huawei-cloud-dds-list

• Outcome: Review
• Latest audit: Aug 16, 2026 · 10:52 AM UTC
• Version: 1.0.0

Overview

The skill’s DDS listing function is read-only, but it automatically sends execution telemetry and summarized results to an external operations endpoint by default.

Install only if you accept the telemetry behavior. Use a least-privilege DDS read-only IAM user, verify the KooCLI installer source, and set SKILL_QUALITY_DISABLE=1 unless you explicitly approve sending execution metadata and summarized DDS results to the configured operations endpoint.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 97% confidence
• Finding: The SDK sends telemetry to an endpoint controlled by the SKILL_QUALITY_ENDPOINT environment variable, and the payload can include inputs, outputs, error messages, and stack traces. Because the skill’s stated purpose is only to list DDS instances, allowing environment-configured outbound exfiltration of execution data materially expands the trust boundary and creates a real data-leak path if the endpoint is changed or the default service is not trusted.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises read-only DDS listing behavior but clearly relies on shell execution, network access, and environment-derived credentials without declaring those capabilities. Undeclared capabilities reduce transparency and policy enforcement, making it easier for a seemingly harmless inventory skill to access secrets or communicate externally in ways operators did not authorize.

Description-Behavior Mismatch

Low

• Confidence: 97% confidence
• Finding: The documentation states the skill only queries DDS instances, but it also sends execution telemetry including trace_id, status, error code, and timing to an external operations console. This is a security-relevant mismatch because users and reviewers may authorize the skill under a read-only cloud inventory assumption while it performs an additional outbound data transfer.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: Execution-quality reporting introduces an extra networked capability unrelated to the core function of listing DDS instances. Even if the reported fields appear limited, any external reporting path expands the attack surface and can leak operational metadata such as usage patterns, failures, tenant activity timing, or identifiers if the implementation evolves or is misconfigured.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The verification document states that every run reports execution data to an operations console, which introduces outbound data transmission behavior beyond the skill’s stated read-only DDS-listing purpose. Even if the payload is limited to trace ID, status, error code, and cost, this creates an undocumented side effect and expands the trust boundary to an external service.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Telemetry to a skills operations console is not necessary to fulfill the stated function of listing DDS instances, so it represents unnecessary data egress and hidden functionality. This mismatch is security-relevant because operators may approve a read-only inventory skill without realizing execution metadata is being transmitted elsewhere.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code adds external execution-quality reporting that transmits operational data unrelated to the declared DDS-listing function. That mismatch is security-relevant because users and reviewers would reasonably expect a read-only cloud inventory skill not to export execution context to a separate remote service.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The module documentation explicitly describes automatic reporting of trace IDs, timing, status, masked parameters, outputs, and stacks to an operations platform, which exceeds the manifest claim that the skill only queries DDS instances and is read-only. This hidden secondary behavior undermines transparency and can expose sensitive cloud metadata or user-provided values during routine execution.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs users to execute a remote script via `curl ... | bash`, which runs unreviewed code from the network directly in the shell. If the hosting endpoint, transport path, or script content is compromised, this can lead to arbitrary code execution on the system performing the installation. In an agent/CI context, the risk is higher because such environments may hold cloud credentials or broad access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document describes telemetry collection and reporting without a clear warning to the user at execution time, so users may unknowingly transmit metadata about their environment and usage. Lack of transparent disclosure undermines consent and can expose sensitive operational details such as invocation patterns, errors, and regional usage context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The reporting path transmits execution data to a remote endpoint without any user-facing notice or consent mechanism in the skill. Even with some masking, inputs, outputs, and error details can still contain tenant identifiers, instance metadata, query filters, or other sensitive operational context.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The SDK collects agent identifiers from environment variables and includes them in outbound reports. While lower risk than input/output capture, it still leaks execution-environment metadata that is unnecessary for a DDS-listing skill and may aid profiling of the hosting platform.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The SDK is designed to upload inputs, outputs, error codes, and stack traces to an external operations endpoint in natural language. Natural-language payloads are especially risky because they can contain cloud resource names, user queries, exception content, and secret-adjacent context that simple regex masking may miss.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The decorator automatically captures function arguments, results, and exception details, then reports them on both success and failure paths. In the context of a cloud inventory skill, those values can include tenant/project metadata, resource identifiers, filters, and error traces, creating continuous routine leakage rather than an edge-case bug.

Static analysis

No suspicious patterns detected.