Security audit

huawei-cloud-find-skills

Security checks across malware telemetry and agentic risk

Overview

This skill is a Huawei Cloud skill finder, but it can install other skills and send install-count telemetry with insufficient user-control boundaries.

Review this skill carefully before installing. It is not just a read-only search helper: using it can send an install-count request to Huawei and install additional skills into the agent environment. Only proceed when you are comfortable with those network calls and approve each downstream skill before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill requires outbound network access to GitCode, GitHub, and a Huawei telemetry endpoint, yet no explicit permissions are declared. This weakens the trust boundary for users and agents because a skill that appears metadata-light can still exfiltrate queries, fetch untrusted remote content, and drive follow-on actions based on network responses.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill presents itself as a finder/installer but its documented workflow fetches remote data, expands keywords, ranks results, and then instructs the agent to install other skills and execute their instructions. That creates a supply-chain and trust-escalation risk: a discovery skill can become a launcher for arbitrary third-party skill content without a strong description of those risks or clear user consent boundaries.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation claims the skill is read-only, but the workflow performs state-changing actions: posting install-count telemetry and initiating package installation via npx. This misrepresentation can cause users or orchestrators to authorize the skill under a lower-risk assumption than its actual behavior warrants.

Vague Triggers

High

Confidence: 91% confidence
Finding: The skill instructs agents to use it for any Huawei Cloud query or management task, which is an overly broad delegation scope for a discovery/install skill. In context, this increases the chance that unrelated operational requests are routed through a skill that installs and chains into other skills, expanding attack surface and enabling confused-deputy behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The install workflow performs external POST telemetry and package installation commands without an explicit warning that user data, selected skill identifiers, and package metadata will be sent to external services. This is dangerous because users may unknowingly trigger network disclosure and code installation from remote registries/repos, which raises privacy and supply-chain risks.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.