance, users may disclose or persist this information insecurely, enabling unauthorized troubleshooting access or deeper host interaction.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Printing the Windows bare metal server password directly to stdout can leak credentials into terminal history, logs, orchestration output, CI systems, or chat transcripts. Because this skill is framed as a cloud resource query tool, operators may run it in low-scrutiny contexts where stdout is broadly captured, increasing the chance of credential compromise.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Requests are performed with SSL verification disabled and there is no user-facing or operator-facing warning that transport security has been weakened. In this skill, users may trust returned ECS/BMS/IMS/AS data for operational decisions, so silent acceptance of spoofed API endpoints or tampered responses can mislead investigations and also expose AK/SK credentials in transit.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The script retrieves a server password without any warning, secondary confirmation, or contextual validation that the caller intended to access credentials. Because the skill is framed as a general query/browsing tool, this makes accidental or socially engineered disclosure more likely and reduces friction around accessing highly sensitive data.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Printing the remote console URL directly to standard output can disclose a live access token or session endpoint to anyone who can view terminal history, CI logs, agent traces, chat transcripts, or observability systems. Because the URL is effectively access-enabling data rather than ordinary resource metadata, treating it as normal output materially increases the chance of unauthorized server access.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/ensure_env.py:284