huawei-cloud-gitsync-nativetest

• Outcome: Review
• Latest audit: Aug 16, 2026 · 3:09 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent MaaS usage-monitoring purpose, but it uses cloud credentials with unsafe TLS defaults and automatically reports execution details to a separate operations endpoint.

Use Review before installing. The MaaS query behavior is understandable, but install only if you are comfortable with default external quality reporting and can disable or contain it with SKILL_QUALITY_DISABLE=1. Do not use this with production Huawei credentials unless TLS verification is fixed, credentials are least-privilege, and secret files are protected and never printed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 93% confidence
• Finding: The SDK sends telemetry to an endpoint controlled by the SKILL_QUALITY_ENDPOINT environment variable, so a hostile or misconfigured runtime can redirect sensitive execution data to an arbitrary server. Because the payload includes skill metadata and may include masked-but-still-sensitive inputs, outputs, and error context, this creates a real exfiltration channel rather than a benign configurable callback.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation indicates capabilities to read environment variables, read local credential files, and make network requests, but those capabilities are not explicitly declared in a permission model. This reduces transparency and can cause users or orchestrators to invoke a skill that accesses sensitive data sources and external services without clear consent boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The manifest presents the skill as a MaaS statistics query tool, but the documentation discloses additional behavior: external telemetry reporting on every run, credential loading from arbitrary user-specified files, and API-key filtering. Hidden or under-disclosed side effects are dangerous because they expand data exposure and attack surface beyond the user's reasonable expectations, especially when execution metadata and possibly error details are sent to a third-party endpoint.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill reports trace IDs, status, error codes, and timing to an external operations console on each execution, even though that behavior is not necessary to fulfill the user's stated task of querying MaaS usage statistics. Any automatic outbound reporting creates a risk of leaking operational metadata, user workflow details, and possibly sensitive error context to an external domain.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is advertised as a read-only monitoring utility, but the documentation reveals undisclosed outbound reporting side effects on every run. This mismatch undermines informed consent and trust, and it can expose execution context to an external service without users realizing that using the skill causes additional network activity beyond the Huawei Cloud API call.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script imports and uses a telemetry/reporting SDK that sends execution metadata to a separate operations console on every run, which is outside the user-declared purpose of querying MaaS usage statistics. Even if described as non-blocking and limited to trace/status/cost, this creates undisclosed data exfiltration risk and expands trust boundaries beyond Huawei MaaS APIs.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The top-level documentation presents the tool as a MaaS statistics query script, while an embedded comment reveals that each run also reports metadata to an operations console. This documentation/behavior mismatch is dangerous because it hides a secondary data flow from reviewers and users, undermining informed consent and making the telemetry harder to detect.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements outbound telemetry reporting to a third-party operations endpoint, which is unrelated to the skill's declared purpose of querying Huawei Cloud MaaS usage statistics. Hidden or undocumented secondary network behavior is dangerous because it expands the trust boundary and can leak operational data from every skill execution.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The report payload captures input parameters, output results, error messages, and full exception stacks and sends them externally. The masking is regex-based and incomplete, so credentials, prompts, API responses, identifiers, and internal paths can still be exposed, making this a significant data leakage risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Although telemetry reporting is mentioned, the documentation does not clearly warn users before operation that execution metadata is sent to an external operations console. Insufficient notice is dangerous because users may provide or process sensitive operational data under the assumption that the skill only communicates with Huawei Cloud APIs.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The troubleshooting guide explicitly shows `requests.post(..., verify=False)` when sending a signed request, which disables TLS certificate validation and enables man-in-the-middle interception or tampering of API traffic. In this skill context, the request carries Huawei Cloud AK/SK-signed authentication material and usage data, so disabling certificate verification is especially dangerous because it can expose sensitive credentials-in-use and allow forged responses.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation explicitly tells users to run `cat /path/to/aksk.txt`, which prints secret access credentials directly to the terminal and potentially into shell history, screen recordings, logs, or shared sessions. In a cloud-account context, exposing AK/SK pairs can enable unauthorized API access and compromise billing, data, or service configuration.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The verification workflow instructs users to export real cloud credentials and perform live API calls, but provides no warning about handling secrets safely or using least-privilege/test credentials. This increases the chance of credential leakage and accidental use of production accounts during validation, especially in copied terminal sessions or automated environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The end-to-end script hardcodes an example credential file path under a home directory and uses it in a live command without any warning about protecting that file. This normalizes unsafe secret-file handling and can lead users to store long-lived credentials in predictable locations that may be exposed through scripts, screenshots, backups, or permissive file permissions.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The code disables TLS certificate verification for HTTPS requests and suppresses related warnings, which permits man-in-the-middle interception of signed API traffic. In this skill's context, the requests carry cloud authentication material and usage data, so transport downgrading materially increases the chance of credential compromise, request tampering, and response spoofing.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The SDK performs external telemetry transmission of execution details without any user-facing warning or in-code consent mechanism. In a skill intended only for MaaS statistics queries, silent collection and export of runtime data materially increases privacy and security risk, especially in multi-tenant or enterprise environments.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The SDK design explicitly states that it reports desensitized inputs/outputs and stacks to a remote operations service. Even when summarized, such telemetry can contain business data, model prompts, identifiers, or internal error details, and the skill's declared functionality does not justify this export.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The implementation confirms that automatic reports include input_param, output_result, error_msg, and full_stack for external transmission. Full exception traces and runtime payloads frequently contain secrets, tokens, internal endpoints, prompts, and response bodies, so this is a concrete sensitive-data exposure risk.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

req_headers[k] = v

    url = f"https://{host}{signed_req.uri}"
    return requests.request(method, url, headers=req_headers, data=body, verify=False, timeout=30)


def get_project_id(ak, sk, region):

• Confidence: 99% confidence
• Finding: Using verify=False makes insecure transport the default for all outbound HTTPS requests. Because this skill authenticates to cloud APIs with AK/SK-signed requests and processes account usage data, the unsafe default meaningfully increases exposure to interception and tampering in any hostile or misconfigured network environment.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/maas_rest_usage_stats.py:92