Security audit

huawei-cloud-ecs-query

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but it can expose ECS passwords and console login URLs while using cloud credentials, installing dependencies, and disabling TLS verification.

Install only if you are comfortable giving the skill Huawei Cloud credentials that can read ECS inventory and potentially retrieve passwords and console login URLs. Use a tightly scoped test account or temporary credentials, avoid granting password/console permissions unless needed, do not run it on networks where disabled TLS verification is unacceptable, and treat any printed passwords or console URLs as secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises read-only ECS querying but declares no permissions while instructing execution of shell scripts, dependency installation, environment-variable access, network calls, and local file writes. This weakens user and platform transparency and can enable unexpected credential use, filesystem changes, and outbound access without explicit consent boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior diverges materially from the claimed scope: beyond read-only ECS inventory, it may expose sensitive access artifacts such as server password data and VNC/console URLs, call IAM for credential/project discovery, install dependencies, create environments, and persist project identifiers locally. Scope mismatch is dangerous because users may authorize a seemingly harmless query skill that actually performs credential validation, local modification, and retrieval of sensitive remote-access data.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The guide documents `show_server_password.py` with the purpose 'Query ECS server password' even though the skill metadata claims a read-only ECS query scope. Retrieving instance passwords exposes highly sensitive credentials and materially exceeds ordinary inventory/query semantics, creating a dangerous capability mismatch that can lead to unauthorized system access if invoked or surfaced to users.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code globally sets `http_config.ignore_ssl_verification = True`, which disables TLS certificate validation for all Huawei Cloud API traffic made through this configuration. That enables man-in-the-middle interception or tampering of requests and responses, including exposure of AK/SK credentials or security tokens, which is especially dangerous because this skill authenticates to cloud IAM and ECS APIs.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script explicitly retrieves an ECS server password, which goes beyond the skill's declared read-only inventory/query scope and introduces secret-access capability. In a skill presented as safe for resource inspection, hidden or undocumented password retrieval materially increases abuse potential and violates least privilege expectations.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code calls the cloud API to obtain a server password and then handles it as application output, exposing a sensitive secret unrelated to ordinary ECS inventory inspection. Because the skill context is advertised as read-only resource querying, this secret-retrieval path is especially dangerous: users or downstream tooling may invoke it without realizing it can disclose credentials.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script does more than passive ECS inventory/querying: it requests and prints a live remote console URL for a server. A remote console session can provide interactive access to an instance outside the narrow scope implied by a read-only discovery skill, materially increasing the risk of unauthorized access or misuse if invoked by an agent or exposed to an untrusted user.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The stated skill purpose is ECS querying and inventory inspection, but this code constructs a ShowServerRemoteConsole request that initiates access to a server console endpoint. In this context, the capability is mismatched to user expectations and expands the attack surface, because an operator may trust the skill as read-only while it can obtain access artifacts for direct instance interaction.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is described as a read-only ECS query tool, but this helper creates a virtual environment, installs software, re-executes itself, and later persists data locally. That broadens the trust boundary from cloud querying to local system modification, which is dangerous in an agent skill because users may invoke it expecting non-invasive behavior.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script validates credentials by calling IAM user-listing APIs, which exceeds the declared ECS-query scope and touches identity-management data. In a skill advertised as read-only ECS querying, this unnecessary expansion increases sensitivity and can expose metadata about users and permissions.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The script executes local system and package-management commands unrelated to simply querying ECS resources, including venv creation and software installation helpers. In an agent setting, that creates a substantial local execution surface and can alter the host unexpectedly.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script downloads get-pip.py from the network and executes it locally, effectively running remote code as the current user. Combined with the global TLS-verification bypass in this file, this creates a severe supply-chain and man-in-the-middle risk.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The docstring claims ECS service availability verification, but the implemented checks primarily call IAM APIs instead. Misleading security-relevant documentation can cause operators to approve behavior they do not expect, especially in an agent skill advertised as read-only ECS querying.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Overly broad trigger phrases increase the chance the skill is auto-selected in ordinary cloud discussions, causing unneeded environment checks, credential use, or exposure of infrastructure metadata. In this context the risk is amplified because the skill can execute scripts, access secrets from environment variables, and query live cloud inventory.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill includes VNC/remote-console retrieval without prominently warning that the output may contain sensitive remote-access information that can facilitate unauthorized access or session hijacking if exposed. In an infrastructure skill, console URLs and related access artifacts are materially sensitive and should be treated more like secrets than ordinary metadata.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide instructs users to download and immediately execute a shell script from the network with curl and bash, but provides no integrity verification, signature checking, or safety warning. If the hosting location, transport path, or published artifact were compromised, users could run arbitrary code on their systems during installation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The Windows instructions tell users to download and run an executable installer without any authenticity or integrity validation guidance. A tampered installer or compromised distribution endpoint could lead to arbitrary code execution on the user's workstation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The credential examples show direct handling of access keys and secret keys but omit warnings about secure storage, shell history exposure, file permission hygiene, and use of least-privilege IAM credentials. Users may paste long-lived cloud secrets into commands or environment variables in insecure ways, increasing the risk of credential leakage and unauthorized cloud access.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Describing server password retrieval without any warning, sensitivity labeling, or handling guidance normalizes access to credentials as a routine query. In practice, passwords are secrets that can enable direct compromise of cloud instances, lateral movement, and persistence if displayed, logged, or returned to untrusted requesters.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide advertises `show_server_remote_console.py` as obtaining a VNC remote login address but provides no warning that console access can grant privileged interactive access to the instance. Even if framed as 'query,' console endpoints are operationally sensitive and can be abused for direct administration or bypass of normal network access paths.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The serial console login address is presented as a simple query result without warning, but serial console access often provides powerful low-level access useful for recovery, debugging, or privileged intervention. Exposing such access details can facilitate unauthorized control of instances, especially when normal network controls are bypassed or unavailable.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The sample policy is presented as a least-privilege read-only policy, but it includes highly sensitive read actions such as `ecs:serverPassword:get` and `ecs:serverRemoteConsole:get`. That can expose credentials or console access paths and may mislead operators into granting broader access than expected, especially because the documentation does not warn that these permissions are more sensitive than ordinary inventory queries.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The verification steps instruct operators to run scripts that validate credentials and query live Huawei Cloud ECS resources, but they do not warn that the commands will use configured cloud credentials and may print account inventory and resource metadata to the terminal or logs. In a verification document, this creates a real risk of unintended disclosure of cloud asset information and accidental use of production credentials during testing.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Outbound IAM API requests are built from the same insecure HTTP configuration, so certificate verification is disabled when retrieving project information from IAM. Because IAM handles identity-scoped operations and uses cloud credentials, an attacker positioned on the network or proxy path could spoof endpoints, capture sensitive tokens, or alter API responses without detection.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Printing the server password directly to stdout can leak credentials into terminal scrollback, logs, CI output, chat transcripts, agent traces, or other observability systems. This creates immediate credential exposure risk and can enable unauthorized access to the ECS instance if those outputs are retained or shared.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/ensure_env.py:284