huawei-cloud-dws-list

• Outcome: Review
• Latest audit: Aug 16, 2026 · 10:52 AM UTC
• Version: 1.0.0

Overview

This skill performs the advertised read-only Huawei DWS listing, but its optional wrapper automatically reports cloud inventory inputs, outputs, errors, and stack data to a configurable telemetry endpoint.

Install only if you are comfortable with the wrapper's quality reporting. Prefer the direct hcloud command or set SKILL_QUALITY_DISABLE=1 unless you control and trust the reporting endpoint; use a least-privilege Huawei IAM user with only dws:cluster:list, and avoid running the eval-based test script on modified or untrusted copies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 96% confidence
• Finding: The SDK sends telemetry to an endpoint taken from environment configuration without any trust restriction, allowing runtime data to be exfiltrated to an attacker-controlled host if the environment is influenced. Because the payload includes skill metadata, sanitized inputs/outputs, and potentially stack traces, this creates a meaningful data-leak channel even if the original skill is only supposed to list DWS cluster names.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs use of shell commands, external network access to Huawei Cloud APIs, and access to local credential state via the CLI, but does not declare permissions or boundaries for those capabilities. That creates a trust and governance gap: an agent may execute a networked shell workflow with ambient credentials without explicit least-privilege approval, increasing the chance of unintended data exposure or misuse.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill advertises that it 'only returns cluster names', but it also records execution input and output into a quality reporting context. That creates an undeclared data flow of cloud metadata such as region, enterprise project identifier, cluster count, and cluster names to another component, which may violate least surprise, privacy expectations, or tenant data-handling requirements.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Execution-quality telemetry is an additional capability beyond listing DWS cluster names and is not justified by the stated function of the skill. In a cloud inventory context, even seemingly modest metadata can reveal internal asset structure and operational patterns, increasing exposure if the reporting backend is compromised or unauthorized.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a generic telemetry/reporting SDK rather than logic for listing DWS clusters, which is a clear mismatch with the declared skill purpose. Such hidden extra capability increases risk because it can capture and transmit execution data unrelated to the user-requested DWS inventory operation.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code explicitly packages input parameters, output results, error messages, and full stack traces and posts them over HTTP to a reporting endpoint. For a skill whose stated function is only to return DWS cluster names, this is over-collection and creates a concrete confidentiality risk if any sensitive cloud identifiers, tokens, or internal errors appear in those fields.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The SDK silently performs telemetry that includes execution content without a user-facing disclosure or explicit consent path. In the context of a simple DWS listing skill, hidden reporting is especially concerning because users would not reasonably expect their inputs, outputs, and failures to be exported.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script reads test case commands from templates/test-vars.json and executes them with eval, which allows arbitrary shell metacharacters, command substitution, and chained commands to run in the current environment. Because the JSON file is treated as data but directly interpreted as shell code, any attacker who can modify the skill contents or test definitions can achieve arbitrary command execution during testing.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The SDK is designed to automatically report summarized inputs, outputs, and full exception information to an endpoint on every run. This automatic memory-and-transmit behavior is dangerous because it operationalizes continuous data egress from a skill whose expected behavior should be limited to querying and returning DWS cluster names.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The decorator and context manager transparently hook normal execution and ensure that user-provided inputs and produced outputs are remembered and sent during both success and failure paths. This makes the data collection pervasive and hard to notice, amplifying the confidentiality impact relative to the declared DWS-listing purpose.

Static analysis

No suspicious patterns detected.